Privacy Policy

Last updated: March 2026

This Privacy Policy explains how The Peachy Life Company ("we", "us", "our") collects, uses, stores, and protects your personal information when you use The Peachy Life mobile application and website (together, "the Service").

We have written this policy in plain English, but it is legally complete. Please read it carefully. If you have questions, email us at hello@thepeachylifecompany.com.

1. Who We Are

The Peachy Life Company
Sydney, New South Wales, Australia
Email: hello@thepeachylifecompany.com
Website: thepeachylifecompany.com

For users in the United Kingdom, The Peachy Life Company acts as the data controller within the meaning of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

For users in Australia, we are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Although the small business exemption under the Privacy Act may technically apply based on our current revenue, we voluntarily comply with the APPs in full because we handle health information, which is always subject to the Act regardless of business size.

For users in California, USA, please also read the dedicated section at the end of this policy covering your rights under the California Consumer Privacy Act (CCPA) and related California laws.

2. What Data We Collect and Why

We only collect data that is necessary to provide and improve the Service.

2.1 Account and Identity Data

• What: Email address and display name.
• Why: To create and authenticate your account, and to identify you within the app.
• How collected: You provide this directly when you register.
• UK GDPR lawful basis: Performance of a contract (Art. 6(1)(b)) — you cannot use the Service without an account.

2.2 Mood and Wellbeing Data

• What: Mood scores, emotion words, activity tags, PHQ-9 or GAD-7 style self-assessment responses, and associated timestamps you submit.
• Why: To generate personalised mood insights, trends, and weekly reports for you.
• How collected: You enter this data directly through the app.
• Special category status: This data constitutes health or mental health data under UK GDPR Article 9 and Australian law. We treat it accordingly (see Section 3).
• UK GDPR lawful basis: Explicit consent (Art. 6(1)(a) and Art. 9(2)(a)). You give this consent when you create an account and begin logging. You can withdraw consent at any time by deleting your data or account.

2.3 Journal Entries

• What: Free-text content you write in the journalling feature.
• Why: To provide a private, secure space for self-reflection and to connect journal content with your broader wellbeing picture (where you choose to).
• How collected: You type this directly into the app.
• Special category status: May contain sensitive mental health information. Treated as special category data.
• UK GDPR lawful basis: Explicit consent (Art. 6(1)(a) and Art. 9(2)(a)).

2.4 AI Conversation Messages

• What: Messages you send to, and responses you receive from, the AI chat feature.
• Why: To provide the AI coaching and support feature.
• How collected: You type messages directly. Your messages are sent to our AI provider (OpenAI) to generate responses (see Section 5 — Third-Party Processors).
• Retention: AI conversation messages are retained for up to 90 days and then deleted. This deletion process is actively being implemented; in the interim, messages may be retained until the automated deletion job is live.
• Special category status: May contain sensitive mental health information. Treated as special category data.
• UK GDPR lawful basis: Explicit consent (Art. 6(1)(a) and Art. 9(2)(a)).

2.5 Biometric and Health Metrics

• What: Health metrics such as step count, heart rate, sleep data, and other biometric data sourced from Apple Health (iOS), Google Health Connect (Android), or Garmin Connect — depending on which integrations you enable.
• Why: To enrich your wellbeing picture by correlating physical health data with mood patterns.
• How collected: Only with your explicit, separate in-app permission for each integration. You can revoke access at any time from your device's health app settings or within The Peachy Life app.
• Special category status: Biometric and health data is special category data. We do not collect this unless you actively grant permission.
• UK GDPR lawful basis: Explicit consent (Art. 6(1)(a) and Art. 9(2)(a)).

2.6 Usage Analytics

• What: Aggregated, anonymised usage patterns — such as which features are used and general navigation flows.
• Why: To understand how the app is used and to prioritise improvements.
• How collected: Via Plausible.io, a privacy-focused analytics tool that does not use cookies, does not track individual users across sessions or sites, and does not collect or process personal data. IP addresses are anonymised. No consent banner is required for Plausible analytics.
• UK GDPR lawful basis: Legitimate interests (Art. 6(1)(f)) — the interest in improving our product, balanced against the minimal privacy impact of anonymous, aggregated data.

