Privacy Policy

Last updated: August 25, 2026

Ballast ("we", "us") makes a panic-attack and anxiety relief app for iOS and Android. This policy explains what data the app collects, why, and how it's protected. We built Ballast to work fully offline for its core feature, and we've tried to keep the amount of data we touch as small as that implies.

The short version

• You can use Ballast's core rescue feature with no account and no signup.
• Your written journal entries are end-to-end encrypted. We cannot read them, even if we wanted to.
• We never sell your data, and we don't run ads.
• Analytics we collect are anonymous and don't include anything you've written.

What we collect

An anonymous account is created automatically on install so your settings and history have somewhere to live. This doesn't require an email address or any personal information.

• Episodes, streaks, and stats: records of when you used a rescue or breathing exercise, stored with server-side encryption at rest.
• Journal entries: anything you write is encrypted on your device before it ever leaves it (end-to-end encryption). We store only the encrypted blob; the key lives on your device and, if you choose to set one up, in a recovery code you control.
• Email address: only if you choose to create an account, used solely to send a one-time sign-in code and, if applicable, purchase-restore related messages.
• Purchase data: if you buy a subscription, our payment provider (RevenueCat) receives an anonymous purchaser ID tied to your app store account. We never see your payment details. Those are handled entirely by Apple or Google.
• Anonymous usage analytics: event-level, aggregate app usage (e.g., a screen was opened) with no journal content, no free-text you've written, and nothing that identifies you personally.

What we never collect

• The plaintext contents of your journal entries
• Payment card or bank details
• Location data
• Contacts, unless you manually enter an emergency contact, which stays on your device

Who we share data with

We use a small number of service providers to run Ballast. None of them are permitted to use your data for their own purposes.

• Supabase: hosts our database, authentication, and encrypted backup storage.
• Cloudflare R2: hosts audio content (soundscapes, sleep stories, voice packs). This is public media delivery and isn't tied to your personal data.
• Resend: delivers the email containing your one-time sign-in code, if you choose to create an account.
• RevenueCat: manages subscription entitlements, using an anonymous purchaser ID.
• PostHog: collects anonymous, event-level usage analytics (e.g., a screen was opened). It never receives journal content, anything you've written, or your email address.

We do not sell personal data to anyone, for any reason.

Cookies on this website

This website (ballast.to) is separate from the app and uses its own, separate analytics — nothing collected here is linked to your app usage. With your consent, given through the banner shown on your first visit, we use Google Analytics to see how the site is used (e.g., which pages get visited). If you decline, or don't respond to the banner, no analytics cookie is set and no data is sent to Google. You can change your choice at any time by clearing your browser's cookies for this site, which will show the banner again.

AI features

Ballast includes an optional, post-episode AI reflection feature. It is never used during an active crisis or rescue. If you use it, you'll be told plainly before any of your text is sent to our AI provider, and you can revoke that consent at any time, which turns the feature off rather than silently continuing.

Deleting your Ballast account

You can delete your Ballast account and its associated data at any time, directly in the app: open Ballast, go to Profile, and select Delete Account. Confirm once and it's gone — no waiting period, no contacting support required.

Deleting your account permanently removes, from our servers:

• Your email address and account record
• Encrypted journal backup blobs, if you had cloud backup enabled
• Your synced episodes, streaks, and settings backup
• Your device list and entitlement record

This deletion is immediate and permanent once confirmed — we do not retain a copy afterward. It only removes what's stored on our servers under your account. Content stored only on your device (your local journal, episode history, and settings) is not affected by account deletion and stays on that device until you delete the app itself. If you never created an account, there is nothing on our servers to delete — the app's core features have always worked without one.

Your choices

• You can use the app's core rescue features without ever creating an account.
• You can delete your account and associated data at any time from within the app.
• You can decline to set up a journal recovery code. Your written entries then stay only on that device, and we tell you this plainly when you make that choice.
• You can turn off anonymous usage analytics at any time from Profile & Settings.

Children's privacy

Ballast is not directed at children, and we do not knowingly collect data from anyone under 13 (or the relevant age of digital consent in your country).

Changes to this policy

If this policy changes materially, we'll update the date at the top of this page and, where required, notify you in the app.

Contact

Questions about this policy or your data can be sent to contact@ballast.to.