Privacy
Last updated: 10 November 2026
States of Bliss is operated by States Of Bliss, a limited liability company registered in the State of Florida, United States. We offer States of Bliss in the United States and the United Kingdom.
If you have any question about this policy or about your information, email us at arian@statesofbliss.com. A person reads that address.
You tell us how you feel. We use that to build you a session. We do not sell your information to anyone, we do not advertise to you, and we never use what you write in your hardest moments to market anything.
The rest of this page is the detail, in plain words.
When you create an account. Your email address, your password and your name if you give us one. Your password is handled by our sign-in provider, and we never see it. If you sign in with Google, we receive your email address and name from Google. We never see your Google password.
When you complete onboarding. Your answers to three questions: what brought you here, how much time you have each day, and your experience with breathing practice. You choose each answer from a short list.
When you agree to how we use your check-ins. Before you check in, you tick a box to agree, and to confirm you are 18 or over. If we change what we send to the AI or how we explain it, we ask you again. We record the date and time you agreed and which version of the wording you agreed to.
When you check in. The words you write about how you feel, the kind of moment you say it is (a hard one, a bit of both, or a good one), and how strong the feeling is, from 1 to 5. If you start a journey, we also keep which journey and how long. What you write is the heart of the product, and it is also the most personal thing we hold.
What we build for you. The session we make from your check-in: a short reading of how you seem to be, the breathing practice, the soundscape, the affirmation, the plan for your day and where to rest a hand. We keep it so you can come back to it. If what you write suggests you might be in crisis, we keep a note of that so the app can show you where to find support.
After a session. How you felt afterwards. Usually that is one of five answers, from "Eased a lot" to "A lot more". If you came in on a good day, it is one of three: "It grew", "About the same" or "It faded a little". We also keep how many sessions you have finished and when you last did one.
Your garden. The plant you choose, when you planted it, when you last changed it, and which landmarks you have already seen.
If you become a member. On our website your payment is handled by Stripe; in the iPhone app, by Apple through the App Store. We never see or store your card number. We keep your Stripe customer and subscription references or your App Store membership's end date and product, your plan, your membership status, whether it is set to end, the date it renews or ends, when a free trial ends, and whether you are a founding member, so the app knows what you have access to.
Your free sessions. Each time you use one of your free weekly sessions, or your one free journey, we record that you used it and when, so we can count what is left. Never what you wrote.
If you send feedback. Your message, where in the app you sent it from, and which session it was about if you sent it from one. Only our team reads it.
If you turn on reminders in the iPhone app. Your device's notification token, the time you chose and your timezone. We also record the date of your last reminder and which message it was, so we never send two in a day or the same line twice in a row. Turning reminders off deletes the token.
Keeping the service safe. The dates and times you use the app. To stop anyone overloading the service we count requests: by account when you are signed in, and by internet address when someone uses the form to join our list. If a session fails to build, we record that it failed and what kind of failure it was, never what you wrote.
If you give us your email to hear about States of Bliss, we use it only to send you updates about States of Bliss. We rely on your consent. Email arian@statesofbliss.com and we will remove you. If you later delete a States of Bliss account with the same email address, we remove it then too.
When you write about how you feel, you may describe your mental or physical health. Under UK data protection law that is special category data, and it gets extra protection.
We do not ask you for health information, and we do not require it. If you choose to write it, you are choosing to share it with us in order to receive a session, and we treat it as sensitive. You can delete it at any time by deleting your account, which removes it permanently.
If you would rather not share something, write less. The app works fine with a short sentence.
This is the part we most want you to understand clearly.
To build your session, what you write at check-in is sent to Anthropic, the company behind the Claude AI model. The AI reads it, interprets it, and sends back the parts of your session.
Your check-in is sent to Anthropic to build your session. Under Anthropic's commercial terms it is deleted within 30 days, unless it is flagged for breaking their usage policy, in which case it can be kept for up to 2 years. Anthropic does not use it to train its models.
The AI receives exactly this: what you write at check-in, how strong the feeling is, the kind of moment you chose, your onboarding answers, which journey and length you chose if you start one, your local time to the nearest hour, and the names of the breathing practices and soundscapes from your last five sessions, and of the day plans and practices, and the kind of each practice, from your recent quick sessions, so your sessions can vary. It never receives your name, your email address or your account details. Nothing else you do in the app is sent to an AI.
If you are not comfortable with this, the honest answer is that you should not use States of Bliss, because this is how the product works.
Under UK data protection law (the UK GDPR) we need a lawful reason for everything we do with your information.
To provide the service you asked for. Creating your account, building your sessions, keeping your history and your garden, and taking your payment. This is necessary to keep our agreement with you.
