Woosha is developed and operated by Epic Media, LLC, a single-member limited liability company based in Huntsville, Alabama, United States.
This Privacy Policy explains how we collect, use, disclose, and protect information when you use the Woosha mobile application, our website (www.woosha.app), and related services (collectively, the “Service”). By using the Service, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use the Service.
We take privacy seriously. Woosha handles mental health information, reproductive health information, and personal reflections, categories of data that deserve particular care. This policy reflects that responsibility.
This Privacy Policy should be read together with our Consumer Health Data Privacy Policy, which applies specifically to residents of Washington, Nevada, and Connecticut and is published as a separate document at www.woosha.app/consumer-health-data-privacy. Where the Consumer Health Data Privacy Policy and this Privacy Policy differ in respect of consumer health data, the Consumer Health Data Privacy Policy governs for residents of those states.
Woosha is designed for users 18 years of age or older. If you are under 18, do not use this app. We do not knowingly collect data from minors. If we become aware that a user is under 18, we will terminate their account and delete their data.
Parents or guardians who believe their child under 18 has provided us with personal information should contact us at privacy@woosha.app.
If you also use other Epic Media apps (such as FemCode or CoreCode), each app maintains separate data. We do not combine your data across apps without your explicit consent at the time of combination.
We use your data to:
We may occasionally show you information about other apps developed by Epic Media, LLC (such as FemCode and CoreCode). These suggestions are shown to all users with the relevant feature enabled and are never personalized based on your cycle data, anxiety patterns, panic events, journal entries, or any other personal information. You can opt out of cross-app suggestions at any time from Settings.
The Woosha app communicates with only the following services, each of which processes data on our behalf:
Service | Purpose | Data Sent |
Supabase | Database, authentication, file storage | Account data, all user-generated content |
Sentry | Crash reporting and error tracking | Error logs, device information, and a user identifier. Error payloads and stack traces can incidentally include fragments of data being processed at the time of the error, which may include text you have typed. |
RevenueCat | Subscription management | Purchase events and an app-specific user identifier |
Anthropic (Claude AI) | AI-generated insights and suggestions (opt-in only) | Varies by feature. See Section 6 for a feature-by-feature description. Some features send text you have typed yourself. |
Google Sign-In | Optional sign-in with Google account | Auth token only |
Apple Sign-In | Optional sign-in with Apple ID (iOS only) | Auth token only |
We enter into data processing terms with each of these providers requiring them to process data only on our instructions and to maintain appropriate security measures.
The Woosha app does NOT include Firebase Analytics, Facebook SDK, Google Analytics, Amplitude, Mixpanel, Braze, AppsFlyer, Adjust, or any other third-party analytics or advertising SDK. No code embedded in the app reports your activity to advertisers or analytics providers.
Separately, Epic Media may engage in standard marketing activities outside the app, including our website (www.woosha.app), social media accounts, paid advertising on platforms such as Facebook or Google, and email newsletters. These marketing channels operate independently of the app and do NOT have access to information from your Woosha account. Advertisements we run to promote Woosha are targeted based on interest categories provided by the advertising platform (for example, people interested in wellness apps), never based on any data from existing Woosha users.
We do not currently use tracking pixels (such as the Meta/Facebook Pixel, Google Ads Conversion Tag, TikTok Pixel, or similar) on our website (www.woosha.app). If we add these in the future to measure the effectiveness of our advertising campaigns, we will:
Tracking pixels are small snippets of code that record when someone visits our website and share that information with advertising platforms so those platforms can measure ad effectiveness or show follow-up ads. They would only operate on our marketing website, never inside the Woosha app itself. The app does not contain any advertising SDK, tracking pixel, or advertiser-facing code, and we do not plan to add any.
Woosha includes optional AI-powered features that use Anthropic’s Claude API to generate personalized insights and suggestions. These features are:
Woosha’s Journal Reflection Prompts are not an AI feature. They are drawn from a fixed set of prompts written in advance and selected without any AI processing, and nothing you write is transmitted anywhere when you use them.
