Privacy Policy

LeWell is operated by LEWELL Co., Ltd., Bangkok, Thailand ("LeWell", "we", "us", or "our"). We are the data controller for personal data we decide how and why to process. Contact privacy@lewell.app with privacy questions or requests.

LeWell is intended only for people aged 18 or older. We do not knowingly create or maintain accounts for anyone under 18, and we ask for a date of birth before an account can be completed or continued where age was not previously confirmed.

This Policy covers information processed through available features and records retained from earlier versions of LeWell.

Waitlist records: We retain email addresses and signup-source information previously submitted through the website waitlist.

Account and legal records: We collect your email address, username, password hash if you use a password, and identifiers supplied by Google or Apple if you use social sign-in. We never receive your Google or Apple password. Apple may provide a private relay email. Your date of birth is required to check age eligibility. We record the legal-document versions and time you accepted them, plus your optional usage-data and device-health connection choices and any permission history retained from earlier versions. Information required to create, secure, or verify eligibility for an account is necessary to use an account; optional profile answers and usage analytics can be declined.

Guest onboarding draft: Before you create or sign in to an account, the device stores the goals, optional profile answers, units, learning schedule, reminder choice, and progress needed to resume onboarding. The draft expires after seven days without an update and is removed when the app next reads it, or after successful onboarding. Credentials and tokens are never included. We do not record or buffer guest analytics interactions before consent. Draft answers are uploaded only after successful account creation or sign-in, acceptance of the current Terms, acknowledgement of this Policy, and your decision to continue.

Profile and personalization: We process goals and saved learning subjects, learning and reminder preferences, units, timezone, onboarding version and progress, and offer status. We use these details to resume your experience and recommend learning content. These recommendations do not make legal or similarly significant decisions about you. We also save your selected app language with your account to display the interface, localize notifications and prepare available downloads.

We keep the initial goals saved when you first complete onboarding and a history of later goal changes, including their time and source. Accepted lesson, quiz, practice, and Challenge completions record the content, completion time, local date, timezone, and related goals, topics, and Masteries. App version, platform, and available release identifiers help us distinguish experiences. These first-party records support progress, personalization, and aggregate reporting of completed and repeated actions; they do not establish a health benefit.

Health and wellness information: You provide your date of birth and may provide optional biological sex and weight during onboarding, nutrition or routine information, and health or emotional details in practice responses. Earlier versions also allowed mood check-ins, step logs, activity logs, and health readings such as resting heart rate, heart rate variability, blood glucose, blood lipids, and sleep. This information can be sensitive personal data.

We use optional body-profile answers and health information you choose to provide for related personalized guidance when those features are available. Mood check-ins, step logging, health-metric screens, and device-health syncing are unavailable in the current MVP. This change does not delete records created in earlier versions; retained records are handled under the retention and deletion terms in this Policy. To ask about retained account data, contact privacy@lewell.app. Skipping optional questions does not remove purchases or learning progress.

Earlier versions used mood check-ins, step logs, and activity records to calculate first-party Insights, including daily and weekly averages, trends, and associations between check-ins and activity. These user-facing mood, step, and health-metric features are unavailable in the current MVP. We do not use these records to make legal or similarly significant decisions about you.

Earlier versions could read steps, active energy, exercise minutes, resting heart rate, heart rate variability, and sleep duration from Apple Health or Health Connect where supported, with separate device permission. Access was read-only; LeWell did not write to those services. The current MVP does not request device-health permissions or read new data from Apple Health or Health Connect, even if permission was previously granted in device settings. This feature change does not delete readings already copied to your LeWell account or historical permission records; they remain subject to this Policy.

Learning-path records: We store your selected path and content version, focus, progress and activity times, plans, optional usefulness ratings, and follow-up choices. We also keep available entry-source or campaign context and identifiers needed to prevent duplicate updates. These records support your learning path and are deleted with the account. They do not establish a health benefit.

Offline learning and saved submissions: To let you resume during a connection or service outage, we save an account-specific copy of your last successfully loaded profile, Journey, progress, known access state, and available learning content on your device. The app automatically prepares available written lessons, quizzes, and practices in your selected language. Offline audio is not guaranteed: audio already in an account-specific device cache may play offline while its access window is valid; uncached audio requires a connection. These copies may include your selected goals, authored quiz choices, completion identifiers, and a practice's existing personalized default target. They do not include your private free-text responses or personalized AI feedback.

