Believe

Privacy

Believe Privacy Policy

Believe is a 90-day mindset practice. This policy explains what data the current release handles in the app and on this website.

Last updated: 10 August 2026

Back to Believe Join the list

Summary

  • Believe does not require an account in the current release.
  • Believe stores private practice content locally. Its protected private stores, audio files, recovery copies, and widget snapshot container are backup-excluded. Some settings, derived progress and achievement totals, and a device-local identity-statement fingerprint use standard iOS app preferences and may be included in a device or iCloud backup under the user's Apple backup settings. If Believe cannot exclude the widget container from backup, it does not write the private widget snapshot.
  • Believe can request permission for notifications and microphone access.
  • Daily reminder previews use generic wording. If the user schedules a one-off Learn reminder, its preview can include a shortened version of that lesson's task. Widgets may show the user's identity statement if added.
  • Believe uses AppsFlyer for limited app-install and advertising attribution. Its current Meta integration forwards only the broad app-launch/activation event and the approved onboarding, first-check-in, and milestone conversion families, including organic opens needed to verify the connection. TelemetryDeck anonymous product analytics is off by default and starts only after the user explicitly opts in.
  • Believe may use Apple's privacy-protected App Store analytics, crash reports, and MetricKit diagnostics.
  • Believe does not include the Meta SDK or TikTok SDK. AppsFlyer is the only component allowed to update SKAdNetwork or AdAttributionKit conversion values.
  • The public website is hosted on Cloudflare Pages. Only the Believe landing page at /believe/ offers optional Meta Pixel measurement, and it does not contact Meta unless the visitor selects Allow measurement. Waitlist and support forms are sent through FormSubmit only when a visitor submits one.
  • Believe does not sell personal information.

Data Believe stores

Depending on how the user chooses to use the app, Believe may store:

  • identity statements
  • check-in data
  • gratitude reflections
  • the most recent optional Learn practice response or reflection
  • PERMA and weekly survey entries
  • reminder preferences
  • onboarding and privacy consent choices
  • progress, milestone, achievement, and lesson history
  • locally recorded audio files
  • a device-local SHA-256 fingerprint of the normalised identity statement, used only to tell whether a saved recording matches the current statement
  • a local product-analytics queue and minimal delivery ledgers containing only pending allowlisted events, safe bounded values, unconfirmed submission-attempt or provider-handoff receipts, and one-time duplicate-suppression keys

Where data is stored

Believe stores private practice content locally on the device using Apple platform storage. Audio recordings remain on the device so the user can play them back in the app. Believe marks its protected private stores, audio files, recovery copies, and widget snapshot app-group container as excluded from device backup; if the widget container cannot be marked successfully, Believe does not write the private widget snapshot. Standard iOS app preferences are not included in that exclusion guarantee. They can contain settings, derived progress and achievement totals, and the device-local statement fingerprint described above, and may be included in a device or iCloud backup under the user's Apple backup settings. The narrow measurement queue and ledgers contain no private practice content. Believe records a submission-attempt receipt before calling a measurement SDK so an interrupted response is not blindly submitted twice. A confirmed request is reduced to its one-time duplicate-suppression key; a callback-free submission attempt or otherwise ambiguous provider handoff remains marked unconfirmed rather than being represented as delivered. If saved practice data cannot be read, Believe may preserve a protected recovery copy and let the user export it through the iOS Share Sheet.

Anonymous product analytics

Anonymous Usage Analytics is off by default. Believe does not initialise TelemetryDeck or create or transmit a TelemetryDeck product event until the user explicitly turns this choice on during privacy review or later under Settings > Privacy & Legal. When enabled, Believe uses TelemetryDeck to understand whether broad product flows work. TelemetryDeck may receive a random protected app-install identifier, an allowlisted event name, a rounded timestamp, technical app and device metadata, and safe bounded properties such as a day number, safe onboarding-step name, entry surface, or permission-result value.

The allowlist covers broad actions such as opening the app, completing a safe onboarding step, starting or completing a daily check-in, reaching an approved milestone, opening or acknowledging a lesson, using Audio, viewing Progress, scheduling or opening a reminder, opening a widget, and using a reset control.

TelemetryDeck says it does not store IP addresses and anonymises its identifiers. Anonymous Usage Analytics can be turned off under Settings > Privacy & Legal without removing an app feature. Opt-out prevents Believe from creating or handing off new product-analytics events, clears pending and unconfirmed TelemetryDeck envelopes from Believe's local queue, terminates the SDK, and removes its known on-device cache. A minimal content-free one-time duplicate-suppression key may remain until Delete All Believe Data so re-enabling analytics does not blindly repeat an earlier ambiguous handoff. The TelemetryDeck SDK does not provide Believe with a public callback or purge control that can confirm cancellation of a signal already handed to the SDK, queued for asynchronous processing, or already in flight, so one transmission that had already started may finish.