Artificial intelligence (AI) is a machine-based system that generates outputs based on the input it receives. Woosha’s use of AI is limited to the user-facing AI Features listed above, which you must explicitly enable. We do not use AI for behind-the-scenes purposes such as automated decision-making about you, behavioral profiling, or predictive scoring of you as a user.
You must explicitly enable AI features in Settings, then AI Features. You can turn them off at any time. When AI features are off, no data is sent to Anthropic.
What is sent to Anthropic depends on which AI feature you use. We set this out feature by feature because the difference matters.
Weekly Insights and Predictions. We send aggregated statistics drawn from your logs (counts, averages, and correlations), structured fields from your panic events (triggers, physical symptoms, emotional symptoms, coping methods, resolution, and any notes you have typed in those fields), technique effectiveness figures, and a short list of recurring keywords extracted from your journal entries. We do not send the full text of your journal entries for these features. These requests include a pseudonymous identifier derived from your account by a one-way cryptographic hash. This identifier is not your name, email address, or account number, but it is not fully anonymous either: it stays the same between requests, so it can link your requests to one another.
Thought Reframing, Socratic Questioning, and Fear Ladder. These features send the text you type to Anthropic exactly as you wrote it. That includes the automatic thought you record, the evidence you write against it, and the situation you describe for a fear ladder, together with the thinking-error categories you select. We do not send an account identifier with these requests, and we do not remove names, places, or other details from the text before sending it. Please keep this in mind when deciding what to write in these fields.
Crisis wording. If a Socratic Questioning entry contains wording associated with suicide or self-harm, the app does not send it to Anthropic. It returns pre-written crisis resource information instead. This is a narrow keyword safeguard, not a monitoring system, and it does not apply to other features. Woosha does not monitor your entries for crises and cannot reliably detect one.
Retention by Anthropic. Anthropic’s commercial API terms provide that inputs and outputs are retained for up to 30 days for trust and safety purposes and are then deleted, and that inputs and outputs are not used to train Anthropic’s models. We do not control Anthropic’s systems and this description reflects Anthropic’s published terms as at the date of this policy.
Insights generated are shown only to you. They are stored in your account and are never shared with other users. You can delete them at any time.
If we change AI providers, we will notify you before the change takes effect and will not send your data to a new provider until you have re-accepted the AI Disclosure.
AI-generated content may sometimes be incorrect, misleading, or contrary to established clinical guidance. AI content is for personal reflection, not clinical guidance. See our AI Disclosure and Medical Disclaimer for full details.
Your data is stored in Supabase’s US-based infrastructure, specifically in the AWS us-east-1 region (Northern Virginia, United States).
Our database provider takes automated daily backups of our infrastructure. Backups are retained for a limited period, currently between 7 and 30 days depending on our service plan, and are then overwritten. Backups are held by our provider and are not accessible to us in the ordinary course. This means that for a short period after you delete data, a copy may still exist in a backup before that backup expires. See Section 12.
No method of transmission over the internet, or method of electronic storage, is 100% secure. While we implement commercially reasonable measures to protect your data, we cannot guarantee absolute security. In the unlikely event of a data breach affecting your information, we will notify you in accordance with applicable laws.
Because Woosha handles health information, a breach may also be notifiable under the Federal Trade Commission’s Health Breach Notification Rule, which applies to health applications that are not covered by HIPAA. Where that rule applies, we will notify affected users, the Federal Trade Commission, and, where required, the media, within the timeframes the rule prescribes.
We recognize that Woosha handles categories of information that are especially sensitive:
We treat this information with heightened protection:
Under the California Consumer Privacy Act, you have the right to limit the use of sensitive personal information. To exercise this right, contact privacy@woosha.app.
Woosha is a direct-to-consumer wellness application. Epic Media, LLC is not a covered entity or a business associate under the Health Insurance Portability and Accountability Act (HIPAA), and the information you enter into Woosha is not protected health information under HIPAA. This is a common misunderstanding about health applications, so we state it plainly. The protections that apply to your information are the ones described in this policy, in our Consumer Health Data Privacy Policy, and under the state and federal consumer privacy laws referred to in Section 10.