Unfinished private practice drafts are separate from submitted work. Activity completions and submitted quiz answers can be saved durably for later server checking. Private practice answers enter this queue only when you explicitly choose Submit. It can contain your answers, including sensitive reflections you chose to submit, the activity and content version, timing evidence, a unique request identifier, and retry or review status. When service returns, LeWell can send that saved submission using the same account after its sign-in, age and current legal eligibility checks succeed. If the activity calls for AI feedback, that processing can then send your submitted response to the provider described below. An unfinished draft is not automatically submitted, and offline use does not generate personalized AI feedback on your device. Saved progress controls let you retry, review or remove saved submissions. Removing a local copy cannot recall a request already received by the server or an AI provider.

Learning and social activity: We process lesson and practice progress, quiz answers and scores, XP, gold, gems, streaks, challenges, follows, connections, reactions, and other actions needed to provide the Service.

When you view another person's profile, we temporarily record both internal account IDs and the local date to produce anonymous daily view counts and notifications. We do not currently show the viewer's identity to the viewed account or send the viewer-profile pair or viewed username to PostHog.

Practice responses and AI feedback: When you request AI feedback under the Terms, we process your response, including health or emotional information you choose to include, and send it with the relevant practice instructions to Anthropic's commercial Claude API. We do not attach your account ID or email address, but the response itself may contain identifying information. You can choose not to submit a response and use other learning features. AI feedback evaluates responses against activity requirements; it is not a medical assessment. Avoid including information about another person or details you do not want processed for this purpose. Anthropic does not use commercial API inputs or outputs to train its models by default. Under its standard retention, Anthropic may retain inputs and outputs for up to 30 days, with longer retention possible for safety, abuse prevention, or legal obligations. Responses that form part of your LeWell history, such as commitments and check-ins, remain in your account until deleted.

Optional practice feedback: After completing a practice, you may rate whether it helped. We save the selected rating and its time with that completed practice in your account until deleted. This feedback is optional, works independently of Share usage data, and is not sent to AI providers or PostHog. Skipping does not affect your progress or rewards.

Optional product analytics: If you opt in to Share usage data, PostHog receives selected events about onboarding, feature use, plan engagement, time spent, purchases, trials, and retention. PostHog starts only after you are authenticated and your choice is recorded. We identify the analytics profile using an internal account ID and may attach coarse product properties such as level, Premium status, and whether your account has legacy catalog access or requires subscription activation. When an opted-in event is sent, PostHog uses the request's IP address to derive approximate location properties, for example country and region. This is network-derived location, not GPS or precise device location, and we use it only for aggregate product analytics, not advertising. We do not send your email, username, raw birth date, sex, height, weight, practice text, user-created routine names, user-selected reminder times, or health-reading values to PostHog. PostHog data is hosted in the EU. If you decline, no PostHog product analytics are sent from your device. You may change this choice in Settings at any time.

With the same optional usage-data choice, we also store account-linked first-party records of recommendations actually shown, their content, rank, reason and goal context, and explicit selections, dismissals or changes. An explicitly selected recommendation may be linked to a completed practice. Optional usefulness ratings are linked to completed actions; they are not medical assessments. We record observed foreground sessions and dates, session identifiers, app/platform/release and onboarding versions, and available campaign/source labels and referring website hostname observed after consent. We do not collect full attribution URLs, private query parameters, advertising identifiers, or pre-consent guest activity for this measurement. Selected recommendation, completion and usefulness context may also be sent to PostHog after opt-in. Declining or withdrawing usage-data consent stops new optional collection, including these first-party records, without preventing normal use of LeWell.

We separately keep first-party operational records required to provide and understand the Service, such as account and onboarding completion, goal history, accepted learning and action completions, purchases, entitlements, subscription lifecycle, notification delivery, and the local calendar dates on which authenticated app requests are observed. Operational activity dates support aggregate retention reporting and are distinct from optional foreground-session observations. These records are not advertising analytics.

Crash diagnostics: Sentry receives crash and technical diagnostic information, which may include device model, operating-system version, app version, network context, and the code path involved in an error. Sentry is used for security and reliability, independently of the optional Share usage data setting. We redact known sensitive fields and do not intentionally include practice text or health-answer values.

Access eligibility: We keep your account's access-policy version, selected free-topic identifier where applicable, and purchase and entitlement records to apply your access rights.

