Privacy Policy

Last Updated: June 13, 2026

PortalKinetic is the Relief Operating System for overloaded professionals: clear your head, see what matters, and take one next step. This policy explains what we collect, why we collect it, how long we keep it, and the choices you have — across the web app, the iOS app, and the Android app.

PortalKinetic is a relief and clarity support product for overloaded professionals. It is not professional care, lifestyle content, employee monitoring, or regulated device software. Nothing in this policy or in the product changes that.

What We Collect

Account and Profile

When you create an account we collect your email address and any display name or profile picture you choose to add. We use this to identify your account, sync your data across devices, and send account-related messages such as password reset emails.

Content You Create

PortalKinetic stores content you actively choose to create inside the app. This includes:

• Tasks and next moves
• Routines and ritual configurations
• Mental Unload entries and brain dump text
• Journal entries and reflections
• Reset session history and relief path selections
• NFC anchor shortcut configurations
• Private intentions you set for focus or body-doubling sessions
• Weekly reflection signals and clarity check-ins

This content belongs to you. It is stored encrypted in transit and at rest. Journal content is encrypted using a server-side key ( ENCRYPTION_SECRET_JOURNAL) that PortalKinetic controls and that is not shared with your employer or any third party.

App Activity and Usage Events

We collect product telemetry to operate, debug, and improve the service. This includes: sessions started and completed, relief paths selected, features used, button taps, navigation patterns, error and crash reports, app version, device type and operating system, and approximate region derived from your IP address. We do not collect precise GPS location.

Body-Doubling and Regulation Sessions

If you use body-doubling or somatic regulation features, we record session metadata such as start time, duration, and completion status. We do not record audio, video, or screen content from these sessions.

Support Messages

If you contact us for support, we retain the messages and any files you send to resolve your issue.

Security and Access Logs

We log authentication events, sensitive endpoint access (such as data export or deletion requests), and security-relevant signals to detect abuse, unauthorized access, and fraud.

Optional Permissions (Mobile)

Apple Health and Google Fit

On iOS you can connect Apple Health. On Android you can connect Google Fit or Health Connect. If you do, PortalKinetic reads heart rate variability and sleep duration to provide energy context and regulation suggestions. Health data is:

• Optional — the app works fully without it
• Used only for in-app functionality
• Not sold, not shared with advertisers, not used for tracking
• Not shared with your employer or any organization you belong to through PortalKinetic

You can disconnect Health access at any time in iOS Settings or Android Health Connect permissions, or from the app's Settings screen. Disconnecting stops future reads but does not automatically delete data already stored; you can request deletion separately.

Microphone

Some somatic support tools may request microphone permission to detect coarse sound events — for example, a sigh or a vocal anchor — during an active exercise. PortalKinetic does not store raw audio recordings. Detection runs only during the active exercise and is used only to complete that flow. No audio leaves your device.

Camera and Photos

Camera and photo access is used only for profile pictures. We do not analyze, store, or transmit any other image content.

Face ID and Biometric Authentication

Face ID (iOS) and equivalent biometric unlock (Android) are handled entirely by your device's operating system. PortalKinetic never receives or stores biometric data. Biometric authentication is used only to unlock app access on your device.

NFC

NFC access is used only for physical anchor shortcuts you choose to create. When you tap an NFC tag you have configured, PortalKinetic reads the tag payload and launches the linked relief path or routine. We do not read NFC tags you have not configured, and we do not use NFC for background scanning or tracking.

Notifications

Notifications are optional. If you enable them, we use them for reminders, nudges, and support moments you configure. You can turn notifications off at any time in your device settings or in the app.

Calendar and Life Sync Integration

If you enable Life Sync, PortalKinetic can connect to your calendar and task providers — such as Google Calendar — to surface your schedule alongside your relief work. When you connect a provider, we store:

• Connection metadata: provider name, sync status, authorized scopes, token expiry, and last sync timestamp
• Normalized calendar events and tasks imported from the connected account
• Routine candidates detected from recurring event patterns
• Sync run and conflict records

Life Sync data is linked to your account, used only to provide the integration features you enabled, and is not shared with your employer. You can revoke calendar access at any time from your provider's connected-apps settings or from the Life Sync screen in the app. Revoking access stops future syncs. You can export or delete your Life Sync data through the privacy settings.

