Feedback Sent

Support & Compliance Center

Privacy-First Architecture · International Regulatory Compliance

Compliance Standards & Principles

GDPR Compliant
Full EU/UK regulation compliance with zero raw PII retention and instant right to erasure.
CCPA / CPRA
Zero sale or monetization of seeker data. Strict data minimization by default.
HK PDPO & Apple
Adherence to Hong Kong Schedule 1 Principles and App Store Guideline 5.1.1.

Frequently Asked Questions

What is Concordia's privacy-first architecture?
Concordia is designed with a local-first paradigm. Your mindfulness practices, breathing anchors, resonance minutes, and journal reflections are stored securely on your local device. Optional cloud synchronization uses salted one-way hashing and modern cryptographic standards.
How does anonymous Guest Mode telemetry work?
To measure active engagement (Daily, Weekly, and Monthly Active Users) without compromising anonymity, Concordia generates an ephemeral, salted 256-bit cryptographic Client Identifier (SHA-256). Your raw IP address is processed in volatile memory and is never written to our persistent database.
How is my account data and password protected?
All data transfers are secured via TLS 1.3 / HTTPS encryption. Passwords are protected using industry-standard Bcrypt cryptographic hashing with timing-safe verification. Direct public download access to internal database files and system logs is permanently blocked at the web-server layer.
How do I delete my account and data?
You maintain complete sovereign ownership of your data. You can delete your account and all associated cloud records at any time directly through the app's Profile settings or by visiting the Account Portal. Deletion triggers an immediate, irreversible purge from our database.

Feedback & Technical Assistance

Data Protection & Inquiries

For data access requests, privacy inquiries, or developer support, contact our dedicated desk:

hello@concordiamindfulness.com
×

Global Privacy Policy

Effective Date: September 2026 · Compliant with GDPR, CCPA/CPRA, HK PDPO, and Apple Guidelines

1. Guiding Philosophy: Privacy-by-Design

Concordia Mindfulness ("Concordia", "we", "our") is founded on the belief that personal mindfulness practice is deeply intimate. Our technology is engineered around Privacy-by-Design and Data Minimization. We do not track you across the web, we do not deploy third-party advertising SDKs, and we never sell or monetize your information.

2. Information We Collect & Lawful Basis

We process only the minimum information required to deliver a seamless mindfulness experience:

  • Guest Seekers (No Account): If you use Concordia in Guest Mode, zero personally identifiable information (PII) is required. Practice counters are stored locally on your device.
  • Registered Members (Optional Cloud Sync): If you choose to create an account to sync progress across macOS and iOS, we store your email, username, encrypted password hash, and accumulated mindfulness metrics (anchors, resonances, focus minutes, streak counts, custom themes, and journal reflections).
Lawful Basis under GDPR (Article 6): Cloud synchronization is processed under Contractual Necessity (to fulfill your request to sync your account) and anonymous service maintenance under Legitimate Interest.

3. Cryptographic Client Telemetry (DAU / WAU / MAU)

To understand system health and aggregate active usage without identifying individual human beings, Concordia generates a salted one-way cryptographic Client Identifier:

  • Mechanism: Computed via SHA-256(Salt + IP + UserAgent + Language).
  • IP Anonymization: Your raw IP address is processed strictly in volatile memory during the HTTP request cycle and is never recorded or stored in our database.
  • Purpose: Used exclusively to aggregate Daily Active Users (DAU), Weekly Active Users (WAU), and Monthly Active Users (MAU). It cannot be reverse-engineered to identify your device or identity.

4. Data Security & Storage Hardening

We employ rigorous technical and organizational security measures (GDPR Article 32):

  • Transport Encryption: All client-server communications are enforced over TLS 1.3 / HTTPS.
  • Password Security: Passwords are cryptographic hashes produced via Bcrypt. Concordia personnel cannot access or view your plaintext password.
  • Server Defense-in-Depth: Database files, backup archives, and application logs are protected by active multi-layer web server access interception rules that issue immediate 403 Forbidden blocks to direct HTTP requests.

5. International Regulatory Compliance

Concordia adheres strictly to international privacy standards:

  • GDPR / UK GDPR: You have the right to access, rectify, export, and permanently erase your personal data (Articles 15–20).
  • CCPA / CPRA (California): We do not sell or share personal information with third parties. California residents enjoy complete sovereignty over their data.
  • Hong Kong PDPO: Compliant with the Six Data Protection Principles (collection limitation, accuracy, retention, use limitation, security, and openness).
  • Apple App Store Guideline 5.1.1: Transparent data disclosures and full support for native local-first offline usage.

6. Data Retention & Right to Erasure

You maintain full control over your stored records:

  • Instant Account Deletion: Deleting your account in the Profile settings immediately and irrevocably purges all associated records from our live database.
  • Ephemeral Telemetry: High-granularity request logs are automatically rotated and deleted after 24 hours.

7. Third-Party Sharing

Concordia maintains a strict Zero Third-Party Sharing Policy. We do not integrate tracking pixels, cross-app advertising identifiers (IDFA), or analytics brokers.

8. Data Protection Contact

For inquiries regarding your rights or our cryptographic privacy architecture, please contact:

Data Protection Desk: hello@concordiamindfulness.com