Purchases: Apple or Google processes mobile payments and RevenueCat validates receipts and entitlements. We receive product and transaction identifiers, store, entitlement status, trial status, renewal, cancellation, expiration, and conversion information. We do not receive card or bank details.

Operational billing records also include account-linked provider event and transaction references, timestamps and their source, offer codes, store environment, cancellation reasons, currency, purchase and refund amounts, taxes, commissions, and estimated proceeds where available. These records support reconciliation and financial reporting independently of optional usage-data consent. Missing refund amounts remain unknown, and estimated proceeds are not proof of bank settlement.

Notifications and email: We process device push tokens, notification preferences, user-selected reminder times, delivery records, and email delivery information needed for verification, password reset, account notices, and communications you request. If you enable a personal routine reminder, the routine text is used in its notification message and may appear on your device lock screen depending on your notification settings. To show app-icon badges, we also store account-specific information about which notifications count toward the badge and which have been cleared from it. Clearing the badge does not mark notifications as read.

Heart refill alerts use the affected activity's identifier and type, blocking and status-check times, and expected recovery time. Pending alert data is cleared when recovery is observed or the alert is sent or discarded. This processing is separate from optional product analytics.

Feedback and support: If you send product feedback in the app, we store the category and message with your account. We also store limited technical context shown before submission: the app version, platform, and the app screen path without query parameters. You can choose whether LeWell may contact you about the submission. We do not send the message text to PostHog.

For sign-in security, the server stores account-linked refresh-session identifiers and hashes of refresh tokens, plus session creation, expiry, rotation and revocation times and an account-level token cutoff time. These records support sign-in, token rotation and revocation, and preventing revoked credentials from being reused; the session table does not store raw refresh tokens. A separate table can store a hash and expiry date for a revoked legacy refresh token without an account link. Its expiry limits validation but does not itself delete the row.

LeWell does not use advertising cookies or cross-app tracking. In this Policy, "device storage" includes browser cookies, browser local or session storage, browser databases such as IndexedDB, native app preferences, and files kept in native app storage.

• `refreshToken` web cookie: Essential authentication; HTTP-only and secure in production. Up to 365 days, rotated during use, cleared on sign-out or account deletion
• `lewell-auth` and native session preference: Essential sign-in state; native builds also store a refresh token in app preferences. Until sign-out, account deletion, storage clearing, or uninstall
• Guest onboarding draft: Resume unfinished onboarding. Expires after seven days without an update; removed on the next read or successful onboarding
• Analytics consent preference: Remember the Share usage data choice on that device. Until changed, account deletion, or device storage clearing
• PostHog local identifier: Support optional product analytics after opt-in. Reset on opt-out, sign-out, or account deletion
• Optional analytics session and recommendation handoff: Connect observed usage and an explicitly selected practice on the signed-in device. In memory; session rotates after 30 minutes of inactivity or account change; unused handoff expires after 30 minutes
• Usefulness-prompt preference: Limit optional feedback prompts on that device. Last-prompt timestamp until account deletion or device storage clearing
• Saved account and learning copies: Resume your account, Journey, and available content during outages. Last-known profile and saved account data remain on the device until account or device cleanup; signing out alone retains them. General learning snapshots expire after 14 days. Prepared content has an access window of no more than 14 days or the known paid-access end, whichever comes first
• Prepared written content and cached audio: Available written bundles and any audio already in your account-specific device cache. Written bundles use a 32 MiB logical budget per account; cached audio uses a 128 MiB logical budget per account. Older cached content can be replaced; a pending submission or unfinished position can retain its content version while its access window remains valid. These budgets exclude other device storage, temporary copies, and ordinary browser caches
• Unfinished lesson and quiz positions: Authored choices and position, tied to your account and content version. Durable positions expire after 14 days, with up to 200 records; session copies last with the tab/session or explicit cleanup
• Private practice drafts and session progress: Private inputs and any existing session feedback have a separate one-hour inactivity limit. Response-free durable practice position metadata also expires after one hour, with up to 200 records. Practice timers contain remaining time and pause state, with no separate automatic timer-key expiry; player reset, completion, expiry or account/device cleanup removes applicable copies
• Saved submissions: Up to 100 pending submissions per account, each up to 64 KiB. There is no automatic age-based deletion: they remain until confirmed synchronization, your explicit removal, or account deletion. Sign-out and language changes retain them
• Deletion retry marker: A local account identifier retained until cleanup of that account's device records succeeds. It supports another cleanup attempt after sign-out or restart. If device storage cannot save it, the retry state lasts only until the app closes
• Tutorial progress and other interface preferences: Local copies follow the expiry and cleanup for the related feature. Account-linked records are removed during account cleanup; some device-only preferences remain until changed or app/site storage is cleared, as described below
• Pending offline legal choice: The device stores the associated account, the displayed Terms and Privacy versions, the time of the choice, and whether it is pending or blocked. The record remains until the server confirms the same versions for that account, a later choice replaces it, or account/device cleanup removes it. This local record is separate from server-confirmed acceptance
• Pending account preference changes: Offline changes to language, units, learning schedule, reminders and notification preferences stay on the device for the same account until the server acknowledges the corresponding values or account/device cleanup removes them. They have no automatic age-based expiry, and signing out alone does not remove them
• Unsubmitted private practice drafts: Free-text drafts are stored in browser or WebView local storage, not mirrored into secure native storage; the one-hour inactivity limit and physical-copy caveat above apply
• Account-scoped pending badge and usefulness-feedback choices: A badge-display retry can hold up to 3 selected achievement IDs; the server decides which badges are eligible. That record is cleared after server sync or final rejection and expires after 30 days. A usefulness-feedback retry holds practice and completion IDs and, if answered, a categorical rating rather than free text. It is cleared after successful sync or dismissal and also expires after 30 days
• Device-only haptic preferences: The browser or WebView stores two settings: vibration enabled and word-reveal vibration enabled. They are not account-scoped or sent to the server. They remain until changed or app/site storage is cleared; account deletion does not clear them

