esen.

Esen. Privacy Policy

DRAFT — not yet reviewed by a lawyer, not yet hosted. Do not submit to App Store/Play until both are done.

Effective date: [INSERT DATE BEFORE LAUNCH] · Last updated: [INSERT DATE]

Reconciled against the actual v1 build — 8 Sep 2026 (session 14). Changes from the previous version are marked inline; nothing legally substantive was invented — only brought in line with what the app currently does.

1. Who we are

Esen. is a daily planning and wellbeing application developed and operated by Esen Collective Labs Pty Ltd (ACN 701 828 248) (ABN [PENDING — company ABN application submitted 27 Aug 2026 via business.gov.au; confirm arrival before this goes to the lawyer]), trading as Esen. ("we", "us", "our"). We are based in Australia. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use the Esen. app.

2. What information we collect

We collect only the information necessary to provide the Esen. service:

We do not collect your location, contacts, camera data, or any information beyond what is listed here.

Information you enter about other people: some of what you enter — for example, a fixed responsibility or appointment such as a family member's therapy session or a parent's care visit — may reference another person. This information is provided by you, about your own schedule and commitments, and is used solely to power your own account experience (showing your routine back to you). We do not use it to build a profile of, contact, or make any decision about that other person, and we never share it with any third party (see Section 5). You're responsible for only entering information about others that you have the right to share in this way.

3. How we use your information

We use your information solely to:

We do not use your information for advertising. We do not sell your data to any third party. We do not share your personal information with any third party except as described in Section 5.

Esen. is currently offered entirely free of charge. There are no in-app purchases or subscriptions in this version of the app.

4. Where your data is stored

Your data is stored securely using Google Firebase (Firestore), with the database region set to australia-southeast1 (Sydney, Australia). Your data does not leave Australia. Firebase is operated by Google LLC and is subject to Google's data processing terms, which are consistent with Australian Privacy Act requirements.

5. Third parties

Esen. uses the following third-party services, each processing only the data necessary for their function:

(Changed 8 Sep: RevenueCat is not currently used — Esen. v1 has no subscriptions or in-app purchases. This section will be updated, and this Policy re-reviewed, before any future version introduces a paid tier. See the Appendix for the reserved v1.1 wording.)

We do not use advertising networks or data brokers. We do not share your journal entries, daily states, or personal content with any third party under any circumstances.

6. Your rights

Under the Australian Privacy Act 1988, you have the right to:

To exercise any of these rights, contact us at sarah@esencollectivelabs.com. We will respond within 30 days. Account and data deletion is also available directly in the app under Settings → Account → Delete account — this satisfies Apple's requirement (App Store Review Guideline 5.1.1(v)) that any app supporting account creation must also support in-app account deletion.

7. Data retention

We retain your data for as long as your account is active. If you delete your account, all personal data is permanently deleted within 30 days. Anonymised, aggregated usage data (which cannot identify you) may be retained for product improvement purposes.

8. Children

Esen. is not designed for use by persons under 16 years of age. We do not knowingly collect information from children under 16. If you believe a child under 16 has provided us with personal information, please contact us and we will delete it promptly.

9. Health-related content

Esen. asks you to declare a daily capacity state and may surface wellbeing-related content (affirmations, journal prompts, regulation techniques, and signposting to crisis and support services). Esen. is not a medical or mental health service and does not diagnose, treat, or provide clinical advice. We do not use any health-related information you provide for advertising, employment decisions, insurance eligibility, or any purpose other than delivering the Esen. service to you, consistent with Google Play's Health apps policy and Apple's guidelines on health and wellness data.

10. Changes to this policy

We may update this policy as the app develops. We will notify you of significant changes via the app or email. The current version is always available in Settings → About → Privacy Policy and at https://esencollectivelabs.com/privacy.

11. Contact

For any privacy questions or concerns: sarah@esencollectivelabs.com. We will respond within 30 days of receiving your request.

⚠️ Before this can be submitted (status as of 8 Sep 2026)

  1. Lawyer review — this draft is accurate and good-faith but has not been reviewed by a qualified Australian privacy lawyer. Budget ≈$300–500 AUD for a one-hour review. Status unconfirmed as of 8 Sep — the 2 Sep compliance audit said "book today"; no session log since confirms this happened. Check with Sarah directly before assuming it's in hand.
  2. Fill in remaining placeholders — ABN (pending, applied 27 Aug) and contact email (pending the domain/hosting decision — see Finish Line Plan Track 3/4). Legal name filled in 8 Sep (Esen Collective Labs Pty Ltd, ACN 701 828 248).
  3. Host on a live, public, non-geofenced URL — Google Play explicitly requires this (no PDFs, must be publicly accessible); Apple requires the link in both App Store Connect metadata and in-app. Still undecided as of 8 Sep — this blocks item 5 below too (Google Play's required account-deletion web page needs the same domain).
  4. Complete Google Play's Data Safety form in Play Console separately — this is a structured form, not a document, but its answers must stay consistent with what's written here.
  5. Complete Google Play's Health apps declaration form (Play Console → Policy → App content) given Esen.'s capacity-state and wellbeing content.
  6. Account deletion — corrected 8 Sep, this was previously overstated. The deletion cascade itself (all 7 per-collection deletion references, including fixedResponsibilities and shiftTemplates) was wired 7 Aug and re-verified 21 Aug. However, the 2 Sep compliance audit found that users who signed in with Google or Apple cannot currently complete account deletion at all — the re-auth step is password-only and social-sign-in users have no password to enter. This is a real, unfixed gap, not just an untested one. Section 6's "Request deletion of your account" claim is only true today for password-based accounts. Two things must happen before this Policy is accurate for all users: (a) fix the social-provider re-auth branch, (b) run the live end-to-end deletion test on both a password account and a Google/Apple-signed-in account.

Appendix — reserved v1.1 wording (not in effect, do not use until a paid tier actually ships)

Kept here so the earlier drafting work isn't lost. When RevenueCat and a real paid tier are wired (v1.1), reintroduce a version of this into Section 5:

RevenueCat — subscription and in-app purchase management; processes only the information needed to manage your subscription status