Privacy Policy

This Privacy Policy explains what personal information the Clarity mobile application and related websites (together, the “Service”) collect, how we use it, and the choices you have. If you disagree with anything below, please do not install or use the Service.

1. Data controller

JSCreatorPro (“we”, “us”, “our”) is the data controller for personal data processed through the Service. Questions, access requests, or deletion requests: privacy@jscreatorpro.app.

2. What we collect and why

2.1 Account data

• Email address & display name — to create and recover your account (Firebase Authentication).
• Firebase UID — internal identifier; not PII on its own.
• Subscription tier & credit balance — to enforce your plan quotas.

2.2 Content you create

• Journal entries, tasks, lessons completed, flashcards, meditations finished, meal logs, weight, mood — stored on-device by default; eligible modules can sync to cloud only when you explicitly enable cloud sync.
• Creator Studio output history, PDF Studio signature vault/output state, Resume Builder drafts, and E-Sign Vault signatures are stored on your device and are not cloud-synced.
• Bank statements you upload for StatementIQ — processed only for the duration of parsing, then deleted. We do not store the PDF, and we do not store the filename, project metadata, or extracted transactions on our servers. Signing in from another device or the web shows an empty list — by design.

2.3 Device & permission data (opt-in, per feature)

2.4 Diagnostic data

Firebase Crashlytics and Google Analytics for Firebase collect anonymous crash reports and aggregated usage counts (“opened Learn tab 4 times”). No free-text content of your notes, journals, or statements is ever included. You can disable analytics in Profile → Privacy & Sync.

2.5 Per-feature data handling — required vs optional

This is the canonical per-feature breakdown. “Required” means the feature cannot work without that data; “Optional” means you can use the feature without it (you may lose part of the experience). “On-device” means the data never leaves your phone unless an explicit opt-in cloud sub-feature is used.

Reading the table: if a row has only “Optional data” and the “Where it lives” column is on-device, then by default nothing about that feature ever leaves your phone.

3. AI processing and where credits are used

Clarity uses both on-device AI (deterministic, private, free) and cloud AI (billed in credits).

Cloud requests include only the minimum content needed (e.g. the sentence to translate, the prompt to generate). They are sent over TLS. Our AI sub-processors (listed in §10) contractually agree not to retain request content for training.

4. Financial data (StatementIQ, Vault)

Clarity is not a bank, broker, credit reporting agency, or lender. We do not access your bank accounts; we only parse statement PDFs or CSVs that you upload, and we do not store the original file. The Credit Coach and Bill Negotiator features provide coaching suggestions only based on numbers you self-report. They are not credit repair services and are not governed by the US Fair Credit Reporting Act (FCRA), the Gramm-Leach-Bliley Act (GLBA), nor equivalent regimes. The Portfolio Rebalance feature provides educational guidance only; it is not personalised investment advice and does not recommend specific securities.

5. Legal basis for processing (GDPR / UK GDPR)

• Contract (Art. 6(1)(b)) — to deliver the features you use.
• Consent (Art. 6(1)(a)) — for optional permissions (mic, camera, location, analytics, marketing emails). Withdraw any time in settings.
• Legitimate interest (Art. 6(1)(f)) — fraud prevention, abuse detection, aggregate product analytics.
• Legal obligation (Art. 6(1)(c)) — tax records for paid subscriptions.

6. Your rights

Regardless of where you live, you can:

• Access the personal data we hold about you
• Correct or update it
• Export a copy (JSON + CSV)
• Delete your account and all associated data
• Opt out of analytics and marketing
• Object to automated decision-making (none of our AI features makes legally significant automated decisions about you)

EU/UK residents also have the right to lodge a complaint with a supervisory authority. California residents have additional rights under the CCPA/CPRA (right to know categories sold — we do not sell personal data — and right to limit use of sensitive data). Indian residents have rights under the DPDP Act 2023.