Expiry is checked when the app reads, restores, or writes records, or while the relevant player is open. Physical copies may remain until cleanup runs; cleanup cannot run while the app is closed. Interrupted native writes may leave a private submission file until account cleanup. Available written content is prepared automatically in your selected language, with no in-app setting to turn preparation off or controls to remove groups of cached content. Cached content may be replaced or removed when its access window expires or storage is needed. In-app progress controls let you retry, review, or remove individual saved submissions. Removing cached content does not remove private pending submissions or unfinished work that retains a content version.

Signing out clears sign-in state and memory, but keeps that account's saved profile, downloads, positions and pending work for return to the same account. Switching accounts does not transfer these records or send them using the other account's credentials. Blocking essential storage may prevent sign-in or resumable features from working. Optional analytics remains off unless you opt in; offline saving and recovery do not require that opt-in.

We process information to create and secure accounts, provide requested learning and social features, save progress, personalize goals and practices, deliver notifications, process purchases, review product feedback, provide support, prevent fraud, diagnose faults, and comply with law. Optional product analytics requires your opt-in. Optional body-profile and health information you provide is used for the related purposes described above and in the Terms. The current MVP does not access device health services.

Depending on your location and the activity, our legal basis is performance of our contract with you, your consent, compliance with legal obligations, or our legitimate interests in operating and securing LeWell. Where we rely on legitimate interests, we balance those interests against your rights. You may withdraw consent at any time without affecting processing that was lawful before withdrawal.

We do not sell personal data. We use these providers only for the stated purposes:

• Anthropic: Requested AI feedback. Privacy Policy
• PostHog: Optional product analytics in the EU. Privacy Policy
• Sentry: Crash and diagnostic reporting. Privacy Policy
• Render: Application and database hosting. Privacy Policy
• Cloudflare: DNS, marketing-site hosting, email routing, and hosting and delivery of authored practice audio. Privacy Policy
• Resend: Transactional email. Privacy Policy
• Google: Sign-in, Android push delivery, and Google Play payments. Privacy Policy
• Apple: Sign-in, iOS push delivery, and App Store payments. Privacy Policy
• RevenueCat: Receipt, purchase, subscription, and entitlement management. Privacy Policy

Providers may process information outside Thailand, including in the EU, US, or UK, under their contractual protections and applicable transfer safeguards. We may also disclose information when legally required, to protect rights and safety, or as part of a corporate transaction with appropriate confidentiality and notice where required.

We use HTTPS, salted password hashing, short-lived access tokens, restricted database access, authenticated purchase webhooks, field redaction, and other reasonable safeguards. On the web, the refresh token uses an HTTP-only cookie. Native apps store the refresh token in app-controlled local storage and native preferences so the session can survive restarts. Offline copies and submitted answers are held in app or site storage; this feature does not provide end-to-end encryption for them. Their protection also depends on your device, operating system and browser. No storage or transmission method is completely secure.

