Privacy Policy

1. Who We Are and Scope

This Privacy Policy explains how Amaran LLC, a Delaware limited liability company ("Amaran," "we," "us," or "our"), collects, uses, discloses, retains, and protects personal information when you use the Amaran mobile application, websites, account services, storage features, delivery features, and related services (collectively, the "Service").

This Policy applies to account holders, people who visit or interact with our websites, people who contact us, and individuals identified by users as recipients. It does not control information independently retained or used by a recipient or other third party after a delivery has been completed.

2. Information We Collect

2.1 Account and Profile Information

Depending on how you use the Service, we may collect account and profile information such as your name, email address, optional phone number, optional profile information, password hash, verification status, authentication identifiers, referral or promotional information where applicable, subscription status, storage usage, and account timestamps. We do not store your plaintext account password.

Phone number (optional). You may add a phone number to your account. We do not currently send text messages. If we introduce SMS notifications or verification in a future release, we will tell you and, where the law requires, ask for your consent before using your number for that purpose.

Sign in with Google. If you choose to sign in with Google, Google shares your name, email address, and profile picture with us, along with an identifier for your Google account. We use this information only to create your Amaran account, sign you in, keep your account secure, and contact you about your account. We do not use information received from Google for advertising, we do not sell it, and we share it only with service providers that help us operate the Service as described in Section 5.2. We keep and delete it together with your account as described in Sections 7 and 8. Amaran's use of information received from Google APIs adheres to the Google API Services User Data Policy.

2.2 User Content

We process the photos, videos, documents, files, notes, folder information, file names, metadata, and other content that you choose to upload, create, or store in Amaran ("User Content"). Because you decide what to store, User Content may contain highly sensitive or confidential information, including financial, health-related, identity, insurance, immigration, family, credential, or other personal information.

Amaran does not require you to upload any particular type of sensitive information. You are responsible for deciding what is appropriate and lawful to store and share.

2.3 Recipient Information

When you designate another person as a recipient, we may process information you provide about that person, such as a name, email address, optional phone number, optional notes, the content assigned to that person, and the applicable delivery instructions. A recipient may be identified without having an Amaran account.

2.4 Delivery, Check-In, and Activity Information

We may process delivery schedules, recurring schedules, inactivity or check-in settings, reminder settings, responses, delivery triggers, delivery attempts, delivery status, download or access events, account activity, and related timestamps.

2.5 Subscription and Transaction Information

We may receive subscription, entitlement, purchase, refund, reversal, and transaction information from an app store or other authorized payment provider. This may include plan type, trial status, subscription status, renewal or expiration date, transaction identifiers, receipts or entitlement information, and refund or dispute status. Payment providers process payment credentials according to their own terms and privacy practices; Amaran generally does not receive a complete payment-card number for transactions processed by them.

2.6 Device, Technical, and Security Information

We may process technical and security information such as device or platform type, operating system, app version, IP address, push-notification token, session information, security events, server or API activity, error information, and other diagnostic or operational information reasonably necessary to operate, protect, and troubleshoot the Service.

The app may request access to device features such as the camera, microphone, photo library, files or storage, and notifications when needed for features you choose to use. Amaran does not currently require access to your device contacts, GPS location, or Bluetooth for the core Service.

2.7 Communications With Us

If you contact support, privacy, legal, or security personnel, we process the contents of your communication and information reasonably necessary to investigate, respond, and maintain appropriate records.

2.8 Sources of Personal Information

We may receive personal information directly from you; automatically from your device, account activity, and use of the Service; from app stores and authorized payment providers; from other users who identify you as a recipient; and from service providers or other parties that help us operate, secure, support, or administer the Service.