Wearables

If you connect a supported wearable device, PortalKinetic can receive context signals such as physical state indicators to personalize relief suggestions and ritual timing. Wearable data is processed only to provide in-app functionality, is not sold, and is not shared with your employer. You can disconnect wearable integrations from the app settings at any time.

AI-Powered Features

Some PortalKinetic features use AI language models to generate suggestions, summaries, or clarity prompts. When you use these features:

• Inputs you provide may be sent to an AI model provider to generate a response
• We use AI providers that operate under data processing agreements and do not use your inputs to train their general models without separate consent
• Private content — such as Mental Unload text, journal entries, and private intentions — is sanitized before being included in AI context unless the specific feature explicitly requires that content and you have initiated the request
• AI suggestions are informational, not clinical, and are not a substitute for professional care

You will be presented with a separate AI disclosure at the point of first use of AI-powered features. You can review your consent history in Privacy Settings.

Cookies and Web Tracking

On the web app, PortalKinetic uses:

• Essential cookies: Required for authentication and session management. You cannot opt out of these without also logging out.
• Functional cookies: Used to remember your preferences and settings between visits.
• Analytics events: We collect product usage events (not third-party advertising trackers) to understand which features are used and how to improve reliability. These are associated with your account, not sold to advertisers, and not shared with your employer.

We do not use advertising cookies, cross-site tracking pixels, or third-party ad networks. Your activity in PortalKinetic is not used to target you with ads on other platforms.

How We Use Information

We use the information we collect to:

• Provide, sync, and personalize the app
• Generate in-app suggestions, reminders, and clarity prompts
• Operate billing, subscriptions, and account management
• Debug errors, crashes, and reliability issues
• Detect and prevent fraud, abuse, and unauthorized access
• Comply with legal obligations
• Respond to support requests
• Produce aggregate, anonymized product insights to improve the service

We do not sell personal information. We do not use your private content — Mental Unloads, journals, tasks, intentions, or relief history — for advertising targeting, employer reporting, or AI training without your explicit consent.

Enterprise Accounts and the Organization Boundary

If your employer or organization has an enterprise account with PortalKinetic, the following boundary applies as a product law, not a policy choice:

• Your employer does not see your private tasks, Mental Unload content, journal entries, private next moves, individual relief history, individual cognitive state, private intentions, or raw activity trails.
• The employer-visible reporting plane shows only aggregate, cohort-safe patterns — such as sessions started, sessions completed, and adoption trends — with minimum group sizes enforced before any cohort appears in a report.
• Your employer cannot use PortalKinetic to rank, compare, score, or evaluate individual employees. The reporting plane does not receive the individual identifiers or content required to do that.
• Individual capacity data is never exported to HR, compensation, performance management, promotion, or discipline systems.

This boundary is enforced at the data architecture level. The employer-visible reporting plane and the individual relief workspace are separate planes. The individual plane cannot be read by the employer plane.

Sensitive Data Boundary

PortalKinetic is designed to avoid collecting unnecessary sensitive information. You should not enter emergency information, protected health records, medication instructions, professional care notes, legal information, or crisis-level content into the app unless a specific feature clearly asks for it and explains why. The app is a self-support tool, not a professional record system or an emergency service.

Data Retention

We keep your account information and content while your account is active or as needed to provide the service. Different data categories have different retention windows:

• Brain dump and Mental Unload entries: Retained for the period configured in your account, after which raw text is deleted. You can request earlier deletion.
• Behavior and analytics events: Retained for product analytics purposes for a limited period, after which they are aggregated or deleted.
• Calendar imports (Life Sync): Retained while the integration is active. Revoking the connection stops future imports; you can request deletion of previously imported data.
• Body-doubling and regulation session metadata: Retained for the period configured in your account.
• Security and access logs: Retained for fraud prevention and compliance.
• Billing records: Retained as required by law and financial regulations.

When you delete your account, we initiate a deletion workflow that removes your personal data from active systems. Some data may be retained in backups for a limited period before permanent removal. Billing records and legal compliance records may be retained longer where required.