2.7 Communications Data

• What: The content of any emails or messages you send us, and your email address.
• Why: To respond to your enquiries and support requests.
• UK GDPR lawful basis: Legitimate interests (Art. 6(1)(f)) — responding to communications you initiate.

3. Special Category Data — Mental Health Information

Mood scores, journal content, wellbeing self-assessments, AI conversation messages, and biometric data are all treated as health or mental health data. Under UK GDPR, this is "special category" data that attracts heightened protections under Article 9. Under Australian law, it is "sensitive information" and "health information" under the Privacy Act 1988.

We process this data exclusively on the basis of your explicit, freely given, informed consent. This means:

• We explain clearly what data we collect and how we use it before you provide it.
• You can withdraw consent at any time without penalty by exporting and deleting your data through the app's Settings, or by contacting us.
• We never use your mental health data for advertising, profiling, or sale to third parties.
• Access to this data is strictly limited: only you, and our authorised engineers under confidentiality obligations, can access it — and engineer access is audit-logged.

We also implement the principle of data minimisation: we only ask you for data that is directly useful to you. Nothing is collected passively or in the background beyond what is described in this policy.

4. Data We Do Not Collect

• Payment information: All payments are processed directly by Apple (App Store) or Google (Play Store). We receive no raw payment card data, bank details, or full billing addresses. We may receive a transaction confirmation and subscription status from the platform.
• Advertising identifiers: We do not use advertising SDKs, tracking pixels, or ad identifiers such as IDFA or GAID.
• Device identifiers beyond what Firebase requires: Firebase Authentication may generate an anonymous installation ID for technical operation. We do not use this for advertising.
• Location data: We do not collect precise or coarse location data.
• Contact lists or social graph: We do not access your contacts, social accounts, or friends lists.

5. Third-Party Data Processors

We use the following third-party services to operate The Peachy Life. Each is a data processor acting on our instruction — they may not use your data for their own purposes.

We do not authorise any of our processors to use your data for their own purposes, to sell your data, or to transfer it to further parties beyond what is required to provide their service to us.

6. International Data Transfers

The Peachy Life Company is based in Australia. Our primary infrastructure — Google Firebase (Authentication and Firestore) — is hosted in the United States. When you use the AI chat feature, your messages are also processed by OpenAI in the United States.

For Australian users

Under Australian Privacy Principle 8 (APP 8), before disclosing personal information to overseas recipients, we are required to take reasonable steps to ensure the recipient does not breach the APPs. Google LLC and its Firebase services are subject to Google's binding corporate rules and standard contractual clauses, and Google's global infrastructure is subject to its Data Processing Addendum. By using The Peachy Life, you acknowledge that your data will be transferred to and stored in the United States under these arrangements.

For UK users

Transfers of your personal data from the United Kingdom to the United States are governed by appropriate safeguards. For transfers to Google Firebase, we rely on the UK International Data Transfer Agreement (UK IDTA) or equivalent standard contractual clauses approved by the UK Information Commissioner's Office (ICO). For transfers to OpenAI, we currently rely on OpenAI's standard terms and contractual measures. A formal Data Processing Agreement with OpenAI is pending; we will update this section once it is in place. You may request details of the specific transfer mechanism in use by emailing us at hello@thepeachylifecompany.com.

7. How Long We Keep Your Data

When you delete your account through the app's Settings, we initiate deletion of your personal data from our active databases within 30 days. Some residual data may persist in encrypted backup snapshots for a short period thereafter, consistent with our backup and disaster-recovery practices, before being overwritten.

8. How We Protect Your Data

• Encryption in transit: All data is transmitted over HTTPS/TLS.
• Encryption at rest: Data stored in Google Cloud Firestore is encrypted at rest by Google's infrastructure.
• Access controls: Access to production data is restricted to authorised personnel only, on a need-to-know basis, and is audit-logged.
• Firebase Security Rules: Firestore rules are configured so that users can only read and write their own data. No cross-user data access is possible at the database level.
• Authentication: Firebase Authentication handles credential storage and management. We never store raw passwords.

No method of transmission over the internet or electronic storage is 100% secure. While we use commercially reasonable measures to protect your data, we cannot guarantee absolute security. In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and relevant authorities as required by law.