Advertising attribution

Believe uses AppsFlyer to understand which campaigns lead to installs and activation. On a fresh install, AppsFlyer configuration and session startup stay paused while Apple's ATT choice is not determined. Believe durably queues the content-free first-open signal locally during that pause. After the user allows or denies the native Apple choice—or on a later launch when the choice is already resolved—AppsFlyer may start and process the queued signal and qualifying sessions. The IDFA remains disabled unless the user authorised ATT. AppsFlyer can otherwise use IDFV, its installation identifier, the connection IP address, and Apple's privacy-preserving attribution paths. AppsFlyer may process limited device and app technical information, an AppsFlyer installation identifier, IDFV, an IP address that AppsFlyer may resolve to regional coarse location, campaign interactions, and only these broad advertising events: first open/install; AppsFlyer's automatic app-launch/session activation signal when the app enters a qualifying foreground session; onboarding completed; first full daily check-in completed; and Days 3, 7, 14, 30, 60, and 90 reached.

Believe currently has one active advertising-partner integration: Meta ads through AppsFlyer. It forwards AppsFlyer's broad app-launch/activation event plus the approved onboarding, first-check-in, and milestone conversion families for all acquisition sources, including organic, so the connection can be verified and Believe's own campaigns can be attributed and optimised. AppsFlyer's Advanced Data Sharing setting is enabled for that restricted event map; Advanced Matching Data Sharing is disabled, and Believe does not supply a name, email address, phone number, customer user ID, or other contact field for matching. TikTok, Google Ads/YouTube, and Apple Ads are not currently active partner integrations. This policy and the App Store disclosures must be reviewed before another partner is activated.

AppsFlyer's session signal does not contain a private practice entry, and Believe does not log a competing custom first-open event. Believe does not send detailed product activity to Meta or another advertising partner. AppsFlyer is the sole mobile measurement partner and sole owner of SKAdNetwork and AdAttributionKit conversion-value updates.

App Tracking Transparency

Apple's App Tracking Transparency (ATT) permission controls access to the IDFA and tracking across other companies' apps or websites. On a fresh install, Believe explains the advertising purpose on the final onboarding privacy screen and requests ATT only after the user chooses Agree and review Apple privacy choice. The same contextual control remains available later under Settings > Privacy & Legal. Believe does not request ATT automatically at cold launch.

If ATT is denied or has not been decided, the entire app remains usable and Believe does not access the IDFA. TelemetryDeck remains a separate anonymous product-analytics choice, while Apple's privacy-preserving SKAdNetwork or AdAttributionKit attribution can still operate.

Information never sent in measurement events

Believe's measurement allowlist prohibits identity statements; selected focus areas, moods, or personal difficulties; gratitude, reflection, check-in, or lesson text; PERMA or weekly survey answers or scores; audio; notification or reminder text; support messages; names, email addresses, or contact information; health or therapy labels; free-form strings; and a persistent custom identifier shared between product analytics and advertising systems.

Permissions

Believe may ask for:

  • Microphone access, to record a user's identity statement for playback
  • Notification access, to send reminder notifications chosen by the user
  • ATT, only from the contextual measurement control described above

If a user denies a permission, the rest of the app can still be used except for the specific feature that depends on microphone or notification access. ATT denial does not remove any feature.

Notifications and widgets

If the user enables notifications, Believe does not include the user's identity statement, check-in answers, or private reflections in notification previews. A one-off Learn practice reminder may include a shortened version of the lesson task the user chose to revisit.

If the user adds a Believe widget, the identity statement and summary practice information may appear on the Home Screen or Lock Screen through Apple's widget system.

Apple analytics, crashes, and MetricKit

Apple may provide Nosey Suze Pty Ltd with privacy-protected App Store acquisition and usage reports, crash reports, and MetricKit performance or diagnostic payloads. Some usage data is available only when people choose to share diagnostics and usage information with Apple, and Apple applies privacy thresholds. Believe uses this information for acquisition baselines, crash-free usage, performance trends, and release-quality monitoring. No third-party crash-reporting SDK is included in this design.

Believe does not intentionally attach private practice content to logs, analytics, crash reports, or MetricKit payloads.

TestFlight and testing

Simulator, automated-test, screenshot, and capture builds use non-network measurement paths. TestFlight signals are marked or separated from App Store production data and excluded from production dashboards and campaign decisions. Registered physical test devices may be used to verify delivery before release.

Website measurement, forms, and services

The public website is hosted through Cloudflare Pages. Cloudflare receives standard network request information needed to deliver and protect the site, which can include an IP address, browser and device details, requested URL, and request time.

Only the Believe landing page offers optional Meta Pixel measurement using Meta Pixel/Dataset ID 1027064830216687. The page does not load connect.facebook.net, contact Meta, or set Meta cookies unless the visitor affirmatively selects Allow measurement. Only necessary leaves the Pixel off. The page stores only the versioned consent choice in local storage, and the persistent Privacy choices footer control lets the visitor reopen and change it.

