Privacy | Refuge

REFUGE

Effective Date: February 17, 2026 | Last Updated: February 17, 2026

---

Refuge Technologies LLC ("Company," "we," "us," or "our") operates the Refuge application and website at refugeapp.ai (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

We take your privacy seriously. Given the deeply personal nature of the conversations you may have with Refuge, we have designed our systems and policies to protect your data with the highest standards of care.

By using the Service, you consent to the collection, use, and disclosure of your information as described in this Privacy Policy. If you do not agree with the terms of this Privacy Policy, please do not access or use the Service.

1. Information We Collect

1a. Information You Provide Directly

Account Information: When you create an account, we collect your email address, display name, and password (if using email authentication). If you sign in with Google or Apple, we receive your name and email address from those providers. We do not receive or store your Google or Apple password.

Conversation Content: When you use the Service, we collect and store the messages you send to and receive from the AI companion. This includes all text content within your conversations and guided journeys.

Payment Information: When you subscribe to a paid plan, your payment information (credit card number, billing address) is collected and processed directly by our payment processor, Stripe, Inc. We do not store your full credit card number on our servers. We receive and store only a truncated card number (last 4 digits), card type, and billing status from Stripe.

Communications: If you contact us via email at support@refugeapp.ai, we collect the content of your message, your email address, and any other information you choose to provide.

1b. Information Collected Automatically

Usage Data: We collect information about how you interact with the Service, including timestamps of your sessions, number of messages sent, features used, and pages visited on our website.

Device Information: We may collect information about the device you use to access the Service, including device type, operating system, browser type, and general location (city/region level, derived from IP address). We do not collect precise GPS location data.

Cookies: We use essential cookies to maintain your authentication session and remember your preferences. We do not use advertising cookies, tracking cookies, or third-party analytics cookies that follow you across other websites. See Section 7 for more details.

1c. Information We Do NOT Collect

We do not collect or store biometric data, precise geolocation data, contacts from your phone or device, data from other apps on your device, or any information from minors under the age of 18. We do not use any form of facial recognition technology. We do not record audio or video.

2. How We Use Your Information

We use the information we collect for the following purposes:

Providing the Service: To operate and maintain the Service, process your conversations through our AI system, store your conversation history, manage your account, and deliver guided journeys.

Billing and Payments: To process subscription payments, manage your billing cycle, enforce usage limits based on your subscription tier, and send transaction-related communications.

Service Improvement: To understand how users interact with the Service in aggregate (not by reading individual conversations), identify and fix technical issues, and improve the overall user experience.

Security: To detect, prevent, and address fraud, abuse, security incidents, and technical issues.

Legal Compliance: To comply with applicable laws, regulations, legal processes, or enforceable governmental requests.

Communications: To respond to your inquiries and send you essential service-related notifications (such as billing confirmations, security alerts, and Terms updates). We will not send you marketing emails without your explicit opt-in consent.

3. How We Protect Your Data

We implement robust technical and organizational measures to protect your personal information:

Encryption in Transit: All data transmitted between your device and our servers is encrypted using TLS (Transport Layer Security) 1.2 or higher.

Encryption at Rest: Your conversation data is stored in encrypted databases hosted by Supabase, which uses AES-256 encryption at rest.

Access Controls: Access to user data is strictly limited to essential personnel and systems required to operate the Service. We employ role-based access controls and audit logging.

Third-Party Security: Our infrastructure providers (Supabase for database, Railway for application hosting, Stripe for payments) maintain SOC 2 compliance and industry-standard security practices.

No AI Training on Your Data: Your conversations are never used to train, fine-tune, or improve AI models. Your messages are sent to the AI provider (Anthropic) for real-time processing only, and Anthropic does not retain or train on data sent through their API. Your conversations exist solely to serve you.

While we implement commercially reasonable safeguards, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security. In the event of a data breach that affects your personal information, we will notify you in accordance with applicable law.

4. Data Sharing and Disclosure

We do not sell, rent, or trade your personal information to third parties. Period.

We do not use your data for advertising purposes. We do not share your data with advertisers, data brokers, or marketing companies.

We may share limited information with the following categories of service providers, solely to operate the Service:

AI Processing (Anthropic): Your messages are transmitted to Anthropic's Claude API for real-time AI response generation. Anthropic processes these messages under their API terms, which prohibit them from using API data to train their models. Messages are not stored by Anthropic after processing.

