Privacy Policy

Tenang · Last updated 31 October 2026 · Effective 31 October 2026

1. WHO WE ARE

Tenang ("the app") is published by Hery Setiawan ("we", "us"), based in Indonesia. We are the data controller for the personal data described in this policy.

Contact: [email protected]

2. WHAT TENANG IS AND IS NOT

Tenang is a self-help wellbeing journal. It is not a medical device, not a diagnostic tool, and not a substitute for professional care. The PHQ-9 and GAD-7 questionnaires in the app are publicly available screening instruments. They indicate how you may be feeling; they do not diagnose any condition. If you are in crisis, use the SOS screen or contact local emergency services.

3. DATA WE PROCESS

3.1 Stored on your device only (default)

With no account, all of the following is written to your device's local app storage and is never transmitted anywhere:

• Mood check-ins (a 1–5 rating and date)
• Journal notes, free text you write
• PHQ-9 and GAD-7 screening answers and scores
• CBT thought records (situation, thought, evidence, reframe)
• Daily intentions, water log, meditation log, streaks, challenges, achievements
• Reminder times, your display name, language and theme preference

Uninstalling the app deletes all of it. We cannot recover it, because we never had it.

3.2 If you create an account (optional)

An account exists solely to back up and sync your own data across your devices. When you sign in:

Your backup record is readable only by your own account. Access is enforced at the database level by row-level security, so one account cannot read another's data.

Kami tidak memakai email akunmu untuk pemasaran. Email daftar tunggu diatur terpisah di bagian 3.5.

3.3 If you set a PIN (optional, recommended)

Setting a PIN encrypts your data on your device and before it is uploaded. The encryption key is derived from your PIN and never leaves your device, so the backup we hold is unreadable to us and to anyone who obtains it. If you forget your PIN, your data cannot be recovered by us or by anyone.

3.4 Health data

Mood ratings, PHQ-9/GAD-7 responses, journal text and CBT records concern your mental health and are treated as sensitive data. We process them only to provide the features you actively use. We never use them for advertising, profiling for marketing, or any purpose beyond operating the app. We do not read or use your data to train any machine-learning model.

3.5 If you join a waitlist

If you join the native beta waitlist, we collect your email address and your phone platform (iPhone or Android). The platform tells us which store's test list to use. If you join the Self-check Insights waitlist, we collect your email address and any optional note. Your birth date is checked on your device and is never sent to us.

We use this only to send your invitation and the launch emails for that waitlist. We do not use it for anything else. Every email includes a one-click unsubscribe and a reply address; when you unsubscribe, we stop immediately and do not email that address again. You can also email us to delete your waitlist entry.

We keep waitlist entries until you unsubscribe, ask us to delete them, delete a Tenang account that uses the same email address, or the waitlist closes. The waitlist is separate from your account; we never use your account email for marketing.

3.6 If you post on the public feedback board

The Feedback Board in Settings is public. If you post an idea, other users can see its title, description, vote count, and date. A signed-in post is linked to your account by an internal user id, not your email or name, but we can see that link.

Please do not post journal text, mood entries, self-check answers, crisis content, or anything else you want to keep private. The board is for product ideas and feedback, not for personal health information.

We store the post text, your account link, votes, reports, and the time you posted. We use it to run and moderate the board. If you delete your account, we remove the link between the post and your account (so it becomes anonymous), but the text stays visible unless you ask us to remove it or we remove it after a valid report or copyright notice. You can report a post from the board; reports are reviewed by the founder.

4. THE AI FEATURES

Paid AI features (coaching nudges and reflection reports) send a compact statistical summary to Anthropic's Claude API to generate text. That summary contains:

• Your display name, current streak, and today's date
• Mood values with dates
• The number of journal entries and meditations, never their content
• Water log, intention completion rate, challenge progress
• PHQ-9/GAD-7 scores and dates

Anthropic processes this data to return a response and does not use API inputs to train its models. Generated text is cached against your account so the same report is not regenerated repeatedly. AI features require an account and an active trial or subscription.

You never paste an Anthropic API key into the app. The model key is held only on our servers (Supabase Edge Function secrets). We do not ask for, store, or sync a personal API key on your device. Older builds that once offered a “paste your key in Settings” option have been removed; any legacy key left on a device is cleared automatically and is never re-uploaded.

4.1 The Companion chat

The Companion screen is separate from the coaching features above, and it behaves differently.

• By default it runs entirely on your device. Replies come from a built-in rule-based responder. Nothing you type is transmitted anywhere, and conversations are not saved.
• If you use AI replies (Pro or trial, signed in, with cloud configured), your recent chat turns are sent to our secure server, which calls Anthropic with our server-held key. The key never lives on your phone. Messages are not saved in the app after the session ends.

Only the conversation itself is sent for AI replies: the most recent 16 turns, and nothing else. Your name, journal, self-check results, and the rest of your data are not included in Companion chat requests. (Coaching nudges/reports use a separate statistical summary, see above.)

Companion conversations are held in memory for the session only. They are not written to your device, not included in backups, and not synced.

5. PAYMENTS

Payment is handled entirely by the App Store or Google Play. We never see, receive, or store your card number, bank credentials, or any payment instrument. Our server receives only confirmation that your subscription is active, which we use to turn on Pro — that record holds your subscription status and nothing about your payment.