Where you have chosen to share something sensitive. We only use what you write in a check-in with your explicit consent, which you give by ticking a box before you check in, and again if the wording changes. You can withdraw it at any time by deleting your account or emailing us.
To keep the service safe and working. Limiting requests, preventing abuse, fixing faults and understanding whether the product is working. This is our legitimate interest in running a secure service that works, balanced against your rights.
If you join our list. Your consent, which you can withdraw at any time.
We do not sell your information. We do not share it for advertising. We share it only with the companies that make the product run:
Supabase
Stores your account and everything in your app history in its database, and handles signing in. It also starts account emails, such as sign-up confirmations and password resets, which Resend delivers, and stores the sounds and voice clips the app plays, so it sees your internet address when your browser plays them.
Resend
Delivers sign-in and account emails, such as sign-up confirmations and password resets. It receives your email address and the content of those emails.
Vercel
Runs and serves the app. Every visit passes through it, including your internet address and browser details. Our own logs leave out what you write.
Sentry
Receives error reports when something in the app goes wrong, and timings for a small share of visits, so we can fix problems. Both are stripped of what you write and your email before they are sent, and contain only technical details such as which part of the app failed.
Anthropic
What you write at check-in, how strong the feeling is, the kind of moment you chose, your onboarding answers, your journey choice, your local time to the nearest hour, and the names of recent practices, soundscapes and day plans, and the kind of each practice, to build your session. Never your name or email address.
Stripe
Your email address and an account reference when you become a member, and the card and billing details you type into Stripe's own page.
Cloudflare Turnstile
On the sign-up and sign-in pages, a quick check that you are a person. Cloudflare sees your internet address and basic browser details.
Only if you choose to sign in with Google. Google confirms who you are and shares your name and email address with us.
Apple
Delivers the reminders you choose to turn on in the iPhone app. If you become a member in the iPhone app, Apple takes your payment through the App Store. We never see your card. If you choose to sign in with Apple, Apple confirms who you are and shares your email address, which may be a private relay address, and your name the first time. We keep a token from Apple so we can end that sign-in when you delete your account.
RevenueCat
Only in the iPhone app. Keeps track of App Store memberships for us, using your account number, never your name or email, so the app knows when your membership is active.
Each of these is bound by a contract that limits them to acting on our instructions.
We will also disclose information if we are legally required to, or where we genuinely believe it is necessary to protect someone from serious harm.
The companies above are based in the United States, so if you are in the UK your information is sent there. Those transfers are covered by the safeguards UK law requires, such as the standard contractual clauses with the UK addendum, or an equivalent safeguard.
We keep your information for as long as your account exists.
If you turn on reminders, your device tokens and reminder settings are kept until you turn reminders off or delete your account. The date of your last reminder and which message it was are kept until you delete your account, so turning reminders off and on again never sends two in one day or the same line twice in a row.
If you delete your account, we delete your profile, your check-ins, your sessions, your garden, your feedback and your history, and any list sign-up with the same email address. This is permanent and we cannot recover it afterwards. If you are a member through our website, your membership is cancelled first, and then your Stripe customer record is deleted. Your RevenueCat record is deleted too. A membership bought in the iPhone app is managed by Apple, so cancel it in your iPhone's Settings before deleting your account. Stripe and Apple keep their own payment records, which are needed for tax, for as long as the law requires. The counters we use to stop overloading may remain, but they hold only an account number or an internet address and a count, never anything you wrote.
Wherever you live, you can ask us to:
These are your rights under UK data protection law, and we offer them to everyone. You can delete your account yourself from inside the app, which is the fastest way. For anything else, email arian@statesofbliss.com and we will reply within one month.
If you are in the UK and you think we have handled your information badly, you can complain to the Information Commissioner's Office at ico.org.uk. We would rather you told us first, but it is your right either way.
We use cookies only to keep you signed in and to keep your session secure. We do not use advertising cookies, tracking pixels or analytics that follow you around the internet. There is nothing here to consent to, because nothing optional is running.
We also remember a few choices in your browser, such as whether voice guidance is on and which notes you have closed. Your garden can mention the time of day you tend to feel calmer. To do that, your browser reads its own time zone for this, and does not send it to us. If you turn on reminders, we store your timezone, as described above.
States of Bliss is not for anyone under 18. We do not knowingly collect information from children. If you believe a child has created an account, email us and we will delete it.
Your information is protected by access controls designed so that one user cannot read another user's data, enforced at the database level rather than only in the app. Connections are encrypted. Payment information never touches our servers.
No service can promise perfect security, and we will not pretend otherwise. What we can say is that we have treated this seriously and we do not hold anything we do not need.
If we change this policy we will update the date at the top and, where the change is significant, tell you in the app or by email. We will not quietly change what we do with your information and hope you do not notice.
arian@statesofbliss.com
States Of Bliss
State of Florida, United States