ENDE

Privacy Policy

Last updated: July 2026

1. Overview

AngerApp is designed with privacy as a core principle. All core features work entirely on-device. We do not sell your data to third parties.

2. Data We Collect

On-Device Only (Free Tier): Anger entries, journal logs, personal sequences, and usage data remain exclusively on your device. We cannot access this data.

Website Analytics: We use Google Analytics 4 (GA4) to understand how visitors use our website. This is gated behind your cookie consent. GA4 data is pseudonymised with a truncated IP and is not used to identify you individually.

Contact Forms: When you submit a contact or beta signup form, we collect your name and email to respond to your inquiry. This data is processed via Resend and stored securely.

Beta Feedback Survey: If you choose to submit the optional Beta Feedback Survey on /get-started, your responses are processed by Tally Forms SAS on our behalf. The survey iframe is only loaded if you have accepted cookies. The data collected includes:

  • NPS score and launch-readiness assessment
  • Usage frequency and per-module ratings (Anger Flow, Breathing, Meditation, Hypnosis)
  • Interest in future AI-based features (Need-Finder, Communication Helper)
  • Learning-module usage, look-and-feel feedback, and fulfilment assessment
  • Any free-text answers you provide
  • The email, first name, and platform you arrived with (passed via URL from your beta-signup link)

State of Anger 2026 Survey: If you choose to take part in the State of Anger 2026 survey on /anger-survey, your responses are processed by Tally Forms SAS on our behalf. The embedded survey is only loaded if you have accepted cookies; otherwise you can open it directly on tally.so. Responses are anonymous (no personal details are required) and results are published exclusively in aggregate form, never as individual responses. If you voluntarily provide your email address at the end of the survey, we use it solely to send you the finished report (Art. 6(1)(a) GDPR); you can withdraw at any time.

6-Week Email Course: If you sign up for the free 6-week email course, then after you confirm via double opt-in we store your email address, first name, start date, language, and course progress. The legal basis is your consent (Art. 6(1)(a) GDPR); your timestamped confirmation serves as proof (Art. 7 GDPR). This signup is its own thing, separate from the newsletter. The emails are sent via Resend and the enrollment data is stored with Upstash. You can unsubscribe at any time via the link in every email; we then delete your enrollment. After the course finishes, the record is automatically deleted after about 90 days.

Embedded Videos (YouTube): Some blog articles offer an optional technique video. No connection to YouTube or Google is made when you open the page. Only if you click the play button is the video loaded from YouTube's privacy-enhanced player (youtube-nocookie.com); at that point YouTube (Google Ireland Ltd. / Google LLC, US) receives your IP address and device information. Your click constitutes consent for that individual video (Art. 6(1)(a) GDPR, §25 TDDDG).

AngerApp Mobile App: The app is built so your personal content (anger entries, journal logs, personal sequences, panic-album images and usage data) stays on your device. A small number of services process limited data, and only for the specific function you use:

  • Guided audio downloads (Cloudflare R2): When you choose to download a guided meditation or hypnosis session, the audio file is delivered from our content-delivery network (Cloudflare R2). Cloudflare receives standard web-request metadata: your IP address, the requested file path and your device user-agent. The transfer is download-only; nothing from your device is uploaded, and no account is involved.
  • Subscriptions and purchases (RevenueCat): When paid plans are active, we use RevenueCat to manage purchases and unlock the features you bought. RevenueCat processes your purchase, receipt and entitlement data together with an anonymous RevenueCat identifier. No account, name or email address is created or shared. (Payments themselves are charged by Apple or Google; see below.)
  • Cloud backup & sync and entitlements (Supabase): If you turn on optional cloud backup and sync, or hold a paid or Founding-Member entitlement, we use Supabase, our backend database, to store the content you choose to sync and to record your subscription, Founding-Member and referral status. This is keyed to a pseudonymous identifier, not your name or email. Cloud sync stays off unless you enable it; the app is fully usable on-device only.
  • Daily reminders: Reminder notifications are scheduled locally on your device. No push token is generated and nothing is transmitted to us or any third party.
  • “Send feedback” button: If you tap Send feedback, the app opens your own email application with a message pre-filled with your app version, device model and OS version, addressed to our angerapp.io support address. The message is sent through your own email provider; we receive only what you choose to send.
  • Panic-album images: Any photos you add to your calming album are stored locally and are never uploaded.
  • Referrals: If you arrive through a referral or share link, we record the referral code so we can credit the person who referred you, and the reward is applied to your entitlement. We do not build a profile about you from it.
  • App stores (Apple / Google): The app is distributed, and payments are processed, by the Apple App Store and Google Play. Your store account and payment data are handled by Apple or Google under their own privacy policies.