After consent, Meta Platforms may receive a PageView and, only when either Apple call-to-action link is selected, the content-free custom event AppStoreOutboundClick. The implementation disables automatic event configuration, does not configure advanced matching, and provides no customer or contact fields. Believe supplies no custom event parameters or content-derived values. It removes every URL query parameter except a valid Meta click identifier (fbclid), which is retained only long enough for the Pixel to initialise attribution and is then removed from the address bar. It does not supply a full referring path, names, email addresses, phone numbers, form fields, contact details, or any app practice, PERMA, wellbeing, audio, reminder, support, or other sensitive content. Before Meta loads, the page reduces an available referrer to its origin. Meta can still process the connection IP address, user-agent and browser/device metadata, the canonical Believe landing-page address, the consented fbclid, referrer origin, and first-party identifiers such as _fbp or _fbc for advertising measurement, attribution, security, and campaign reporting.

Believe treats this Meta website dataset as a Health and wellness dataset and limits it to the two content-free events above. Website Pixel consent is separate from the app's ATT choice, AppsFlyer attribution, and TelemetryDeck choice.

Changing the choice to Only necessary stops Believe from making new Pixel event calls, invokes Meta's fbq consent-revocation command if the library is already loaded, and makes a best-effort attempt to remove accessible first-party _fbp and _fbc cookies. A Meta script already loaded cannot be reliably unloaded from the current page, and an event already queued, sent, or in flight may finish. Closing or reloading the page completes the current-page reset, but withdrawal cannot recall information Meta already received.

If a visitor submits a waitlist or support form, the website sends the information entered to FormSubmit so it can deliver the submission to Nosey Suze Pty Ltd by email. A submission may include a name, email address, support message, the page it came from, and campaign parameters included in the page URL. Campaign parameters are copied into the form only when the visitor submits it.

Waitlist details are used for the requested one-time release email. Support details are used to review and respond to the request. Form details are sent through FormSubmit and the email services needed to deliver them. Visitors can instead email support directly at storm@noseysuze.com.

The website loads fonts from Google Fonts. When the browser requests those font files, Google may receive standard request information such as the visitor's IP address and browser details.

Legal bases and privacy rights

If privacy laws such as the GDPR or CCPA/CPRA apply, Believe intends to rely on:

  • necessity to provide the app's core functionality for local storage used to run the app
  • explicit consent for optional Meta Pixel measurement on the Believe landing page, and consent where required or legitimate interests for operating, securing, measuring, and improving a privacy-protective app
  • the visitor's request or consent when they submit a support or waitlist form

Users can review a concise privacy summary inside the app and open this full policy online, leave Anonymous Usage Analytics off or turn it off later under Settings > Privacy & Legal, deny ATT without losing functionality, remove the app from their device, visit the public support page, or contact support at storm@noseysuze.com. Delete All Believe Data clears local practice data, all existing TelemetryDeck product-event records and product-destination delivery keys, terminates the SDK, removes its known on-device cache, and rotates the local TelemetryDeck identity. The separate anonymous-analytics choice is preserved. If analytics remains opted in, Believe then creates one new content-free reset_performed event under the rotated identity to count use of the deletion control; turning analytics off before reset prevents that event. Believe preserves only the minimum AppsFlyer pending, unconfirmed, attempted, or completed delivery state needed to finish or avoid repeating an install, onboarding, first daily check-in, or milestone event after reset; this state contains no private entry.

Opt-out and local reset cannot prove cancellation of a TelemetryDeck signal already handed to the SDK or already in flight, and cannot recall a signal already transmitted. Because Believe has no user account and TelemetryDeck data is anonymised, Nosey Suze Pty Ltd may not be able to locate an already-transmitted anonymous event as belonging to a particular person. Previously transmitted anonymous or aggregate events may remain for the provider's documented retention period. Where an AppsFlyer record can be identified, Nosey Suze Pty Ltd will use AppsFlyer's data-subject request tools and notify activated advertising partners as required.

Sharing

Private practice content is not shared with advertising networks or data brokers. Limited measurement data may be processed by AppsFlyer, Meta through the active AppsFlyer partner integration, TelemetryDeck after explicit opt-in, and Apple. Separately, after explicit website consent, Meta processes the limited Believe landing-page events and technical data described above. A protected recovery copy leaves the device only when the user chooses a destination in the iOS Share Sheet. Cloudflare processes standard website-hosting and security requests. Website form submissions are shared with FormSubmit and the email services needed to deliver them. Website font requests are sent to Google Fonts. Information may also be disclosed when required by law.

Data retention

  • Protected private stores, audio files, recovery copies, and the widget snapshot remain in backup-excluded local containers until the user clears them or removes the app. If the widget app-group container cannot be marked excluded from backup, Believe fails closed and does not write the private widget snapshot. