Last updated: June 4, 2026
Solace is built for people navigating binge eating recovery. We understand this journey is deeply personal. Your privacy isn't just a policy to us — it's a promise. We will never sell your data, never use it to train AI models, and we treat everything you share with the care it deserves.
This Privacy Policy explains what information we collect, why we collect it, how we use it, and your rights over it. We've tried to write it in plain language. Where the law requires us to be precise, we are. Where we can speak in your voice, we do.
If anything is unclear, reach out at support@solaceapp.me.
Solace is operated by an individual sole proprietor based in Germany. References to "we", "us", or "Solace" in this policy refer to this operator.
Contact for privacy matters: support@solaceapp.me
For users in the European Union, you have the right to lodge a complaint with your local data protection supervisory authority. In Germany, this is your federal state's data protection officer.
When you create a Solace account, we collect:
Solace is a place to reflect. When you use the app, you may create:
All of this is your content. We store it so you can access it across your devices. We do not read it, analyze it, or use it for any purpose beyond providing the service to you.
When you use Solace, we automatically receive:
If you joined our pre-launch waitlist, we collected your email address to notify you when Solace became available. This data is kept only as long as you remain on the waitlist or active as a user.
When you subscribe to Solace Pro, we receive limited subscription data from Apple and our subscription processor RevenueCat — specifically: your subscription status, the product you purchased, the date of purchase, and the date of expiration. We do NOT receive your payment method, credit card details, or full transaction information — those are handled entirely by Apple.
To be specific about what we don't do:
We use your information for the following purposes and no others:
To provide the Solace service. Storing your journal entries, syncing your data across your devices, authenticating you when you sign in, sending you essential emails about your account, and running the server-side functions that power features like the therapist export.
To improve the app's reliability. Receiving crash reports so we can fix bugs that affect users. These reports contain technical details about the crash, not your personal content.
To communicate with you about your account. Confirming your email, helping with password resets, answering your support questions. We do not send marketing emails unless you explicitly opt in.
To meet legal obligations. If we're required by law to retain or disclose information, we will do so with the minimum necessary scope.
We do not use your information for:
Under the General Data Protection Regulation (GDPR), we process your information based on the following legal grounds:
To run Solace, we use a small number of trusted service providers. Each is bound by a Data Processing Agreement requiring them to handle your data according to GDPR standards.
Supabase stores your account information, journal entries, voice notes, and all other content you create in the app. We also use Supabase Edge Functions to run server-side logic — for example, generating your therapist export PDFs, processing certain in-app actions, and handling background tasks that can't run on your device.
All data — including data processed by Edge Functions — is hosted in Supabase's European Union region (Frankfurt, Germany). Edge Functions execute in the same region. Supabase processes your data on our behalf under a Data Processing Agreement and does not use your information for any other purpose.
If you choose to sign in with Google, we receive your Google email address and unique Google account identifier. We do not receive any other Google account information (contacts, files, etc.). You can revoke this access at any time through your Google account settings.
Resend sends you emails related to your account — sign-in confirmations, password resets, and similar essential communications. Your email address is shared with Resend solely for this purpose. Resend is based in the United States and does not retain message content.
If the Solace app crashes on your device, Firebase Crashlytics automatically sends us a technical report containing:
Crash reports do not contain your journal entries, voice notes, anchors, letters, or any other personal content you've created in the app. Firebase Crashlytics is provided by Google.
We use PostHog to understand how people use Solace — which features help most, where users get stuck, and how we can improve the app. PostHog collects:
PostHog does not collect your journal entries, voice notes, emotions, or any personal content you create. Analytics data is stored in PostHog's European Union servers.
You can opt out at any time in Settings → Privacy → Usage Analytics.
Solace's public website (solaceapp.me) is hosted on Vercel. Vercel does not have access to any user account data or in-app content — it only serves the marketing pages.
RevenueCat helps us manage in-app subscriptions. They receive a unique identifier for your account and subscription metadata from Apple. They do not have access to your journal entries, voice notes, or other personal content.
We use PostHog for anonymous usage analytics (see above). You can opt out in Settings → Privacy. We do not use advertising-focused analytics like Google Analytics, Mixpanel, or Amplitude. We do not use advertising networks.
Your personal data is primarily stored and processed in the European Union (Supabase, Frankfurt). Some service providers (Resend, Firebase, Vercel, RevenueCat) are based in the United States and may transfer data internationally.
When such transfers occur, they are protected by:
Active account data: We retain your information for as long as your account is active.
Deleted account data: When you delete your account, we permanently remove your personal data and all your content (journal entries, voice notes, etc.) within 30 days. Some technical information (anonymized crash logs, transaction records required for accounting) may be retained for up to 90 days for technical and legal reasons.
Waitlist data: Retained until you join Solace or unsubscribe from the waitlist, whichever comes first.
Backups: Encrypted backups may retain data for up to 90 days after deletion before being purged in normal backup rotation.
We take the security of your data seriously.
No system is perfectly secure, but we use the practices and technologies appropriate for a personal recovery companion.
If we ever become aware of a data breach affecting your information, we will notify you and the relevant authorities within 72 hours as required by law.
You have the following rights regarding your personal data:
Right to access — You can request a copy of all data we hold about you. Most of this is also available directly in the app.
Right to rectification — You can correct inaccurate or incomplete data. Most fields are editable in the app.
Right to erasure ("right to be forgotten") — You can delete your account and all associated data from within the app, or by emailing support@solaceapp.me. Deletion is permanent and irreversible.
Right to data portability — You can request your data in a machine-readable format. The Therapist Export feature provides a PDF version; we can provide a structured data export on request.
Right to restrict processing — You can ask us to stop processing your data in certain circumstances.
Right to object — You can object to processing based on legitimate interests.
Right to withdraw consent — Where processing is based on your consent, you can withdraw it at any time.
Right to lodge a complaint — You can complain to your local data protection authority if you believe we've violated your rights.
To exercise any of these rights, email support@solaceapp.me. We will respond within 30 days.
Solace is intended for adults. You must be 13 years or older to use Solace.
We do not knowingly collect personal information from anyone under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at support@solaceapp.me and we will delete it immediately.
We have chosen 13 as our minimum age because eating disorders in minors typically require parental involvement and clinical supervision that a companion app cannot provide. If you are under 13 and struggling with disordered eating, please reach out to a parent, trusted adult, or contact the support resources listed at the end of this policy.
To be unmistakably clear:
The Solace mobile app does not use cookies. The Solace mobile app uses only the technical storage necessary to keep you signed in (authentication tokens stored securely on your device).
The Solace website (solaceapp.me) uses only essential cookies required for the waitlist functionality and basic site operation. We do not use marketing or tracking cookies.
Solace does not currently use artificial intelligence or machine learning to process your personal content. Your journal entries, voice notes, and other reflections are not analyzed by AI, not used for sentiment analysis, and not used to train any models.
If we ever add AI-powered features in the future (for example, optional summaries of your journal entries), we will:
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.
When we make material changes, we will:
Your continued use of Solace after a policy update means you accept the revised terms. If you don't agree, you can delete your account at any time.
This Privacy Policy is about how we handle your data. But if you're reading this because you're struggling right now, please know:
Solace is a companion, not a treatment. If you're in crisis, considering self-harm, or experiencing a mental health emergency, please reach out:
Eating disorder support:
Questions, requests, or concerns about your privacy:
Email: support@solaceapp.me
We aim to respond to all privacy-related inquiries within 7 days, and to formal data rights requests within 30 days as required by law.