Draft — requires professional review
This Privacy Policy is a working draft, written in plain English to describe how KohiShifa actually works today. It has not yet been reviewed by a qualified lawyer and may change before commercial launch. Clauses we already know need specialist review are marked “Requires professional legal review before launch”.
At a glance
Here is the short version. The rest of this policy explains each point in detail, and nothing in this summary limits the full text below.
- We don’t sell your dataWe don’t sell or rent personal information, and we don’t use it for advertising.
- No trackers on this siteNo analytics, ad networks, tracking pixels or third-party scripts. Our fonts are self-hosted.
- Your records stay yoursAccount data is protected by row-level security, so each person can reach only their own records.
- AI only if you opt inThe AI companion needs sign-in and your explicit consent. Reflections are never sent to it automatically.
- Export or delete any timeDownload everything as JSON, delete your tracking data or close your account from Settings.
- Not a medical servicePlease don’t enter medical histories, diagnoses or medication lists. KohiShifa is for everyday wellness.
Who we are
KohiShifa Wellness AI (“KohiShifa”, “we”, “us”, “our”) is a general-wellness web app for adults. It helps people build everyday routines with habit tracking, hydration logging, a sleep-routine journal, a reflection journal, mindfulness exercises, activity planning, personal goals and weekly insights, plus an optional AI companion.
This policy covers the website at kohishifa.com (including the interactive demo), KohiShifa accounts and everything inside them, our early-access waiting list and our contact form. It applies to everyone who uses them, wherever they live, although some sections only apply in particular countries or US states.
KohiShifa is operated by [KohiShifa legal entity name], [registered address]. For people in the United Kingdom and the European Economic Area (EEA), we are the “controller” of the personal information described here, which means we decide why and how it is used.
Requires professional legal review before launch. The legal entity name, registered address and company number must be completed before launch. Confirm whether the UK ICO data protection fee is payable, and whether a UK or EU representative is required under Article 27 of the UK GDPR / GDPR if the entity is established elsewhere.We’re an early-stage, independently funded company. Some features described below only run once the related service has been switched on. For example, accounts only exist when our database and sign-in service are configured, and the AI companion only works once it has been set up behind sign-in. Where that matters, we say so.
What we collect
We try to collect as little as possible. What we hold depends entirely on how you use KohiShifa:
| When | What we collect | Where it’s kept |
|---|---|---|
| Browsing the website | No analytics, advertising or tracking cookies. Like any website, our hosting provider receives standard request data — your IP address, browser and device type, the page requested and the time — to deliver pages and protect the service. | Our hosting provider, Vercel |
| Site preferences | Your light or dark theme choice, if you make one (kohishifa-theme). | Your browser’s local storage only |
| Interactive demo | Sample habits, logs, goals and other demo entries you add or change (kohishifa-demo-v1). | Your browser’s local storage only — never sent to us |
| Your account | Email address and password (handled by our sign-in provider, which stores passwords in hashed form); authentication cookies whose names begin with sb-; and your profile: display name, daily water, sleep and activity goals, preferred units, and the date and time you consented to the AI companion, if you do. | Supabase (managed database and sign-in) |
| Tracking features | Habits and the days you complete them; water logs; sleep logs (bedtime, wake time, an optional 1–5 “how rested” rating and a short note); activity logs (type, title, duration, planned or done, and a note); goals and your progress towards them. | Supabase, linked to your account |
| Reflections | A mood label you choose, the prompt you answered (if any) and the free text you write. We treat reflections as potentially sensitive. | Supabase, linked to your account |
| AI companion | The messages you type and recent chat context you submit. Account habits and private journal entries are not automatically included. Usage records contain token counts, time and outcome, never your message content. | Messages: sent to the configured Google Gemini or Anthropic Claude API, not stored by KohiShifa. Usage records: Supabase. Chat history: in-memory in your browser tab. |
| Early-access waiting list | Your email address, the feature you’re most interested in (optional), the page you signed up from, and the time you gave consent. | Supabase, written by our server only |
| Contact form | Your name, email address, the topic you choose and your message. | Supabase, written by our server only |
| Abuse protection | When you submit a form, your IP address is turned into a salted, one-way hash and held briefly to limit repeated requests. We don’t store raw IP addresses. | Short-lived server memory and access-restricted database counters; expired database counters are cleaned up on later form requests |
Information we don’t ask for
We don’t ask for — and you shouldn’t enter — medical histories, diagnoses, medication lists, insurance details, government ID numbers, payment card details or your precise location. KohiShifa doesn’t connect to wearables or health platforms and doesn’t measure anything about your body: every number in your dashboard comes from something you entered yourself.