Your Rights and Choices

You can exercise the following rights at any time through the app or by contacting us:

• Access: Request a copy of the personal data we hold about you.
• Export: Download a machine-readable export of your data, including your Life Sync data, through Privacy Settings.
• Correction: Ask us to correct inaccurate information.
• Deletion: Request deletion of your account and personal data. You can trigger this from Privacy Settings or by emailing us. Immediate deletion is available for most data categories.
• Consent withdrawal: Withdraw consent for optional data uses — such as AI features or Health integration — at any time in Privacy Settings. Withdrawal does not affect processing that already occurred.
• Privacy preferences: Configure what data PortalKinetic collects and how it is used for personalization in Privacy Settings.
• Permissions: Revoke optional device permissions (Health, microphone, camera, notifications) at any time in your device OS settings.

If you are in the European Economic Area, UK, or Switzerland, you have additional rights under the GDPR including the right to object to processing, portability, and the right to lodge a complaint with your local supervisory authority.

If you are in California, you have rights under the CCPA including the right to know, the right to delete, the right to opt out of sale (we do not sell), and the right to non-discrimination for exercising your rights.

Legal Basis for Processing (EEA, UK, Switzerland)

When we process personal data of residents in the EEA, UK, or Switzerland, we rely on the following legal bases:

• Contract: Processing necessary to provide the service you signed up for, including account management, content sync, and billing.
• Consent: Processing for optional features such as Health integration, AI-powered suggestions, and calendar sync.
• Legitimate interests: Processing for fraud prevention, security, product reliability, and aggregated product analytics, where those interests are not overridden by your rights.
• Legal obligation: Processing required to comply with applicable law.

Who We Share Data With

We do not sell personal information. We share data only with:

• Infrastructure providers: Cloud hosting and database services (such as Supabase) that store and process your data on our behalf under data processing agreements.
• AI model providers: When you use AI-powered features, inputs may be sent to an AI provider under a data processing agreement. We use providers that do not train on your data without consent.
• Payment processors: Billing information for subscriptions is handled by our payment processor and is not stored on PortalKinetic servers.
• Analytics tools: Aggregated, anonymized product usage data may be processed by product analytics tools to help us understand reliability and usage patterns.
• Legal compliance: We may disclose data when required by law, court order, or to protect rights and safety.

For enterprise accounts, aggregate cohort-safe reporting is shared with the subscribing organization's admin plane, subject to the organizational boundary described above.

International Data Transfers

PortalKinetic is based in the United States. If you use the service from outside the United States, your data will be transferred to and processed in the United States. For users in the EEA, UK, or Switzerland, we use Standard Contractual Clauses or other lawful transfer mechanisms where required.

Children

PortalKinetic is designed for adults aged 18 and older. We do not knowingly collect personal information from children under 13 (or under 16 in the EEA). If you believe we have inadvertently collected information from a child, contact us at privacy@portalkinetic.com and we will delete it promptly. Child-directed products, if any are launched separately, will operate under age-appropriate consent and data collection rules and will be covered by a separate policy.

Security

We use administrative, technical, and organizational safeguards designed to protect your information. These include encryption in transit (TLS), encryption at rest, server-side journal encryption, access logging on sensitive endpoints, rate limiting, and role-based access controls. No system can be guaranteed to be completely secure. If you believe your account has been compromised, contact us immediately.

Support Boundary

PortalKinetic is not an emergency service. Do not use the app during an emergency. If you are in crisis, contact emergency services in your area (such as 911 in the US) or a crisis line such as the 988 Suicide and Crisis Lifeline (call or text 988 in the US).

Changes to This Policy

If we make material changes to this policy, we will notify you through the app or by email before the changes take effect. The version date at the top of this page reflects the most recent update. Continued use of PortalKinetic after the effective date of a change constitutes acceptance of the updated policy.

Contact

For privacy requests, data questions, or concerns, contact:

• Email: privacy@portalkinetic.com
• In-app: Privacy Settings — export, deletion, and consent management

We aim to respond to privacy requests within 30 days. For deletion requests, immediate deletion is available in the app for most data categories.

This policy is provided for transparency and product safety. It reflects the current state of the product. Have qualified legal counsel review before any commercial launch, regulatory filing, or enterprise procurement process that requires formal policy review.