3. How We Use Personal Information

• Create, authenticate, secure, maintain, and recover accounts.
• Store, organize, display, retrieve, and manage User Content.
• Manage recipients and carry out user-configured delivery instructions.
• Send verification messages, password-reset messages, check-ins, reminders, delivery notices, security alerts, and other service communications.
• Administer subscriptions, trials, purchases, refunds, disputes, and entitlements.
• Prevent fraud, abuse, unauthorized access, and misuse of the Service.
• Provide customer support and troubleshoot technical issues.
• Maintain, secure, and improve the reliability and operation of the Service.
• Enforce our Terms of Service and protect Amaran, our users, recipients, and others.
• Comply with applicable law, legal process, regulatory requirements, and lawful requests.

4. Advertising, AI, and Profiling

Amaran is not currently an advertising-supported service. We do not use private vault content for targeted advertising, and we do not sell private vault content to advertisers or data brokers.

Amaran does not currently use private vault content to train general-purpose artificial-intelligence models. If we later introduce an optional AI-assisted feature that materially changes how personal information is processed, we will provide any additional notice or consent required by applicable law.

We do not currently make decisions about users that produce legal or similarly significant effects solely through automated profiling.

5. How We Disclose Information

5.1 Your Designated Recipients

We disclose selected User Content to the recipients you designate, according to the content assignments and delivery instructions configured in your account. Designating a person as a recipient does not give that person access to your entire account or all stored content.

After information has been delivered or downloaded by a recipient, the recipient may independently save, copy, forward, disclose, or otherwise use that information. Amaran cannot control information after it has left our systems or has been copied by another person.

5.2 Service Providers

We use service providers to help operate Amaran. These providers may include categories such as cloud hosting and storage providers, database and infrastructure providers, authentication providers, email and notification providers, subscription-management providers, payment processors, security providers, customer-support providers, and other technical service providers. They may process personal information only as necessary to provide services to us or as otherwise permitted by applicable law and their applicable contractual obligations.

5.3 App Stores and Payment Providers

App stores and payment providers may independently process information relating to app distribution, subscriptions, billing, refunds, devices, authentication, and their own platform services. Their own terms and privacy policies apply to processing they conduct for their own purposes.

5.4 Payment Disputes, Refunds, and Fraud

We may disclose limited transaction, account, acceptance, or service-use information to an app store, payment provider, bank, card issuer, payment network, or other appropriate party where reasonably necessary to investigate or respond to a refund, reversal, fraud claim, or payment dispute. We do not disclose private vault content merely to prove that a subscription purchase occurred unless required by law or directly relevant to a specific dispute.

5.5 Legal and Safety Disclosures

We may disclose information when we reasonably believe disclosure is required by applicable law, legal process, court order, warrant, subpoena, regulatory request, or other valid governmental demand. We may also disclose information where legally permitted and reasonably necessary to prevent fraud or abuse, protect the security or integrity of the Service, protect rights or safety, or establish, exercise, or defend legal claims.

5.6 Business Transfers

If Amaran is involved in a merger, acquisition, financing, restructuring, bankruptcy, sale of assets, or similar transaction, personal information may be disclosed during due diligence and transferred as part of that transaction, subject to applicable law.

6. Security and Access to User Content

Amaran uses administrative, technical, and organizational safeguards designed to protect personal information and User Content, including encrypted transmission, encryption at rest, access restrictions, authentication controls, and operational security measures appropriate to the nature of the Service.

Amaran does not currently operate a user-exclusive zero-knowledge or end-to-end encryption architecture. Authorized Amaran personnel and authorized service-provider systems may technically be capable of accessing User Content when reasonably necessary to operate, support, secure, investigate, administer, or comply with legal obligations relating to the Service.

No electronic system is completely secure. We cannot guarantee that unauthorized access, security incidents, loss, corruption, or other security failures will never occur. You are responsible for protecting the email account, devices, passwords, and other credentials associated with your account.

7. Data Retention

7.1 Active Accounts

While an account is active, we generally retain account information and User Content for as long as reasonably necessary to provide the Service and for the purposes described in this Policy.