We will comply with valid legal process (subpoenas, court orders, search warrants) as required by applicable law. Where permitted by law, we will notify you before disclosing your data to law enforcement.
We will not voluntarily share your mental health data or reproductive health data with any government agency without legal compulsion.
If we receive a request for reproductive health data specifically (menstrual cycle information, hormonal tracking, related derived analyses), we will:
Beginning with the calendar year following our public launch, we intend to publish an annual transparency report within the app listing the number of law enforcement requests received, if any, categorized by request type. If we receive no requests in a given year, we will say so.
We will respond to data access, correction, and deletion requests within 30 days.
You may designate an authorized agent to exercise any of the rights described in this Privacy Policy on your behalf. Authorized agents should submit requests through the same channels described above. We may require proof that the person is authorized to act on your behalf and may also verify your identity with you directly before responding to the request.
If we deny your privacy request, you may appeal our decision by emailing privacy@woosha.app with the subject line “Privacy Request Appeal.” We will respond to your appeal within 45 days with our decision and reasoning. If you are dissatisfied with the outcome of the appeal, you may contact your state attorney general.
We honor Global Privacy Control (GPC) and similar universal opt-out preference signals where required by law. If you visit our website with a GPC signal enabled in your browser, we treat this as an opt-out request for the sale or sharing of personal information (though we do not currently sell or share personal information as defined by state laws).
We do not make decisions about you that produce legal or similarly significant effects based solely on automated processing of your personal information. Woosha’s AI features (when enabled) generate insights and suggestions for your review; they do not make binding decisions about you, your account, or your access to services.
If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, you have the following rights under the General Data Protection Regulation:
Our legal bases are as follows. We rely on the performance of our contract with you (Article 6(1)(b)) to operate your account and deliver the features you use; on your consent (Article 6(1)(a)) for optional features including cycle tracking and AI features, and for marketing communications; on our legitimate interests (Article 6(1)(f)) in securing the Service, preventing abuse, and improving the app through crash reports and aggregate usage data; and on compliance with legal obligations (Article 6(1)(c)) where applicable. Because your mental health and reproductive health information are special category data, we rely on your explicit consent under Article 9(2)(a) to process them. You can withdraw that consent at any time by disabling the relevant feature or deleting your account, and withdrawal does not affect processing carried out before withdrawal.
Woosha is not currently offered in the European Economic Area or the United Kingdom. This section is provided in anticipation of a future launch in those regions and will be reviewed, along with our transfer mechanism and representative arrangements, before any such launch.
To exercise these rights, contact privacy@woosha.app.
If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):
Woosha does not sell or share your personal information as those terms are defined under CCPA. We do not need to provide a “Do Not Sell or Share” link because we do not engage in these activities.
To exercise CCPA rights, contact privacy@woosha.app.
Washington residents, and residents of Nevada and Connecticut, have specific rights regarding consumer health data. Because those laws require a separate and separately linked notice, those rights are set out in full in our Consumer Health Data Privacy Policy, published at www.woosha.app/consumer-health-data-privacy and linked from the homepage of our website and from within the app. That document forms part of our privacy disclosures and should be read together with this Privacy Policy.
We provide the following rights to residents of Colorado, Connecticut, Delaware, Kentucky, Maryland, Minnesota, Nevada, Oregon, Rhode Island, Utah, and Virginia in accordance with the Colorado Privacy Act, Connecticut Data Privacy Act, Delaware Personal Data Privacy Act, Kentucky Consumer Data Protection Act, Maryland Online Data Privacy Act, Minnesota Consumer Data Privacy Act, Nevada Consumer Health Data Privacy Act, Oregon Consumer Privacy Act, Rhode Island Data Transparency and Privacy Protection Act, Utah Consumer Privacy Act, and Virginia Consumer Data Privacy Act:
Opt-in consent for sensitive data: Connecticut, Colorado, Virginia, Oregon, Delaware, Maryland, Minnesota, Kentucky, Rhode Island, and New Jersey each require opt-in consent before sensitive personal information is processed. We obtain your explicit consent before collecting or processing health, mental health, or reproductive information, and again separately before any such information is sent to our AI provider.
