Privacy policy

Who is responsible?

Pandaly is a product by KoaLab, a sole proprietorship based in Québec, Canada, registered under enterprise number (NEQ) 2282514399. This policy covers the Pandaly app and pandaly.app website.

For personal information requests, contact the person responsible for its protection at KoaLab: support@pandaly.app, subject “Privacy”.

The data we process

• Account and profile: email, account identifier, authentication managed by Supabase, chosen name, gender if provided, language, form of address and time zone.
• Sessions: meditation needs and preferences, duration, voice, generated text and media, history, favourites, playlists, sharing and audio settings. Some choices may reveal information about your well-being.
• Operation: technical connection data, app version, errors and generation and usage operations needed to operate, secure and troubleshoot the service. When Sentry is enabled in your version, diagnostics and an internal identifier are sent to it.
• Support: your email, message and any attachments you choose to provide.
• On your device: securely stored sign-in session, preferences and playback cache.

Do not provide diagnoses, medical records or sensitive information unnecessary for your request.

Purposes and your choices

We use this data to manage your account, personalise and produce requested sessions, retain your choices, enable playback and sharing, respond to requests, prevent abuse and fix errors. We do not sell your information or use it for targeted advertising.

You can limit optional information, edit your profile or stop using personalisation. Contact us to withdraw consent, request a copy or delete your data. Some features require data to be provided.

Artificial intelligence and providers

Personalised sessions use external services. Depending on the feature and selected voice:

• Supabase: authentication, profiles, session data and media storage.
• Fly.io: server hosting and request processing.
• Google Gemini / Imagen: generating text and images from session parameters. Your name, gender if provided and selected need may be used for personalisation.
• ElevenLabs and Fish Audio: speech synthesis from text, which may include a name or other personalised elements.
• Sentry, when enabled: error diagnostics. The configuration reviewed disables screenshots, view-hierarchy capture and profiling.
• Cloudflare: website delivery and protection.
• Google Workspace (Gmail and Google Groups): receiving and managing support correspondence.

These providers process data needed for their services. Information may also be disclosed where legally required or to protect service security and people’s rights. Generated text and voices are not advice from a healthcare professional.

Website and cookies

This website does not install advertising cookies, load remote fonts or embed tracking scripts. It has no accounts or forms: contact links open your email application.

Cloudflare processes connection data, including IP addresses, requests and browser information, to deliver and protect the website. Aggregate statistics may be available through the hosting service. Your email provider also processes sent messages.

Retention and deletion

The account and its preferences are retained to provide the service while the account is active. Session content may expire under service retention rules; permanent availability is not guaranteed. Support correspondence is retained as needed to handle and follow up on requests.

Following a deletion request and identity verification, we delete the account and associated data, except information required for a legal obligation, security or a dispute. Backups and logs may remain during their retention cycle; the applicable period and any exception will be explained in our response.

We respond to access or correction requests within 30 days of receipt, under applicable rules. This response period is not a promise to immediately purge backups. See the deletion procedure.

Sharing sessions

Anyone with a sharing link can import the session. Share only what you are comfortable disclosing, including personalised elements in the content. Revoking a link does not delete copies already imported.

Security and transfers

We use measures including encrypted connections, access controls and secure sign-in session storage on your device. No system can guarantee absolute security.

Providers may process information outside Québec or Canada, including in the United States and Europe, where legal protections may differ. Québec requirements for assessing and governing transfers apply to KoaLab.

Your rights and complaints

Under applicable law, you may request access, correction, a structured copy of computerised information you provided, withdrawal of consent and deletion of your data. Reasonable identity verification may be necessary; do not send a password.

Email support@pandaly.app. You may also contact the Commission d’accès à l’information du Québec or the Office of the Privacy Commissioner of Canada. Rights and exceptions under applicable law continue to apply.

Minors and changes

Pandaly is not designed for children under 13. Where parental consent is legally required, it must be obtained before information is provided. If you believe a child supplied data without required consent, contact us to review and delete it.

This policy may evolve with the service. Its date appears at the top. Material changes to purposes or consent must be brought to your attention before implementation.