6. WHAT WE DO NOT DO

• No advertising, and no advertising or attribution SDKs
• No cross-app tracking, and no third-party profile built from how you use the app
• No selling or sharing of personal data with data brokers
• No push notification service. Reminders are scheduled locally on your device, so no device push token is created or transmitted
• No access to your contacts, photos, microphone, camera, or precise location

With your consent (the same in-app "Allow" prompt), we use a crash-reporting tool (Sentry) so we can find and fix bugs. It is configured to receive only technical failure data (error type, a stack trace pointing at our own source code, app version, and device/OS model), never your journal text, mood entries, screening answers, account email, or anything you typed. See §7.

With your consent, we also use a product-analytics tool (PostHog) to understand screen use, onboarding progress, confirmed email account creation, trial starts, and confirmed purchases. Before you choose, Tenang keeps only closed event names, timestamps, and random event ids on your device. Nothing is sent to PostHog until you tap "Allow". Tapping "No thanks" deletes that local queue. After opt-in, events use an anonymous id while you are signed out and your account id while you are signed in. They never include your name, email, journal, mood, screening answers, or chat content.

We don't use cookies. The native app has no browser and sets none; our own web pages don't either. See the Cookie Policy for the full list. The one cookie-adjacent exception is Cloudflare Turnstile, a bot-check on the web sign-in and sign-up form. It loads only after you focus an email or password field (not on page view), and runs in an embedded Cloudflare frame that may set its own cookies on Cloudflare's domain to verify you're not a bot. We don't read or receive those cookies ourselves, and Turnstile is not used for analytics, advertising, or tracking. The native app does not use it.

The analytics above doesn't use cookies. Before consent, Tenang may store a short local queue containing only a closed event name, its timestamp, and a random event id. The queue is capped at 100 events and seven days, then expired. Rejecting consent deletes it immediately. After opt-in, PostHog stores an anonymous id while you are signed out or your account id while you are signed in. That's what the in-app "Allow / No thanks" prompt is asking about.

7. SERVICE PROVIDERS

These processors handle data strictly on our instructions:

Supabase menyimpan autentikasi, basis data, cadangan, pendaftaran daftar tunggu (email, platform ponsel opsional, catatan opsional), Papan Masukan publik (judul, deskripsi, tautan akun, suara, waktu), dan formulir umpan balik privat. Email daftar tunggu dipakai untuk mengirim undangan dan email peluncuran; lihat bagian 3.5.

Some providers operate outside Indonesia. Where data is transferred internationally, we rely on the provider's contractual safeguards, including standard contractual clauses where applicable.

8. RETENTION

• Local data: kept until you delete it in the app or uninstall.
• Pre-consent analytics queue: deleted immediately when consent is rejected, otherwise capped at 100 events and seven days before it is sent or expired. A full local data wipe clears queued events but preserves the non-identifying once-per-installation first-open marker.
• Cloud backup: kept while your account exists. It is overwritten on each sync, so we hold one current copy, not a history.
• AI outputs: cached against your account and removed when your account is deleted.
• Account record: deleted on request, at which point remaining data is erased.
• Waitlist entry: kept until you unsubscribe, ask us to delete it, delete a Tenang account that uses the same email address, or the waitlist closes.
• Public board posts: kept while the post is on the board. Deleting your account removes the link to your account but leaves the text unless you ask us to remove it or we remove it after a valid report or copyright notice.

Pendaftaran daftar tunggu: disimpan sampai kamu berhenti, meminta kami menghapusnya, menghapus akun Tenang yang memakai alamat email yang sama, atau daftar tunggu ditutup. Kiriman Papan Masukan: disimpan selama kiriman ada di papan. Menghapus akun menghapus tautan ke akunmu tetapi meninggalkan teksnya kecuali kamu meminta kami menghapusnya atau kami menghapusnya setelah laporan yang sah atau pemberitahuan hak cipta.

9. YOUR RIGHTS AND CONTROLS

Inside the app, at any time:

• Export: Settings lets you export your full data as a file you keep.
• Delete: Settings offers a full wipe. This clears local data and deletes your cloud backup record.
• Sign out: stops all syncing. Local data remains on your device.
• Use the app with no account at all: the default.

Under Indonesia's Personal Data Protection Law (UU No. 27 of 2022), and under the GDPR/UK GDPR if you are in the EEA or UK, you also have rights of access, rectification, erasure, restriction, objection, and portability, and the right to lodge a complaint with your supervisory authority. Email us and we will respond within 30 days. Account deletion requests are honoured in full.

You can also email us to remove a public board post or delete a waitlist entry.

Kamu juga dapat mengirim email ke kami untuk menghapus kiriman Papan Masukan publik atau menghapus pendaftaran daftar tunggu.

California residents: we do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we do not process personal information for cross-context behavioural advertising.

10. CHILDREN

Tenang is not for children under 13. Do not create an account or submit personal data to Tenang if you are under 13. We check age eligibility on your device; your birth date is not sent to or stored by us. We do not knowingly collect personal data from children under 13. If we learn that a child under 13 has provided us data, contact us and we will delete it. Because the app covers mental health topics including self-harm screening, we recommend it for users aged 17 and over, or younger users with the involvement of a parent, guardian, or clinician.

11. SECURITY

Data in transit is encrypted with TLS. Cloud records are protected by row-level access control tied to your account. Setting a PIN adds end-to-end encryption so we cannot read your backup at all. No system is perfectly secure; if a breach affects your data we will notify you and the relevant authority as required by law.

12. CHANGES

We will update the date at the top of this page when this policy changes. Material changes will be announced in the app before they take effect.