Cookies and browser storage
We only use storage that’s needed for the site to work: sign-in cookies when you have an account, your theme choice, demo data that stays on your device, and the current AI conversation while your tab is open. There are no analytics, advertising or tracking cookies. The full list, with durations, is on our Cookie Preferences page.
How we use information
We use personal information only for the following purposes:
- To provide KohiShifa. Saving your entries, showing your dashboard, and calculating streaks, completion rates and weekly insights. Insights are calculated from your own records — not from other people’s data, and not from anything we infer about you.
- To run your account. Signing you in, keeping your session secure, and sending essential account emails, such as a sign-up confirmation or password-reset link, through our sign-in provider.
- To generate AI replies you ask for. Only after you’ve opted in, and only using what you send with that message.
- To manage AI usage. Using token counts and outcome categories — never conversation content — to apply fair usage limits, control costs and understand how often safety messages are shown.
- To keep the service safe. Rate limiting, spam checks on forms (such as hidden fields and timing checks) and investigating misuse.
- To reply to you. Answering messages sent through our contact form or by email.
- To send early-access updates. Only to people who joined the waiting list and agreed to hear from us about it.
- To meet legal obligations and to establish, exercise or defend legal claims.
Things we don’t do
- We don’t sell or rent personal information.
- We don’t use personal information for advertising, and we don’t build advertising profiles.
- We don’t use your content — tracking entries, reflections or AI conversations — to train AI models.
- We don’t share your information with data brokers, advertisers, insurers or employers.
- We don’t make decisions about you based solely on automated processing that have legal or similarly significant effects.
Legal bases for UK and EEA users
If you’re in the UK or the EEA, data protection law (the UK GDPR and the EU GDPR) requires us to have a legal basis for each way we use personal information. We rely on the following:
- Contract — to provide your account and the features you use, including storing and showing your entries, exporting your data and deleting it when you ask.
- Consent — for the AI companion and for early-access emails. You can withdraw consent at any time; doing so doesn’t affect processing that has already taken place.
- Legitimate interests — to keep KohiShifa secure (rate limiting, abuse prevention and hosting logs), to answer messages you send us, and to understand overall AI usage so we can keep the service affordable. We weigh these interests against your rights, and you can object to them (see Your choices and rights).
- Legal obligation — where we must keep or disclose information to comply with the law.
Some things you choose to record — sleep notes, mood labels or reflections, for example — could reveal information about your health, which data protection law treats as “special category” data. Where that’s the case, the law requires an additional condition for processing it. We’re confirming the right condition with our advisers, including whether we should ask for your explicit consent before you use these features.
Requires professional legal review before launch. The legal bases above, the Article 9 condition for health-related data (and whether explicit consent must be collected in the product), and whether a data protection impact assessment (DPIA) is required must be confirmed by UK/EU data protection counsel.You also have the right to complain to a data protection regulator — in the UK, the Information Commissioner’s Office (ICO); in the EEA, the supervisory authority where you live. We’d appreciate the chance to resolve your concern first, so please get in touch.