7.2 Subscription Expiration

If a paid subscription expires and is not renewed, Amaran may retain the account and stored content for a recovery period of up to 90 days so the user can renew or retrieve available content. During this period, the account may operate in a limited or read-only state. After the recovery period, we may delete or de-identify account information, User Content, recipient information, and delivery instructions, subject to legal, security, fraud-prevention, payment-dispute, backup, and other legitimate retention requirements.

7.3 User-Requested Account Deletion

When we receive and verify an account-deletion request, we may disable account access promptly and begin the deletion process. We generally aim to delete or de-identify associated personal information and User Content from active systems within 30 days after verification, except information that we are required or permitted to retain for legal, tax, accounting, security, fraud-prevention, abuse-prevention, payment-dispute, or other legitimate purposes.

7.4 Backups and Residual Copies

Residual copies of deleted information may remain temporarily in protected backups, replicas, logs, or storage systems until they are overwritten or removed through ordinary retention and lifecycle processes. Such residual copies are not intended for ordinary product use and remain subject to applicable security controls.

When you delete an individual item, it is removed from your accessible account. Technical copies may remain temporarily while backend deletion, backup, storage-management, security, or legal-retention processes are completed.

7.5 Delivered Information

Deleting your account or content does not delete information already delivered to, downloaded by, or otherwise independently retained by recipients or third parties.

8. Account and Data Deletion

You may request deletion of your Amaran account through deletion controls made available in the app, through a designated web deletion resource where available, or by contacting privacy@amaran.app from the email address associated with your account.

We may require reauthentication or reasonable identity verification before completing a deletion request to reduce the risk of unauthorized or accidental deletion.

Deleting an Amaran account is separate from canceling a subscription purchased through an app store or other billing provider. You must separately cancel recurring billing through the applicable provider if you want future charges to stop.

9. Recipients Who Do Not Have Amaran Accounts

If another user names you as a recipient, Amaran may receive personal information about you from that user, such as your name, email address, optional phone number, and optional notes. We use that information to maintain the sender's instructions, process any future delivery, secure the Service, and comply with applicable law.

You may contact privacy@amaran.app to ask whether we hold recipient information about you and, subject to applicable law and appropriate verification, request access, correction, or deletion. Removing your recipient information may prevent a future delivery to you.

Where applicable law requires Amaran to provide notice to a person whose information was obtained from another individual, we will provide the notice at the time and in the manner required by that law, subject to lawful exceptions.

10. Your Privacy Rights

Depending on where you live and which privacy laws apply to Amaran, you may have rights to access, correct, delete, or obtain a copy of personal information; restrict or object to certain processing; withdraw consent where processing is based on consent; opt out of certain sale, sharing, targeted advertising, or profiling activities where applicable; and appeal certain privacy decisions or complain to a privacy regulator.

To exercise an applicable right, contact privacy@amaran.app. We may request information reasonably necessary to verify your identity or authority. We will not discriminate against you for exercising a legally protected privacy right.

11. U.S. State Privacy Rights Notice at Collection

Where a U.S. state privacy law applies to Amaran, this section provides a notice at collection and describes rights available to eligible residents. These rights are not absolute and may be subject to statutory exceptions, verification requirements, and limitations under applicable law.

11.1 Categories of Personal Information

• Account and contact information. Identifiers and account information such as name, email address, optional phone number, authentication identifiers, verification status, account timestamps, subscription status, and related profile information.
• User Content. Photos, videos, documents, files, notes, folder information, file names, metadata, and other content you choose to store. Depending on what you upload, this content may include sensitive or confidential information.
• Recipient and delivery information. Recipient names and contact details, content assignments, schedules, reminders, check-in or inactivity settings, delivery attempts, delivery status, and related timestamps.
• Subscription and transaction information. Plan, trial, purchase, entitlement, renewal, expiration, refund, reversal, dispute, and transaction information received from app stores or authorized payment providers.
• Device, technical, and security information. Device or platform type, operating system, app version, IP address, session information, push-notification token, security events, diagnostic information, and other information reasonably necessary to operate and protect the Service.
• Communications. Information you provide when you contact support, privacy, legal, or security personnel.