Colorado, Connecticut, and Nevada residents: You have the right to withdraw consent related to your consumer health data at any time.
Colorado and Connecticut residents: You have the right to designate an authorized agent to exercise your rights on your behalf.
To exercise any of these rights, contact privacy@woosha.app. If your request is denied, you may appeal (see Appeals above).
Woosha is operated from the United States and data is processed in the United States. If you are located outside the United States, please note that the United States may not provide the same level of data protection as your home country. By using the Service, you consent to the transfer, processing, and storage of your data in the United States.
Woosha is offered only in the United States at present. If and when we launch in the European Economic Area or the United Kingdom, we will put in place Standard Contractual Clauses or another valid transfer mechanism with each of our processors, complete a transfer impact assessment, and update this section before that launch.
We retain your account data for as long as your account is active. When you delete your account, we delete your personal data from our systems within 30 days, except where retention is required by law (such as financial records related to subscriptions, which may be retained for up to 7 years for tax purposes).
When you delete your account, your logged content and your sign-in record are removed together in a single server-side operation. We do not retain your email address or your linked Google or Apple identifier after deletion.
One exception applies and we want it to be clear rather than buried. Our database provider takes automated daily backups which are retained for a limited period, currently between 7 and 30 days depending on our service plan, before being overwritten. A copy of deleted data may therefore persist in a backup until that backup expires. Backups are held by our provider, are not accessible to us in the ordinary course, and we do not restore deleted user data from them except where necessary to recover from a system failure.
Feedback and satisfaction responses are retained for product improvement for as long as they remain useful, and are dissociated from your account when your account is deleted. The retention summary shown in Settings within the App is a plain-language version of this section; where the two appear to differ, this section governs, and we will keep the in-app summary aligned with it.
Anonymized or aggregated data, meaning information that cannot be linked back to you personally, may be retained indefinitely for analytics and product improvement. We maintain de-identified data in its de-identified form and do not attempt to re-identify it, except when testing the effectiveness of our de-identification practices.
The Service is not directed to children under 18. We do not knowingly collect personal information from anyone under 18. If we discover that we have collected personal information from someone under 18, we will delete that information promptly.
If you are a parent or guardian and believe your child has provided us with personal information, contact us at privacy@woosha.app and we will delete it promptly.
We do not currently offer any enterprise, therapist, or clinical partnership. This section describes how such an arrangement would work if we introduce one, and no part of it applies to the Service as it operates today. While Woosha is primarily a consumer wellness application, we may offer enterprise, therapist, or clinical partnerships in the future (collectively, “Community Subscriptions”). If you access Woosha through a Community Subscription:
If you sign up through a therapist partnership specifically, your therapist may have limited access to summary reports you explicitly share with them. This will be clearly disclosed at the time you connect with a therapist.
No connected device integration is active in the current release. The App lists Apple Health and the Oura Ring as forthcoming. This section describes how those integrations will operate if and when we enable them, and no part of it applies to the Service as it operates today.
You can revoke access at any time from your device settings or from Settings within Woosha.
Our website (www.woosha.app) currently does not use cookies for tracking, analytics, or advertising. The website is a static informational site.
If we add website analytics or tracking in the future, we will:
We commit to transparency when this Privacy Policy changes. Every published version has a version number and content hash recorded in the app. When we make material changes (changes that affect how we collect, use, share, or protect your data), we will:
Trivial changes (formatting, typo fixes, clarifications that do not change what we do) do not require re-acceptance, but the version number still increments and the change is logged.
For questions, concerns, or requests about this Privacy Policy or how we handle your data:
Epic Media, LLC
Attn: Woosha Privacy
Huntsville, Alabama, United States
Email: privacy@woosha.app
For general support: support@woosha.app
For law enforcement requests: privacy@woosha.app (please include valid legal process; informal requests will not be honored)
For press inquiries: press@woosha.app