US state privacy rights
A growing number of US states give residents specific privacy rights — including California (under the CCPA, as amended by the CPRA), Colorado, Connecticut, Virginia, Texas, Oregon and others. Depending on where you live, these may include the right to:
- know what personal information we collect, use and disclose, and get a copy of it;
- correct inaccurate personal information;
- delete personal information;
- receive your information in a portable format;
- opt out of the “sale” or “sharing” of personal information, targeted advertising and certain kinds of profiling;
- limit the use of sensitive personal information; and
- not be treated differently for exercising any of these rights.
We don’t sell or share personal information as those terms are defined in California law, we don’t use it for targeted (cross-context behavioural) advertising, and we don’t use sensitive personal information to infer characteristics about you. Because we don’t track you for advertising, there is nothing for a Global Privacy Control or “Do Not Track” signal to switch off. If that ever changes, we’ll honour those signals.
Categories of personal information
The categories we collect are: identifiers (such as your name and email address); internet activity (request data processed by our hosting provider); account login credentials; information you choose to record about your routines and wellbeing, which may include information concerning your health; and other information you give us, such as goals and messages. The sources, purposes and recipients are described in What we collect, How we use information and Service providers.
Consumer health data
Some states have laws that specifically protect “consumer health data” — for example, Washington’s My Health My Data Act, and similar laws in Nevada and Connecticut. These laws can cover wellness information such as sleep, mood or activity entries, even when an app isn’t medical. We collect this kind of information only to provide the features you ask for. We don’t sell it, we don’t share it except with the service providers that help us run KohiShifa, and you can access or delete it at any time. We don’t collect precise location and don’t use geofencing.
Requires professional legal review before launch. Confirm which US state privacy and consumer health data laws apply (including thresholds), whether a separate consumer health data privacy policy and consent flow are required under Washington’s My Health My Data Act and Nevada SB 370, the required California notice-at-collection wording, authorised-agent handling and the appeal process some states require.To exercise any of these rights, see Your choices and rights. You may use an authorised agent, and if we decline a request you can appeal by replying to our decision with “Appeal” in the subject line. We aim to honour these requests for everyone, wherever you live.
Sensitive information and reflections
Wellness information is personal. Even if you never type a diagnosis, sleep notes, mood labels and reflections can say a lot about you. Here’s how we handle them:
- We don’t ask for medical information. KohiShifa isn’t designed to hold medical histories, diagnoses or medication lists. Please keep entries to everyday routines and thoughts.
- Your records are private to you. Row-level security in our database means your entries can only be read or changed by your own signed-in account.
- Reflections are never sent to the AI automatically. The AI companion receives only what you type into it, not any habit summary or journal record automatically. If you paste reflection text into a message yourself, it is sent like any other message.
- Not for advertising, profiling or AI training. Your reflections are used only to show them back to you.
- Delete any time. You can delete a single reflection, all of your tracking data, or your whole account.
- Limited internal access. Our policy is that people working on KohiShifa don’t read the content of your entries. Access to production systems is restricted and used only when necessary — for example, to investigate a problem you’ve asked us to help with, to keep the service secure, or where the law requires it.
Please don’t record other people’s sensitive information, such as details about a friend’s or family member’s health, in your entries.
Requires professional legal review before launch. Confirm the internal access controls described here are in place before launch (who holds production database access and how that access is logged), and whether mood and reflection data need additional safeguards as special category or consumer health data.The AI companion
The AI companion is optional. Every other part of KohiShifa works without it.
Before you use it
The companion only works when you’re signed in and have given explicit consent. We record the date and time you consented in your profile. If the companion hasn’t been set up yet, you’ll see a “Coming soon” state and nothing is sent anywhere.
What is sent, and to whom
When you send a message, KohiShifa sends it through our server to the currently configured provider: Google Gemini or Anthropic Claude. The request includes your typed message and recent conversation context needed for continuity. We do not automatically send your tracked habits, goals, or journal entries.