Database and Hosting (Supabase, Railway): Your account information and conversation data are stored on servers operated by Supabase (database) and Railway (application hosting). These providers act as data processors on our behalf under contractual obligations to protect your data.

Payment Processing (Stripe): Your payment information is processed by Stripe in accordance with their privacy policy and PCI-DSS compliance standards. We do not have access to your full payment card details.

We may also disclose your information if required by law, such as in response to a valid subpoena, court order, or government request; if necessary to protect the safety, rights, or property of Refuge Technologies LLC, our users, or the public; or in connection with a merger, acquisition, or sale of assets, in which case you will be notified of any change in ownership or control of your personal information.

5. Your Rights and Choices

Depending on your jurisdiction, you may have the following rights regarding your personal information:

Access: You may request a copy of the personal information we hold about you.

Correction: You may request that we correct inaccurate or incomplete personal information.

Deletion: You may request that we delete your personal information. You can delete individual conversations at any time within the Service. You may also request complete account deletion by contacting us at support@refugeapp.ai. Upon account deletion, we will remove your personal data within 30 days, except where retention is required by law.

Data Portability: You may request a machine-readable copy of your data.

Opt-Out of Marketing: You may opt out of marketing communications at any time by clicking the unsubscribe link in any marketing email or by contacting us. Note that we may still send you transactional and service-related communications.

To exercise any of these rights, please contact us at support@refugeapp.ai. We will respond to your request within 30 days.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you with the Service. Specifically:

Account Information: Retained for the duration of your account plus 30 days after deletion.

Conversation Data: Retained for the duration of your account. You may delete individual conversations at any time. All conversation data is deleted within 30 days of account deletion.

Billing Records: Retained for 7 years after the last transaction, as required for tax and accounting compliance.

Server Logs: Automatically purged after 90 days.

7. Cookies and Tracking Technologies

We use only essential cookies necessary for the operation of the Service. These include authentication session cookies (to keep you logged in) and preference cookies (to remember your settings).

We do not use advertising or tracking cookies. We do not use pixel tags, web beacons, or similar technologies that track you across other websites. We do not participate in cross-site tracking or behavioral advertising networks.

You can configure your browser to refuse cookies, but this may prevent you from using certain features of the Service (such as staying logged in).

8. Third-Party Links

The Service may contain links to third-party websites or services (such as social media profiles). We are not responsible for the privacy practices or content of these third-party sites. We encourage you to review the privacy policies of any third-party sites you visit.

9. Children's Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have inadvertently collected personal information from a child under 18, we will take immediate steps to delete such information. If you believe a child under 18 has provided us with personal information, please contact us at support@refugeapp.ai.

10. International Data Transfers

The Service is operated from the United States. If you are accessing the Service from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States. By using the Service, you consent to the transfer of your information to the United States, where data protection laws may differ from those in your jurisdiction.

If you are a resident of the European Economic Area (EEA), United Kingdom, or other jurisdiction with data transfer restrictions, we will ensure that any international transfers of your personal data are conducted in compliance with applicable legal requirements, including the use of Standard Contractual Clauses or other approved transfer mechanisms as appropriate.

11. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the following additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

Right to Know: You have the right to request information about the categories and specific pieces of personal information we have collected about you, the categories of sources from which we collected personal information, the business or commercial purpose for collecting personal information, and the categories of third parties with whom we share personal information.

Right to Delete: You have the right to request deletion of your personal information, subject to certain exceptions.

Right to Opt-Out of Sale: We do not sell your personal information. We have not sold personal information in the preceding 12 months.

Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise your California privacy rights, contact us at support@refugeapp.ai. We will verify your identity before fulfilling your request.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by posting a prominent notice on the Service at least 30 days before the changes take effect. We encourage you to review this Privacy Policy periodically.

Your continued use of the Service after the effective date of the revised Privacy Policy constitutes your acceptance of the updated terms.

13. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Refuge Technologies LLC

Email: support@refugeapp.ai

Website: refugeapp.ai

For data protection inquiries or to exercise your privacy rights, please email support@refugeapp.ai with the subject line "Privacy Request."

---