9. Your Rights

You have the following rights in relation to your personal data, regardless of where you are located. Additional jurisdiction-specific rights are set out in Sections 10 and 11.

• Access your data: You can view all your data within the app. You can also request a full data export from Settings.
• Delete your data: You can permanently delete your account and all associated data from Settings at any time.
• Correct your data: You can update your display name and account details within the app. For other corrections, contact us.
• Withdraw consent: Where we process your data on the basis of consent (including all special category data), you can withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing that occurred before withdrawal. Withdrawing consent for core data processing will require deleting your account.
• Disable health integrations: You can revoke Apple Health, Google Health Connect, or Garmin permission at any time from your device settings or within the app.

To exercise any right, or for any privacy-related request, contact us at hello@thepeachylifecompany.com. We will respond within 30 days.

10. For UK Users — UK GDPR Rights

If you are located in the United Kingdom, you have the following rights under the UK GDPR and Data Protection Act 2018, in addition to the general rights above:

• Right of access (Art. 15): You have the right to receive a copy of your personal data and information about how it is processed.
• Right to rectification (Art. 16): You have the right to have inaccurate personal data corrected and incomplete data completed.
• Right to erasure (Art. 17): You have the right to request deletion of your personal data ("right to be forgotten") in certain circumstances — for example, where you withdraw consent and there is no other lawful basis for processing.
• Right to restriction of processing (Art. 18): You have the right to request that we restrict processing of your data in certain circumstances — for example, while the accuracy of data is contested.
• Right to data portability (Art. 20): Where processing is based on consent or contract and carried out by automated means, you have the right to receive your data in a structured, commonly used, machine-readable format and to transmit it to another controller. You can export your data at any time from the app's Settings.
• Right to object (Art. 21): You have the right to object to processing based on our legitimate interests. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Rights related to automated decision-making (Art. 22): The Peachy Life does not make automated decisions that produce legal or similarly significant effects on you. AI-generated coaching suggestions are informational only and do not constitute automated decision-making in the Art. 22 sense.

How to exercise your UK GDPR rights

Email us at hello@thepeachylifecompany.com with the subject line "UK GDPR Data Rights Request". We will acknowledge within 5 working days and respond in full within one calendar month (extendable by a further two months for complex or numerous requests, with notice).

Right to complain to the ICO

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection:

• Website: ico.org.uk/make-a-complaint
• Telephone: 0303 123 1113

We would appreciate the opportunity to address your concern directly before you approach the ICO, so please contact us first.

11. For Australian Users — Privacy Act 1988

If you are located in Australia, we comply with all 13 Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth). Key rights and obligations include:

• APP 5 — Notice at collection: We notify you of our data collection practices at the point of collection — through this policy and in-app notices.
• APP 6 — Use and disclosure: We only use and disclose your personal information for the primary purpose for which it was collected, or with your consent, or as required by law.
• APP 8 — Cross-border disclosure: Your data is transferred to and stored in the United States via Google Firebase and OpenAI (see Section 6). By using the Service, you consent to this cross-border disclosure.
• APP 11 — Security: We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification, and disclosure (see Section 8).
• APP 12 — Access: You have the right to access your personal information. Make a request by emailing hello@thepeachylifecompany.com. We will respond within 30 days. We may charge a reasonable fee to cover the cost of providing access (we will notify you in advance).
• APP 13 — Correction: You have the right to request correction of inaccurate, out-of-date, incomplete, irrelevant, or misleading personal information. You can update most data directly within the app.

Complaints — Australian users

If you believe we have breached the APPs, please contact us first at hello@thepeachylifecompany.com. We will investigate and respond within 30 days. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

• Website: oaic.gov.au/privacy/privacy-complaints
• Phone: 1300 363 992

12. For California Users — CCPA / CalOPPA

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), and the California Online Privacy Protection Act (CalOPPA).

Categories of personal information we collect

In the preceding 12 months, we have collected the following categories of personal information from California residents:

• Identifiers: Email address, display name.
• Personal records: Content of mood entries, journal entries, and AI chat messages.
• Health and medical information: Mood data, wellbeing assessments, and biometric data (where explicitly permitted).
• Internet or network activity: Anonymised, aggregated usage data via Plausible (no personal identifiers).