What we keep
We don’t store the content of your AI conversations on our servers. Your chat history lives only in your browser tab in memory and disappears when you close or reload the tab. We do store usage records (token counts, the time and an outcome category) so we can apply usage limits. These records don’t contain what you wrote.
Safety messages
If a message contains words or phrases suggesting someone may be in crisis, KohiShifa shows a fixed safety message with crisis resources instead of an AI reply. We do not send screened crisis messages to the model and do not persist their content; see our Wellness Disclaimer for the resources it lists.
How AI providers handle your messages
The configured provider (Google for Gemini or Anthropic for Claude) processes submitted content under its own commercial terms and privacy policies. Provider retention, processing locations and use of API content depend on the applicable account and agreement; please consult their current published policies. KohiShifa itself does not use your conversations to train AI models.
Requires professional legal review before launch. Confirm the active Google or Anthropic account's commercial terms, data processing agreements, retention settings and processing locations before launch. No vendor data-retention promise is assumed.You can withdraw your consent in Settings, by emailing privacy@kohishifa.com or by deleting your account. Withdrawing consent stops future processing; it can’t recall messages that were already sent to generate a reply.
Service providers and sharing
We use a small number of service providers to run KohiShifa. They process personal information on our behalf, under contract, and only for the purposes in this policy. Each one is involved only when the related feature is switched on.
| Provider | What they do | Information involved |
|---|---|---|
| Supabase | Managed Postgres database and sign-in, when accounts, the waiting list or the contact form are enabled | Account, profile, tracking data, reflections, AI usage records, waiting-list sign-ups and contact messages |
| Vercel | Planned hosting and delivery of the website and app | Request data such as IP address, browser type and the pages requested |
| Google or Anthropic | Google Gemini or Anthropic Claude, depending on deployment configuration; only when you consent and send a message | Messages you submit to the companion and recent chat context; no automatic account summaries |
We don’t use advertising networks, data brokers or analytics providers.
Other situations where we may disclose information
- Legal requirements. If we’re required to by law, a court order or a valid request from a public authority. Where we’re allowed to, we’ll tell you first.
- Safety. If we believe in good faith that disclosure is necessary to protect someone’s life or safety, or to prevent fraud or abuse of the service.
- Business changes. If KohiShifa is involved in a merger, acquisition or sale of assets, personal information may transfer to the new owner, who must keep protecting it as this policy describes. We’ll tell you before that happens.
- At your direction. When you ask us to, for example by exporting your data.
International transfers
People use KohiShifa in the US, the UK and elsewhere, and our service providers may process information in the United States and other countries whose data protection laws differ from yours.
When we transfer personal information out of the UK or EEA to a country that hasn’t been recognised as providing adequate protection, we rely on a recognised safeguard — such as the UK International Data Transfer Agreement or Addendum, the EU Standard Contractual Clauses, or a provider’s certification under the EU–US Data Privacy Framework and its UK Extension. You can ask us for more information about the safeguard that applies.
Requires professional legal review before launch. Confirm where each provider stores and processes data (including the Supabase project region), which transfer mechanism applies to each provider, and complete transfer risk assessments where required.How long we keep information
We keep personal information only for as long as we need it. Our intended retention periods are:
| Information | How long we keep it |
|---|---|
| Account, profile and tracking data | Until you delete it or delete your account. Deleting your account permanently removes your profile, habits, logs, reflections, goals and AI usage records. |
| Individual entries and reflections | Until you delete them, or your account. |
| AI conversation content | Not stored on our servers. Your browser keeps it until you close the tab. |
| AI usage records | For as long as your account exists; deleted with your account. |
| Early-access waiting list | Until KohiShifa launches and we’ve let you know, or sooner if you ask us to remove you. |
| Contact messages | Up to 24 months after our last reply, then deleted — unless we need them for an open issue or a legal claim. |
| Rate-limiting hashes | Held in server memory for a short window (currently about ten minutes) and never written to storage. |
| Hosting request logs | According to our hosting provider’s log retention settings. |
| Demo data and theme choice | In your browser until you clear them — see Cookie Preferences. |
If our database provider keeps backups for disaster recovery, deleted information may remain in those backups for a limited period until they are overwritten in the normal cycle. We may also keep information for longer where the law requires it, or where it’s needed to resolve a dispute or enforce our terms.
