DRAFT — pending legal review. Do not publish without review.

Privacy policy

Last updated: October 18, 2026 (draft)

DRAFT for legal review. English version of the Spanish policy. Items marked [TBC] depend on pending technical or legal decisions.

1. Who we are

  • Controller: ROCKALABS LLC (“Bambú”), 68 Mountain Ave, Westwood, NJ 07675, United States.
  • Contact: [email protected]
  • EU representative (GDPR art. 27): [TBC]

2. The short version

  • Bambú is a wellbeing and training app, not a medical service.
  • Your journal, check-ins and mood are private: encrypted, never used for ads, never sold, and never shown to other people, not even in social features.
  • No advertising SDKs, no cross-app tracking, no advertising identifier.
  • You can export your data and delete your account in the app.

3. Data we process

  • Account: email, name, language, time zone, country; Apple or Google identifier if you sign in with them.
  • App usage: completed sessions, minutes, streak, your Bambú plant, reminders.
  • Check-ins and journal: sleep, energy, mood, time available; your journal entries.
  • Exercises and challenges: your answers and results.
  • Subscription: plan and renewal status. We never see your card: Apple or Google handle payment.
  • Device and technical data: push token, device model, app and OS version, error logs and product events without sensitive data.

Check-ins, journal entries and (when available) coach conversations are treated as especially sensitive and encrypted at field level.

4. Why we use it

To provide the service and personalize your daily plan (contract); to compute anonymous challenge comparisons from aggregated data (legitimate interest); to manage subscriptions (contract); to send service reminders, which you can turn off (contract); marketing email only with your consent; product analytics without advertising (legitimate interest); safety features that show helplines when AI features detect risk (vital and legitimate interest); legal obligations.

5. Artificial intelligence

  • Today: we use AI internally to create and calibrate the exercise bank. Your personal data is not sent to any AI provider for this. Free exercises, the daily challenge and the daily plan work without real-time AI.
  • Premium AI features (when available) — the coach, free-text check-in and journal reflection — send only what is needed to answer you to Anthropic, PBC (Claude API), acting as processor, which does not use your data to train its models. Real-time voice provider: [TBC].
  • Coach personal context (Premium, on by default): so the conversation starts from how you are, the coach receives your first name, a summary of your practice, your latest check-ins (sleep, energy, mood), short excerpts of your latest journal entries and your latest exercise results. This content is sent to Anthropic only to answer you in that conversation; it is never used for advertising or to train AI models, and we don’t send it to our analytics tools. If you use voice, the real-time voice provider [TBC] receives it too. You can turn it off in Profile → Settings → “Bambú can read your journal and check-ins to support you”; when it’s off, the coach only knows your name and your practice.
  • The coach does not diagnose or provide therapy. You can view and delete what the coach remembers.

6. Social features

Optional. Only your streak, Bambú growth and challenge answers are shared — never check-ins, mood or journal. No public profiles, direct messages or global rankings.

7. Who we share data with

We never sell data. Processors: Apple and Google (sign-in, payments, notifications), RevenueCat (subscription status), Anthropic (Premium AI features), PostHog (product analytics, EU), Sentry (error logs), hosting provider [TBC, EU], audio storage/CDN [TBC], email provider [TBC]. Transfers outside the EU rely on Standard Contractual Clauses or the EU-US Data Privacy Framework.

8. Retention

While your account exists. After deletion, data is permanently erased within 7 days [TBC]; encrypted backups rotate within 30 days [TBC]. We keep only what the law requires (e.g. billing records).

9. Your rights

Access, rectification, erasure, portability, restriction, objection and withdrawal of consent. Export and deletion are in the app (Profile → Settings); for anything else email [email protected] from your account email. You may complain to your data protection authority.

10. Children

Bambú is not intended for children under 16 [TBC per country].

11. Changes

We will notify you in the app or by email before material changes take effect.