Privacy Policy

Last updated: 13 April 2026

Vessel is a meditation app for iOS that generates bespoke sessions tailored to how you feel in the moment. This policy explains what data Vessel collects, how it is used, and the choices you have. We keep collection to what is necessary to deliver the product and do not sell or rent your data.

The short version. Your session history, check-ins, and preferences live on your device. When you start a session, a small amount of context (how you're feeling, how long you have, optional free text) is sent to Vessel's backend to generate a personalised session. That context is processed by third-party AI services (Anthropic and ElevenLabs) via our server and is not used to train their models. Anonymous analytics are collected in production builds only. You can delete your data by uninstalling the app.

1. Who we are

Vessel is operated by the developer of the Vessel iOS app. In this policy, "we", "us", and "Vessel" refer to us, and "you" refers to the person using the app.

You can contact us at [email protected] for any questions about this policy, to request your data, or to exercise any of the rights described below.

2. What we collect

Stored on your device only

The following information is stored locally on your iPhone and is not transmitted to us in a way that identifies you:

This data is stored in your device's user defaults and app sandbox. It is not synced to a cloud service. Uninstalling the app deletes it.

Sent to our backend to generate a session

When you start a session, the app sends the following to our Cloudflare Worker backend, which forwards it to an AI model to produce a personalised session:

We do not attach your name, Apple ID, email address, IP address (beyond standard request logging), or any persistent personal identifier to this data.

Anonymous usage analytics

In production builds of the app downloaded from the App Store, Vessel captures anonymous events through PostHog to understand how the product is used and where to improve it. Examples of events captured:

These events are not linked to your name, email, or Apple ID. Development and internal testing builds do not send events at all — analytics is fully disabled in those builds to keep dev data out of the production dataset.

Subscription and purchase data

Subscription status is managed by RevenueCat on top of Apple's in-app purchase system. RevenueCat receives an anonymous RevenueCat-generated user identifier and Apple's purchase receipt data. It does not see your name, email, payment method, or Apple ID. Apple handles the actual payment; we never see your payment details.

3. How we use your data

4. Who we share data with

Vessel uses the following third-party processors to operate. Each is contractually limited to processing your data solely for the purposes described below:

We do not sell or rent your data to anyone. We do not share your data with advertisers or use it for advertising purposes. We do not combine Vessel data with data from any other source to build profiles about you.

5. How long we keep data

6. Your rights

Depending on where you live, you may have some or all of the following rights:

To exercise any of these rights, email [email protected]. If you want us to delete data held by our processors (for example, to have your anonymous session requests removed from Anthropic's or ElevenLabs' retention windows), include enough context (approximate dates, device type) that we can identify which records to remove.

7. Lawful basis (for users in the UK, EU, and similar jurisdictions)

Where GDPR or a similar law applies, we process your data on the following lawful bases:

Event properties like desired_state or mood_rating are sent as broad categories in the context of a wellness product and are not tied to identifying data. If you prefer not to participate in analytics at all, contact us to request analytics opt-out.

8. Children

Vessel is not directed to children under 13. We do not knowingly collect data from children under 13. If you believe a child has used the app, contact us and we will take appropriate steps, including deletion of any applicable data.

9. Security

Communication between the app and our backend is encrypted over HTTPS/TLS. Data cached on our backend is held on Cloudflare's infrastructure and expires automatically. No internet-connected system is perfectly secure; we do our best to protect your data and will notify affected users if we become aware of a data incident that affects them.

10. International transfers

Our processors (Anthropic, ElevenLabs, Cloudflare, RevenueCat, PostHog, Apple) operate globally. Your data may be processed in the United States, the European Union, or other jurisdictions depending on the processor and your location. Each processor maintains its own safeguards for international transfers, typically via Standard Contractual Clauses or equivalent.

11. Changes to this policy

We may update this policy when we add features, change processors, or clarify how we handle data. The "Last updated" date at the top of this page reflects when the current version took effect. Material changes will be announced in the app or by email where we have one.

12. Contact

For any questions about this policy, to exercise your rights, or to report a concern, email [email protected].