Privacy Policy

This policy covers two things: this website (ecstasis.app) and the Ecstasis app. It's written in plain English, not legal boilerplate. If anything is unclear, email us at privacy@ecstasis.app.

Who we are

Ecstasis is an ADHD wellness and productivity app. We are based in the UK and this policy is written to meet UK GDPR requirements.

This website

When you join the waitlist, we collect:

• Your email address — so we can notify you when Ecstasis launches and send occasional updates about our progress. If you arrive via a campaign link, we also store the campaign tags from that link (UTM parameters) alongside your signup, so we know which channels work.

The on-page self-assessment stays in your browser. Your answers to the five sliders (time-blindness, working memory, task paralysis, emotional intensity, hyperfocus) and the score calculated from them are processed on your device to show you your profile — they are never sent to us, stored, or linked to your email address.

The assessment is a general-wellness self-reflection tool, not a diagnostic instrument. Completing it does not mean you have been assessed or diagnosed with ADHD.

Cookies and analytics

If you accept analytics cookies via the consent banner, we use Google Analytics 4 (loaded through Google Tag Manager) to see which pages get read and where people drop off — aggregate patterns, not profiles. This sets Google Analytics cookies (names beginning _ga) and shares standard analytics data with Google, who process it on our behalf.

If you decline — or simply ignore the banner — no analytics cookies are set and nothing is sent to Google Analytics. Your choice is stored on your device, and you can change it any time via "Cookie choices" in the footer. We use no advertising cookies or tracking pixels, and consent for those is permanently set to denied. Analytics applies to this website only — the app contains no analytics that see your content or your health data.

The Ecstasis app

Your account

To use the app you create an account, and we store your email address and an internal user ID. They exist so you can sign in and so your data belongs to you and syncs across your devices — nothing more. We process them because they're necessary to provide the service you signed up for (UK GDPR Article 6(1)(b)).

What you capture

The core of Ecstasis is capturing what's in your head. Here is exactly what happens when you speak to it:

• Your voice is transcribed on your phone. We use Apple's on-device speech recognition — the audio never leaves your device and we never receive or store a recording.
• The text is processed by AI. The transcript is sent, encrypted, to our server, where an AI model (Anthropic's Claude, processing on our behalf under an agreement that does not permit your content to be used to train their models) extracts the tasks, notes, ideas, and feelings in it.
• The transcript is then deleted. Once processing succeeds, the raw transcript is removed from our systems. What remains is the extracted content — your tasks, notes, ideas, and feelings — stored in your account.

If something goes wrong mid-processing, the transcript is kept so the work can be retried, and is deleted the same way once processing succeeds.

Your health data

Some of what the app works with is health data — the most sensitive thing we hold, and we treat it that way.

Sleep: if you connect Apple Health, we read your sleep sessions — only after you've said yes on our own plain-language screen and then Apple's. Caffeine: the drinks you log with one tap. Morning light: your answers to the morning-light question — we store answers only, so a day you skip is just absent. Energy: patterns inferred from what you tell the app, disclosed right on the card that shows them.

All of it lives in your account and nowhere else: isolated per-user at the database level, encrypted in transit and at rest, never shared with any third party, never used for advertising, never sold. Apple Health data is additionally covered by Apple's rules, which forbid it ever reaching advertisers. Delete your account and every row of it goes too — the erasure is enforced by the database itself, not by a clean-up script we have to remember to run.

We process health data only with your explicit consent (UK GDPR Article 9(2)(a)), and you can withdraw it at any time — turn off Apple Health access in iOS Settings, or email us to remove what's stored.

Diagnostics — off by default

To debug the AI pipeline we can keep a redacted copy of what the AI was asked and what it answered. Redacted means names, contact details and similar are replaced with placeholders — but the redaction is imperfect, and some details, medication names among them, can remain. That is exactly why we treat these copies as health data and guard them the same way as everything else in this section.

It is off by default: it happens only if you explicitly opt in to help us improve the product, and if you decline — or simply say nothing — no such copies are kept of your content. The one exception is our own internal team and testing accounts, which have it switched on as part of building the product.

Who processes your data

We use these processors to run the site and the app:

• Supabase — hosts our database: waitlist entries, app accounts, extracted content, and health data.
• Anthropic — processes capture transcripts to extract your tasks, notes, ideas, and feelings, on our behalf and without using your content to train models.
• Vercel — hosts and serves this website, and may process standard technical connection data (such as IP address) as part of delivering pages to your browser.
• Google — only if you accept analytics cookies on this website: processes Google Analytics data on our behalf, as described above.

Where a processor stores or processes data outside the UK or EEA, we rely on appropriate safeguards such as Standard Contractual Clauses.

Who we share it with

We do not sell your data. We do not share it with third parties for marketing or advertising purposes. Your health data is not shared with any third party, full stop. Data is only accessible to the processors listed above and to authorised Ecstasis team members.

How long we keep it

• Waitlist data — until our launch communications conclude, or until you ask us to delete it, whichever comes first.
• Capture transcripts — deleted as soon as processing succeeds.
• App data (account, extracted content, health data) — for as long as your account exists. Deleting your account erases all of it.

Your rights

Under UK GDPR, you have the right to:

• Access the data we hold about you
• Correct inaccurate data
• Request erasure of your data
• Withdraw consent at any time — including Apple Health access, via iOS Settings
• Object to or restrict how we use your data
• Complain to the Information Commissioner's Office (ICO)

To exercise any of these rights — including deleting your account and everything in it — email privacy@ecstasis.app. We'll respond within one month.

Children

The site and app are not directed at children under 16. We do not knowingly collect data from children.

Changes to this policy

We may update this policy as the product or our practices change. We'll update the "Last updated" date above when we do.

Contact

Questions about this policy or your data? Email privacy@ecstasis.app.