7. Data retention

• Account + content: until you delete it or close your account.
• StatementIQ uploads: bank and credit-card statement PDFs are processed in-memory only and are deleted as soon as parsing finishes (typically within 60 seconds). We do not retain your statement PDFs while your account is active. Extracted transactions, filenames, and project metadata are stored only on the device that uploaded them — if you sign in from another phone, tablet, or the web, your StatementIQ history will be empty. Only anonymised usage counters (page count, success/failure) are kept on the server, and only for billing limits.
• Other uploaded files (e.g. profile images): deleted from our servers within 60 minutes of upload completion if you did not save them.
• Diagnostic logs: 90 days rolling.
• Subscription & payment records: 7 years (tax law).

7.1 Personal exports and chat attachments

Health Report, Food Log, and Cycle Tracking exports are user-initiated personal exports through the operating system share sheet (for example WhatsApp or personal email). StepUp chat is text-only and does not accept user file attachments.

8. Children

Clarity is an 18+ service and is not directed to minors. We do not knowingly collect personal data from anyone under 18. Contact us and we will delete it.

9. International transfers

Clarity is operated globally by JSCreatorPro Pte. Ltd. (incorporated in Singapore) and uses the sub-processors listed in §10 below, based in the US, EU, and Singapore. International transfers are protected by Standard Contractual Clauses (SCCs) and, where applicable, the EU–US Data Privacy Framework.

10. Sub-processors

These are the only third parties that ever receive any data associated with your account, and only the minimum listed below. None of them receive your journals, AI prompts, AI outputs, health metrics, financial data, statement PDFs, or location history.

10.1 What our partners never receive

Under no circumstances do we share any of the following with advertising networks, survey providers, analytics vendors, or any third party for their own purposes:

• Your journal entries, voice notes, or AI reflections
• Your AI prompts or AI-generated outputs
• Your health metrics (mood, sleep, weight, heart rate, steps, meals)
• Your financial data (statement content, transactions, balances, budgets, credit coach inputs)
• Your bank statement PDFs (processed then deleted; see §7)
• Your GPS route tracks (these never leave your device)
• Your email address or display name

When a feature needs a third party to work (e.g. a rewarded survey), we share only the minimum identifier required (typically a Firebase UID). We do not build or sell marketing segments, look-alike audiences, or data-broker profiles.

11. Security

TLS 1.2+ in transit; AES-256 at rest on Google Cloud SQL (PostgreSQL, managed by Google Cloud in asia-southeast1); Firebase App Check on every API call; secrets scoped to Cloud Run service accounts; no third-party JS on authenticated screens. Sensitive free-text content (journal bodies, AI reflections) is additionally encrypted client-side with AES-GCM using a user-held key before upload. We support biometric lock on the app (Profile → Privacy & Sync → Require Face ID / Fingerprint).

12. Changes

We will notify you in-app and by email at least 14 days before any material change to this Policy takes effect.

13. How we communicate with you

We keep communication simple and limited:

• Email only, for external contact. We contact you by email for: account security and recovery, billing and receipts, subscription changes, legal / privacy notices, and direct replies to your support requests. The only addresses we use are support@jscreatorpro.app, billing@jscreatorpro.app, and privacy@jscreatorpro.app.
• Premium weekly / monthly summary reports — if you opt in (Profile → Email Notifications → Weekly Report or Monthly Report), we send you a PDF summary of your app activity by email. This is an opt-in feature and can be turned off at any time in the same setting, or by emailing privacy@jscreatorpro.app with subject line "Unsubscribe from Clarity Summary".
• In-app push notifications — optional reminders, streak nudges, and session summaries. These are generated by the app on your device via Firebase Cloud Messaging; they are a product feature, not marketing. You can turn them off in Profile → Notifications or in your OS settings.
• We do not send SMS or make phone calls. We will never ask for your password, two-factor code, or payment details by email, SMS, or phone. If you receive such a message claiming to be from Clarity, it is not from us — please forward it to privacy@jscreatorpro.app.
• No shared mailing lists. Your email address is never sold, rented, or shared with marketers or third parties. We do not operate affiliate mailing lists or ad-network sync lists.

14. Contact

JSCreatorPro Pte. Ltd. (incorporated in Singapore) — privacy@jscreatorpro.app
EU representative: available on request.