Privacy Policy
Shora — AI-Powered Emotional Wellness
Last updated: September 2026
What We Collect
- Account info: Email address (if you register), display name.
- Mood & journal data: Mood check-in responses, journal entries, and sentiment vectors derived from your text.
- Session data: Which sessions you complete, duration, and post-session feedback.
- Device info: Device locale/language preference for personalization.
How We Use It
- To personalize session recommendations using our Thompson Sampling algorithm.
- To generate guided audio via text-to-speech services.
- To track your streaks, stats, and progress.
- To improve the app experience based on aggregated, anonymized usage patterns.
Analytics & Diagnostics
To understand how Shora is used and keep it stable, the app collects
usage analytics (Firebase Analytics: events such as sessions started and
completed, screens viewed, and feature usage, tied to a pseudonymous user
and app-instance identifier, never your journal text or reflections),
crash reports (Firebase Crashlytics: crash stack traces and device
state), and performance data (Firebase Performance Monitoring: app start
and network timings).
The same "Share usage analytics" switch also controls Layers,
which we use to tell whether a link someone followed actually led to an
install, and to see how many people finish onboarding or come back for
another practice day. It receives the short list of events described
under Third-Party Services below, and never your journal text, your
reflections, or the mood you picked.
You can turn either off at any time in the app under
Profile → gear icon → Privacy. "Share usage
analytics" and "Send crash reports." The same screen shows your User ID,
which you can include in support requests so we can help you faster.
Our Website (shoraapp.com)
This section covers the website only. It does not change anything in the app.
- Cloudflare Web Analytics: counts page views without cookies and without fingerprinting you. Cloudflare derives your country from your IP address.
- Google Analytics and Google Ads measurement: with cookies, these record which pages you view, which site sent you here, whether you tapped an App Store or Google Play button, your approximate location, and your device and browser type. Google Ads also uses a click identifier to tell whether a visit came from one of our ads.
- Your choice: if you are in the European Economic Area, the United Kingdom or Switzerland, these cookies stay off unless you accept them in the cookie notice. Elsewhere they are on by default. Anyone can change their choice at any time with Cookie settings in the page footer. We store your choice in your browser.
- When cookies are off: Google's tags still send basic signals without cookies, such as that a page loaded and what your cookie choice is, which Google uses to estimate totals.
- No ad targeting: we switch ad personalization off for every visitor, so none of this is used to build ad audiences or to show you ads on other sites.
Third-Party Services
- Firebase (Google): Authentication, database, storage, hosting, analytics, crash reporting, and performance monitoring.
- Google Analytics and Google Ads (website only): Site analytics and ad measurement, as described under Our Website above.
- Cloudflare Web Analytics (website only): Cookie-free page view counts.
- ElevenLabs: Text-to-speech audio generation (your personal data is not sent; only session script text).
- Google Vertex AI: Sentiment analysis of journal text (processed server-side).
- RevenueCat: Subscription and purchase management.
- OneSignal: Push notification delivery. Receives your User ID, a device push token, your app language, a few non-identifying flags we use to choose which reminder wording to send, and the text of the notification itself, which can include your practice streak. Their SDK also records standard device and connection details such as device model, operating system version, time zone and IP address. We never send journal entries, reflections, or the name of a mood you picked.
- Layers: Install attribution and product analytics, controlled by the same "Share usage analytics" switch described above. Receives a short list of app events, such as starting or finishing a practice, completing onboarding, viewing or dismissing the upgrade screen, and the day count of your practice streak. It also receives randomly generated device, install and session identifiers, your device model, operating system version, language, time zone and screen size, and the campaign tags of the link you installed from. Their servers see your IP address and derive an approximate city from it. We switch advertising consent off on every event and remove advertising identifiers before anything is sent. We never send journal entries, reflections, mood values, session or protocol names, your email address or your account ID.
Data Storage & Security
Your data is stored in Google Cloud (Firebase) with encryption at rest and in transit. We do not sell your data to third parties.
Account Deletion
You can delete your account and all associated data at any time:
Deletion removes your profile, journal entries, session history, audio cache, and subscription. If you signed in with Apple, your Apple token is revoked. The action is immediate and cannot be undone.
Contact
Questions? Email us at support@shoraapp.com