The same storage and encryption limitation applies to unsubmitted private practice drafts. Drafts use browser or WebView local storage and are not mirrored into secure native storage.

• Authentication sessions and revoked legacy-token hashes: Account-linked session and token-cutoff records are removed when account deletion succeeds; expiry or revocation does not automatically delete a session row. Revoked legacy refresh-token hashes are not linked to an account. Their expiry limits token checks but does not delete the hash; no automatic deletion period is currently set for these hashes.
• Guest onboarding draft: Expires after seven days without an update; removed on the next read or successful onboarding
• Temporary profile-view records: Normally no more than three days, then deleted by rolling cleanup
• Active-account profile, health, learning, social, and product-feedback data: While the account is active, unless deleted earlier
• First-party goal history, completion evidence, and optional recommendation, foreground-session, and usefulness records: While the account is active; optional collection stops on withdrawal, and existing records are removed on account deletion
• Device learning copies, unfinished positions, saved submissions and pending local choices: The category-specific periods and controls in Section 3 apply. Confirmed synchronization removes the local queued submission and its private payload after the confirmation is saved; it does not delete accepted server history
• Server submission receipts and streak records: We retain account-linked request identifiers, a hash derived from your submitted request, activity references, status and a limited operational outcome until account deletion to prevent repeated requests applying progress or rewards twice. Receipts exclude response text and personalized AI feedback. Streak boundary records retain the local date, applicable timezone, previous activity timestamp, server counters and shield state until account deletion, rather than response text.
• Optional PostHog analytics: Up to 24 months under the project retention setting, unless erased earlier
• Sentry diagnostics: Up to 90 days under the project retention setting
• Routine application and security logs: Normally up to 30 days, longer only for an active security or legal matter
• Anthropic commercial API inputs and outputs: Normally up to 30 days under Anthropic's standard retention, subject to stated safety and legal exceptions
• Transaction, consent, fraud-prevention, tax, and legal records: Only as long as required for the applicable obligation or limitation period, which may be up to seven years
• Service backups: Until overwritten through the hosting backup cycle, with access restricted and no use except restoration

You can delete your account in Settings or request deletion at the account-deletion page. Before the local account is deleted, LeWell requests deletion of account-linked PostHog and RevenueCat customer data where applicable. Provider processing may complete asynchronously. After server account deletion succeeds, the app attempts to remove that account's browser and native offline records, including downloaded files, submitted answers, drafts, timers, positions and saved sign-in state on the device used for deletion. A failed device cleanup remains retryable using the local marker described in Section 3. Records belonging to another account and legacy local records whose owner cannot be determined are not removed by guessing ownership. This does not remotely wipe other devices; their local copies can remain until applicable cleanup, site/app data clearing or uninstall. Sign-out alone does not erase saved offline work. Clearing app or site data, uninstalling, operating-system storage eviction or losing the device can permanently remove work that has not reached the server.

Deleting a LeWell account does not cancel a subscription managed by Apple or Google. Manage or cancel it separately through the relevant store; cancellation is not a condition for requesting account deletion. Apple, Google, and legally required transaction records may remain under their policies or law. We may retain narrowly limited records where legally required, to resolve an active dispute, or to prevent fraud, and will not use retained data for unrelated purposes.

Depending on where you live, including under Thailand's Personal Data Protection Act and the EU or UK GDPR, you may have rights to access, correct, delete, restrict, object, obtain a portable copy, withdraw consent, and complain to a data-protection authority.

Use available in-app controls to update information, change your optional usage-data choice, or delete your account. The current MVP has no in-app controls for health readings or device-health connections. Revoke any device-health access granted in an earlier version through your device settings. For requests about retained health readings or historical permission records, contact privacy@lewell.app. You may change your optional usage-data choice in Settings or unsubscribe from marketing email through its unsubscribe link. Contact privacy@lewell.app for other requests not available in the app; we may need to verify your identity. Withdrawal does not recall an AI request already sent or affect processing that was lawful before withdrawal.

Mandatory privacy and consumer rights where you live continue to apply. Contact privacy@lewell.app for regional privacy questions or to request information about applicable international-transfer safeguards.

We may update this Policy as LeWell changes. We will change the date above and provide an in-app or email notice when a change is material. Where law requires renewed consent, we will request it before the new processing begins.

• Email: privacy@lewell.app
• Data Controller: LEWELL Co., Ltd., Bangkok, Thailand