11.2 Sources

We collect these categories from you, from your devices and use of the Service, from app stores and authorized payment providers, from other users who identify you as a recipient, and from service providers or other parties that support the operation, security, administration, or support of the Service.

11.3 Purposes and Disclosures

We use and disclose personal information for the purposes described in Sections 3 and 5, including to provide and secure the Service, maintain accounts and stored content, carry out user-configured delivery instructions, administer subscriptions, provide support, prevent fraud and abuse, comply with law, and protect rights and safety.

Amaran does not currently sell personal information for monetary consideration. We do not use private vault content for targeted advertising, and we do not currently disclose private vault content for cross-context behavioral advertising.

11.4 Your State Privacy Rights

• Know or obtain information about categories of personal information we collect, sources, purposes, and disclosures, where applicable.
• Access or obtain a copy of personal information, where applicable.
• Correct inaccurate personal information, where applicable.
• Delete personal information, subject to applicable exceptions.
• Obtain data portability where required.
• Opt out of sale, targeted advertising, or certain profiling where applicable. Amaran does not currently sell personal information for monetary consideration or use private vault content for targeted advertising.
• Appeal certain privacy-request decisions where applicable.
• Exercise applicable rights without unlawful discrimination or retaliation.

To exercise an applicable right, email privacy@amaran.app. We may ask for information reasonably necessary to verify your identity, residency, account relationship, or authority to make the request.

11.5 Authorized Agents

Where applicable law permits an authorized agent to submit a request on your behalf, we may require evidence of the agent's authority and may also require you to verify your identity or confirm that you authorized the request.

11.6 Sensitive Personal Information

Because you decide what to store, User Content may contain information treated as sensitive under some privacy laws. Amaran processes User Content to provide, secure, support, and administer the Service and to carry out your instructions. We do not currently use private vault content for targeted advertising or sell private vault content.

12. EU, EEA, and UK Privacy Rights

Where the GDPR, UK GDPR, or similar law applies, Amaran may process personal data on one or more legal bases, including performance of a contract, legitimate interests, compliance with legal obligations, consent where required, and protection of vital interests in exceptional circumstances.

Applicable rights may include access, rectification, erasure, restriction, objection, portability, withdrawal of consent, and the right to lodge a complaint with a competent supervisory authority. Where we rely on legitimate interests, those interests may include providing and securing the Service, preventing fraud and abuse, maintaining reliability, protecting users and recipients, and establishing or defending legal claims.

If applicable law requires Amaran to appoint a local representative, data protection officer, or similar contact, Amaran will make the required contact information available through this Policy or another legally appropriate channel.

13. International Data Transfers

Amaran is operated from the United States, and personal information may be processed in the United States and other countries where our service providers operate. Data-protection laws in those countries may differ from those in your country.

Where applicable law requires safeguards for an international transfer, we will use a legally recognized mechanism or other permitted basis for the transfer.

14. Children

Amaran is intended for adults. You must be at least 18 years old to create an Amaran account. We do not knowingly permit children under 18 to create accounts. An adult account holder may choose to store lawful content about or for a child and is responsible for having the authority to do so.

15. Third-Party Services

The Service may interact with app stores, authentication services, payment providers, communications providers, cloud services, and other third-party services. When a third party independently determines how it uses personal information for its own purposes, its own terms and privacy policy apply. This does not limit any responsibility that applicable law independently places on Amaran for its own processing or use of service providers.

16. Security Incidents

If we become aware of a personal-data breach or security incident that requires notice under applicable law, we will provide notices to affected individuals, regulators, or other parties as required by that law.

17. Changes to This Privacy Policy

We may update this Policy as the Service, our business, technology, or applicable law changes. The "Last Updated" date identifies the current version. If a change materially affects your privacy rights or materially changes how we use previously collected personal information, we will provide any notice or consent required by applicable law before the change becomes effective.

18. Contact Us