Business or commercial purpose for collection

We collect this information to provide the core features of The Peachy Life: mood tracking, journalling, AI coaching, and personalised wellbeing insights.

We do not sell or share your personal information

The Peachy Life Company does not sell, rent, trade, or share your personal information with third parties for their own commercial or advertising purposes. This applies to all users, including California residents. There is no "opt-out of sale" mechanism because we do not engage in the sale of personal information.

Your CCPA rights

• Right to know: You have the right to request disclosure of the categories and specific pieces of personal information we have collected about you, the sources from which it was collected, the business purpose for collection, and the categories of third parties with whom we have shared it.
• Right to delete: You have the right to request deletion of personal information we have collected from you, subject to certain exceptions. You can delete your account and all data directly from the app's Settings.
• Right to correct: You have the right to request correction of inaccurate personal information.
• Right to opt out of sale/sharing: We do not sell or share personal information. No opt-out is needed, but you may contact us to confirm.
• Right to non-discrimination: We will not discriminate against you for exercising your CCPA rights. Exercising these rights will not result in denial of service, different pricing, or a different quality of service.

Shine the Light (California Civil Code Section 1798.83)

California residents may request information once per calendar year about personal information shared with third parties for direct marketing purposes. We do not share personal information with third parties for their direct marketing purposes, so no such disclosure is required. To confirm, contact us at hello@thepeachylifecompany.com.

How to exercise your California rights

Email hello@thepeachylifecompany.com with the subject "California Privacy Rights Request". We will acknowledge within 10 business days and respond in full within 45 calendar days (extendable by a further 45 days with notice). We may need to verify your identity before processing your request.

CalOPPA — Policy effective date and updates

This policy was last updated in March 2026. We will post any changes to this page and update the "Last updated" date. For material changes, we will provide notice through the app.

13. Children's Privacy

The Peachy Life is intended for users aged 16 and over. We do not knowingly collect personal information from children under 16. If you are under 16, please do not use the Service.

If you are a parent or guardian and believe your child under 16 has provided us with personal information, please contact us at hello@thepeachylifecompany.com and we will take steps to delete that information promptly.

Because our minimum age is 16, the US Children's Online Privacy Protection Act (COPPA), which applies to children under 13, does not apply to the Service.

14. Cookies and Tracking Technologies

Our website (thepeachylifecompany.com) uses Plausible.io for analytics, which is cookieless and does not track individual users. We do not use advertising cookies, tracking pixels, or any cross-site tracking technologies on our website. No cookie consent banner is required.

The mobile app does not use advertising cookies. Firebase Authentication and Firestore use technical tokens stored on your device to maintain your login session. These are strictly necessary for the app to function.

15. Mental Health Disclaimer

The Peachy Life is a general-purpose mental fitness and wellbeing tool designed to support self-reflection and healthy habits. It is not:

• A medical device or clinical diagnostic tool.
• A substitute for professional psychological, psychiatric, or medical advice, diagnosis, or treatment.
• A crisis service or emergency intervention resource.

If you are experiencing a mental health crisis, thoughts of self-harm, or need urgent support, please reach out to a qualified health professional or contact emergency services. Crisis support resources in key regions:

• Australia: Lifeline — 13 11 14 | Beyond Blue — 1300 22 4636
• UK: Samaritans — 116 123 | Crisis Text Line — Text SHOUT to 85258
• USA: 988 Suicide & Crisis Lifeline — call or text 988

16. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make changes:

• We will update the "Last updated" date at the top of this page.
• For material changes (changes that significantly affect how we use your data or your rights), we will provide notice through the app and, where required by law, seek your renewed consent before the changes take effect.
• For minor or administrative changes, updating this page is sufficient notice.

Continued use of the Service after a policy update constitutes acceptance of the updated policy, to the extent permitted by applicable law.

Previous versions of this policy are available on request.

17. Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or your personal data, please contact us:

The Peachy Life Company
Sydney, New South Wales, Australia
Email: hello@thepeachylifecompany.com

We aim to respond to all privacy-related enquiries within 30 days. If you are not satisfied with our response, you have the right to escalate to the relevant supervisory authority for your jurisdiction (see Sections 10 and 11 for contact details).