privacy policy

effective date: 4 november 2026

This policy explains how Aware Movement (Pty) Ltd collects, uses, stores, and protects your personal information for The Aware System, in accordance with the Protection of Personal Information Act, 2013 (POPIA) of South Africa.

1. Responsible Party and Information Officer

The responsible party is Aware Movement (Pty) Ltd, registration number 2025/500633/07.

The Information Officer is contactable at hello@theawaresystem.com. All requests relating to your personal information should be sent to this address.

2. Information We Collect and Its Source

• Waitlist email: if you submit your email address on theawaresystem.com, we collect that address, provided directly by you, together with which link brought you to the site (for example, an Instagram or Reddit post), or 'direct' if there wasn't one.
• Contact form: if you write to us through the form on theawaresystem.com, we collect your name, your email address, the category you select, and the content of your message, provided directly by you.
• Test user application: if you apply on theawaresystem.com to become a test user, we collect your name, your email address, your age, whether your phone runs iOS or Android, and a record that you ticked the consent box, provided directly by you. If you are invited, the test service that delivers the app also reports installs, usage counts, crash reports and any feedback you send through it. Section 3D below sets out what we do with them.
• Account information: when you sign up in the app, we collect your email address and a password, provided directly by you.
• Date of birth: the date you enter when you set up your account, provided directly by you. We collect it for one purpose, to confirm that you are 18 or older. The Aware System is not intended for anyone under 18, and we do not knowingly create accounts for them. Section 3B below sets out what we do with it.
• Sex at birth: an optional value you may select when you set up your account, provided directly by you. "Prefer not to say" is one of the choices and skipping it has no effect on anything. Section 3A below sets out why we ask and what we do with it.
• In-app usage events: a small record of actions taken in the app, such as that a day was logged, how many lanes were filled, and that a reflection was sent. These events are recorded against your account. They contain counts, dates and identifiers only, and never the content of anything you write.
• Subscription and entitlement information: if you buy a paid plan, the app store tells us which plan you hold and whether it is still active. We never receive your card number, your billing address, or any other payment information. Payment is taken by the store, not by us.
• User content: the observations, reflections, and sequences you enter into the Observe, Reflect, and Examine layers, provided directly by you and stored in your private account.

3. The Nature of User Content

The Aware System is not a medical or diagnostic tool. The entries you record are your own self-observations, not clinical health records, diagnoses, or assessments. We do not process your entries as health information, and we do not use them to infer, evaluate, or record any health condition. They exist only as your private log, accessible to you.

We do not monitor or review what you write. No member of staff reads your entries in the ordinary course of running the service. Access to the database is restricted, and row level security is applied so that an account can reach only its own records.

3A. Sex at Birth

We ask for one value, once, when you set up your account.

We use it for a single purpose: to count how the app is used across sexes. That counting is done in aggregate. The figures it produces are totals only. They contain no name, no email address and no account identifier, and once aggregated they cannot be traced back to any individual. We do not analyse this value at the level of an individual person. It is never used to interpret your record, it never changes a reading you are shown, and nothing in your own experience of the app depends on it.

The value is held on your account alongside your other account details, so that you can see it, correct it, or have it removed. That is the only reason it is held against your account rather than separately.

It is not shared with any third party, it is not used for advertising or profiling, and it is deleted when your account is deleted. You may correct it or ask us to remove it at any time by emailing the Information Officer.

3B. Date of Birth and the Age Requirement

You must be 18 or older to use The Aware System. We ask for your date of birth once, at account set-up, so that we can confirm this.

It is used for that purpose and no other. It is not used to interpret your record, it never changes a reading you are shown, it is not used for advertising or profiling, and it is not shared with any third party. It is stored on your account record and is deleted with your account.

If we learn that an account belongs to someone under 18, we will delete that account and the record attached to it. If you believe a person under 18 has created an account, contact the Information Officer at hello@theawaresystem.com.

3C. Artificial Intelligence Features

Some features use Claude, an artificial intelligence model provided by Anthropic, PBC, a company in the United States. Those features are Reflect’s replies, the written readings in Review, and the suggested sequences in Examine.

To produce them we send Anthropic the relevant text you have written and logged in the app. That means your Observe notes and states, your Reflect messages, and the name and background you have given Reflect. We never send your email address, your account identifier, your sex at birth or your date of birth.

Anthropic processes this in the United States, only to produce the response returned to you, and under its commercial terms does not use it to train its models.

The app asks for your permission before any of this is sent, and you can switch it off at any time in Preferences. The rest of the app works without it.

One point worth stating plainly. Not every one of these is something you tap. Reflect replies and Examine suggestions are produced when you ask for them. The written readings in Review are produced by the app when you open the Review tab, without a further action from you. Your permission still gates all of it, and withdrawing permission stops all of it.