AI Features: Two features use an AI language model, and only when you actively use them: the website's Angry Message Translator, and the app's Chat Training coaching conversation. Both send the text you enter in that session to a vetted external provider, currently Anthropic (Claude), under a full Data Processing Agreement and appropriate security measures, solely to produce your reply. Your input is not used to train AI models and is not tied to your name or an account. Chat Training is off by default and, because the conversation can touch sensitive feelings, is gated behind your explicit consent (Art. 9(2)(a) GDPR). The app's other features, including the Emotional Check-In and the NeedFinder, run entirely on your device with no AI and no network connection. These AI features are optional; please avoid entering details you would not want processed by an AI model.

3. Legal Basis (GDPR)

We process data under Art. 6(1)(a) GDPR (consent) for analytics, optional embedded content, the optional AI features and cloud backup & sync; Art. 6(1)(b) GDPR (performance of a contract) for contact-form responses, guided-audio delivery, subscription and entitlement management and referral rewards; and Art. 6(1)(f) GDPR (legitimate interest) for the limited technical metadata needed to deliver files you request and to handle feedback you send us.

4. Data Retention

Contact form submissions are retained for up to 12 months. You may request deletion at any time by contacting privacy@angerapp.io.

5. Your Rights

Under GDPR, you have the right to access, rectify, erase, restrict, and port your personal data. Contact privacy@angerapp.io for any requests.

6. Cookies

We use cookies for analytics (GA4) only, and only with your consent. See our Cookie Policy for details.

7. International Data Transfers and Sub-Processors

We use the following sub-processors:

  • Resend (Resend Inc., US/EU): transactional email and audience management for contact forms and beta signup. SCCs in place per GDPR Art. 46.
  • Tally Forms SAS (France/EU): beta feedback survey on /get-started and the State of Anger 2026 survey on /anger-survey. EU-based, with a published DPA and sub-processor list at tally.so/help/gdpr-compliance. Embedded surveys only load if you accept cookies.
  • Google Analytics 4 (Google LLC, US): pseudonymised website analytics with truncated IP, only with your cookie consent.
  • YouTube (Google Ireland Ltd. / Google LLC, US): optional technique videos on blog articles, loaded via the privacy-enhanced youtube-nocookie player only after you click play. No data flows to YouTube before that click.
  • Cloudflare (Cloudflare, Inc., US): content-delivery network hosting guided-audio files for optional in-app download. Processes standard request metadata (IP address, file path, user-agent) when you download a file. SCCs in place per GDPR Art. 46.
  • RevenueCat (RevenueCat, Inc., US): in-app purchase and subscription management. Processes purchase, receipt and entitlement data plus an anonymous RevenueCat identifier; no account, name or email. Dormant until paid plans launch. SCCs in place per GDPR Art. 46.
  • Supabase (Supabase, Inc., US/EU): backend database for subscription entitlements, the Founding-Member allocation, referral rewards and optional cloud backup & sync. Stores a pseudonymous identifier plus the content you choose to sync. SCCs in place per GDPR Art. 46.
  • Anthropic (Anthropic PBC, US): external AI language model (Claude) powering the website message translator and the app's Chat Training feature. Processes the text you submit in that session to generate a reply; does not train on your input; operates under a Data Processing Agreement. SCCs in place per GDPR Art. 46.
  • Upstash (Upstash, Inc., US): serverless data store. It holds anonymous counters, such as the vote tallies on the /roadmap page and internal usage counts, and, if you sign up for the 6-week email course, your course enrollment record (email, first name, start date, language and progress). Roadmap voting stores no personal data: only the item's identifier is sent, and whether you have already voted is remembered by your browser alone. SCCs in place per GDPR Art. 46.

Your personal app data (journal entries, anger logs, panic-album images) is stored locally on your device and is never transmitted to AngerApp servers or any sub-processor.

8. Data Security

Your personal content stays on your device and is never sent to us. Where data must leave your device (downloading audio, managing a purchase, or sending feedback) it travels over encrypted (TLS/HTTPS) connections. Transfers to sub-processors outside the EU are covered by Standard Contractual Clauses. Because we do not operate a central database of your personal app content, there is by design very little that could ever be exposed.

9. US Users / California Residents (CCPA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA):

  • Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you.
  • Right to Delete: You may request deletion of personal information we have collected from you, subject to certain exceptions.
  • Right to Opt-Out of Sale: AngerApp does not sell your personal information to third parties. This right is therefore not applicable.
  • Right to Non-Discrimination: We will not deny services, charge different prices, or provide a different level of service based on your exercise of CCPA rights.

To exercise your rights, contact us at privacy@angerapp.io. We will respond within 45 days as required by law.

10. Contact

Data Controller: AngerApp.io LLC, represented by Dr. Johannes Hangl (Managing Member)
Email: privacy@angerapp.io

Privacy Policy · AngerApp