Requires professional legal review before launch. These retention periods are intended behaviour. Confirm them — including database backup retention and hosting log retention — against provider settings and legal requirements before launch.How we protect information
We use practical safeguards that match how KohiShifa is built:
- Row-level security. Every table that holds your data is protected by database policies that let a signed-in person read and change only their own records.
- Encryption in transit. Connections to KohiShifa and between our services use HTTPS (TLS).
- Least-privilege keys. Powerful server credentials stay on the server and are never sent to browsers. The waiting list and contact form are written through our server, not directly from your browser.
- Hashed identifiers. For rate limiting, IP addresses are converted into salted, one-way hashes used in temporary memory and database counters. Raw IPs are not stored by this application limiter.
- Abuse protection. Same-origin checks, rate limits and spam checks on public forms.
- Collecting less. We don’t collect what we don’t need, so there is less to protect.
No system is perfectly secure, and we don’t claim any security certification. If we become aware of a breach affecting your personal information, we’ll notify you and the relevant regulators where the law requires. You can help by using a strong, unique password and keeping your login details private.
Requires professional legal review before launch. Confirm breach-notification procedures and timelines, such as notifying the ICO within 72 hours where UK GDPR requires it, and the notice requirements of US state breach laws.Your choices and rights
In the app
- Export: download a copy of all your data as a JSON file from Settings.
- Correct: edit your profile, goals and entries at any time.
- Delete entries: delete individual reflections, or all of your tracking data at once.
- Delete your account: permanently delete your account and its data from Settings.
- AI companion: decide whether to use it and which messages to send. Your tracking records are not included automatically.
- Browser storage: reset your theme or clear demo data on Cookie Preferences.
By request
Depending on where you live, you may also have the right to access, correct, delete or port your information; to restrict or object to certain uses (including those based on legitimate interests); to withdraw consent; and to complain to a regulator.
To make a request, email privacy@kohishifa.com or use our contact form and choose “Privacy”. Tell us what you’d like us to do and which email address your account uses. To leave the early-access waiting list, email us and we’ll remove your details.
To protect your account, we verify requests — usually by asking you to confirm from the email address linked to your account. We won’t charge you for a reasonable request, and we won’t treat you differently for exercising your rights. We aim to respond within one month, or within the time your local law requires, and we’ll tell you if we need longer.
Requires professional legal review before launch. Confirm response timelines (one month under UK GDPR / GDPR, extendable in some cases; 45 days under the CCPA and similar state laws), identity-verification steps, authorised-agent handling and the appeal process.Children
KohiShifa is for adults aged 18 and over. It isn’t directed at children, and we don’t knowingly collect personal information from anyone under 18. If we learn that an account belongs to someone under 18, we’ll close it and delete the associated data. If you believe a child has given us personal information, please contact us at privacy@kohishifa.com.
Changes to this policy
We’ll update this policy as KohiShifa changes — for example, when a planned feature launches, or after our legal review. The “Last updated” date at the top shows when it last changed.
If we make a material change, such as using information in a new way or adding a new kind of service provider, we’ll tell you in the app or by email before it takes effect, and ask for your consent where the law requires it. We won’t start using analytics, advertising or tracking cookies without first updating this policy and our Cookie Preferences page.
Contact us
We’re a small team and we read every message. You can reach us at:
- Privacy questions and requests: privacy@kohishifa.com
- Everything else: hello@kohishifa.com
- Online: our contact form
- By post: [KohiShifa legal entity name], [registered address]
Related reading: our Terms of Service, Wellness Disclaimer and Cookie Preferences.