3D. Test Users

If you apply to become a test user, we collect your name, your email address, your age and whether your phone runs iOS or Android, and record the date and time you submitted it, with the consent box ticked.

We use them to decide whom to invite, to send the invitation, and to contact you about the test. Your age is used only to confirm that you are 18 or older. Your phone type tells us which test service, Apple's or Google's, to invite you through. Applying does not place you on the waitlist, and the link that brought you to the site is not recorded with an application.

If you are invited, your email address is given to Apple (TestFlight) or Google (Google Play), whichever delivers the test version to your phone, so that it can send you the invitation. Their test services also show us your name as you gave it to them, whether you installed the test version, how often it is used, crash reports, and any feedback or screenshots you choose to send through them. We use these only to fix and improve the app. Once you install the test version, the rest of this policy applies to your account and your record as it does for anyone else. Your account and record are kept when a test ends, whether you carry on with test versions or move to the public app.

An application is kept while we run testing. It is deleted when you withdraw it or when testing stops, whichever comes first. You may withdraw your application, and have it deleted, at any time by emailing the Information Officer.

3E. Cookies and Your Choices

This section covers the website, theawaresystem.com. When you first visit, a banner offers reject all, manage choices and accept all. Nothing optional is stored, and no advertising tag runs, until you choose. You can change your choice at any time with “cookie choices” at the foot of every page.

• ck (strictly necessary): remembers your choice, as a random number, the choice and the date. Kept for 12 months, then you are asked again. Not shared beyond our storage operator (Supabase).
• source (strictly necessary): held in your browser only for the visit, it remembers the link that brought you so the waitlist form can record it. Deleted when you close the tab.
• Google Ads measurement (only with your yes): tells us which of our ads brought you to the site, so we only pay for ads that work. Google's tag is not loaded at all until you say yes, and it is told never to personalise ads. It sets two cookies on this site (_gcl_au and _gcl_aw) and one on Google's own sites (GCL_AW_P), each kept for 90 days. If you change your answer to no, the cookies on this site are removed at once; Google's own expire, or you can clear them in your browser.

Personalised advertising is never allowed. We do not let Google, or anyone, use your visit to follow you with advertising on other sites, and we never sell your personal information. With your yes, Google receives only what it needs to tell us which ad brought you here. If your browser sends a Global Privacy Control signal, we treat it as a no and do not show the banner.

Each choice is recorded as proof of consent: the random number, the choice, whether a privacy signal was on, the banner version and the time. No email address, IP address or account is recorded with it. It is stored with Supabase.

4. Purpose of Collection

• The waitlist email is used solely to send you one notification when the app launches. The link that brought you is stored with it and used only to see which posts reach people. It is not shared or used for advertising.
• A test user application is used solely to choose testers, to invite them, and to contact them about the test.
• Contact form information is used solely to read and answer your message, and for nothing else.
• Account information is used to create, secure, and manage your account.
• Date of birth is used solely to confirm that you are 18 or older.
• In-app usage events are used only to see which parts of the app are used and to find what is broken. They are not used for advertising, profiling, or any decision about you.
• User content is used only to operate the app and let you track your own history over time, and, where you have given permission, to produce the artificial intelligence features described in section 3C.
• Your cookie choice is used only to remember it and to prove it was given.
• Subscription and entitlement information is used to give you access to the plan you have bought and to restore it on a new device.

We do not process your information for any purpose beyond those stated above. We advertise the app with Google Ads. Apart from the link recorded with a waitlist email, the only measure of where visitors come from is Google Ads measurement, which runs only if you say yes to it (section 3E).

5. Whether Provision Is Voluntary, and the Consequences

Providing your personal information is voluntary. No law requires you to provide it. If you do not provide a waitlist email, you will not receive the launch notification. If you do not provide account details, you will not be able to create or use an account. If you do not provide a date of birth, we cannot confirm that you are 18 or older, and an account cannot be created. Sex at birth is optional and nothing depends on it. If you do not buy a subscription, no subscription information exists and you keep the plan that costs nothing. If you do not apply to become a test user, you will not be invited to test the app. If you do not complete the contact form, you can still reach us by email at hello@theawaresystem.com.

6. Legal Basis and How Consent Is Given

We process most of your personal information on the basis of your consent. For the waitlist and for the contact form, submitting the form on theawaresystem.com is the act of consent. For the test user form, ticking the consent box and submitting the form is the act of consent. Each submission of any of these forms is recorded with a date and time stamp as a record of that consent. For the artificial intelligence features in section 3C, the permission you give in the app is the act of consent. For website cookies, your choice in the banner or the cookie choices panel is the act of consent, recorded as section 3E describes; you can withdraw it there at any time.

Two things are not processed on the basis of consent. Where you buy a subscription, we process the information needed to give you that plan because it is necessary to perform the contract between us, under section 11(1)(b) of POPIA. Your date of birth is processed so that we can meet our own obligation not to provide the service to anyone under 18.

You may withdraw your consent at any time by emailing the Information Officer, after which we will stop processing and delete the relevant information, subject to any retention we are lawfully required to keep. Withdrawing consent does not cancel a subscription. You cancel that through the app store, as set out in section 10 of the Terms of Service.

7. Operators and Recipients

We use trusted service providers, known under POPIA as operators, who process personal information on our behalf and under a duty of confidentiality:

• Netlify, for website hosting, waitlist capture, test user applications and contact form submissions.
• Supabase, for authentication and secure data storage. Your record is held in Supabase's Ireland region. Supabase also holds the record of website cookie choices.
• Google, for Google Ads measurement on the website, only if you say yes to it (section 3E).
• Anthropic, PBC, as the artificial intelligence provider for the features described in section 3C.
• Resend, to send you account emails: your sign-up code, password reset links, and the confirmation when an account is closed. It receives your email address and the content of those messages.
• Google Workspace, for our own email.
• Apple (TestFlight) and Google (Google Play), to deliver test versions to invited testers. Each receives the email address of the testers it delivers to, and reports back installs, usage counts, crash reports and the feedback testers send through it.
• The Apple App Store and Google Play, for the purchase, renewal and restoration of subscriptions. They handle payment themselves and we never see or hold your card details.

We require our operators to provide the same or equal protection of your personal information as this policy states. We do not sell, rent, or trade your personal information, and we never share it to target advertising at you.

Section 3C sets out exactly what is sent to Anthropic, what is never sent, and how to switch it off.

8. Cross-Border Transfer

Our operators store or process personal information on servers located outside South Africa. Your record in Supabase is held in Ireland. Text sent to Anthropic under section 3C is processed in the United States. Google Ads measurement (section 3E) is processed by Google on its own servers, which may be outside South Africa. Our other operators process information in the regions their own terms set out.

Where this occurs, we take reasonable steps to ensure the information receives a level of protection comparable to that required by Section 72 of POPIA, and we require each operator to provide the same or equal protection as this policy states.

9. Data Security

We use industry-standard authentication through Supabase and apply reasonable technical and organisational measures to protect your information against loss, unauthorised access, and misuse.

10. Breach Notification

If your personal information is compromised through unauthorised access or disclosure, we will notify the Information Regulator and you, as the affected data subject, as soon as reasonably possible, in accordance with Section 22 of POPIA.

11. Retention and Withdrawal

Waitlist email addresses are held only until the app launches and the launch notification has been sent, after which they are deleted unless you have separately created an account. You may withdraw from the waitlist and have your address deleted at any time before then by emailing the Information Officer at hello@theawaresystem.com. Test user applications are kept while we run testing, and are deleted when you withdraw or when testing stops. Messages sent through the contact form are kept only for as long as needed to answer you and to keep a record of that correspondence, and are deleted on request. Account information and user content are retained while your account is active. When you close your account in the app, it is deactivated immediately and held for 30 days, so that you can reopen it in that window. At the end of the 30 days your account and everything in it are permanently purged, and that cannot be reversed. In-app usage events are retained while your account is active and are purged with it. Subscription and entitlement information is retained while the subscription is active, and afterwards only for as long as we are lawfully required to keep a record of it. You can also export your record from inside the app at any time, on every plan, before closing the account.

12. No Ads Shown to You

We will never display third-party advertising, we never allow personalised advertising based on your visit, and we will never use your personal content to manipulate or convert behaviour.

13. Your Rights Under POPIA

As a data subject, you have the right to be notified about the collection of your information, to access the personal information we hold about you, to request its correction or deletion, to object to its processing, and to withdraw your consent at any time. To exercise any of these rights, email the Information Officer at hello@theawaresystem.com.

14. Lodging a Complaint

If you believe your personal information has been handled unlawfully, you have the right to lodge a complaint with the Information Regulator of South Africa:

15. Relationship to the Terms of Service

This policy forms part of, and should be read together with, our Terms of Service.

16. Changes to This Policy

We may update this policy from time to time. For material changes to the purpose or legal basis of processing, we will notify you by email where we hold your address. Your continued use of the service constitutes acceptance of the updated policy.

4 November 2026: section 3E added for website cookies; sections 4, 6, 7 and 12 updated to match. Later the same day: Google Ads measurement switched on, only with your yes (section 3E); sections 8 and 12 updated to match.

2 November 2026: section 3D added for test users; sections 2, 4, 5, 6, 7 and 11 updated to match.

1 November 2026: section 7 now names Resend as the sender of your sign-up code and password reset links, as well as the confirmation when an account is closed.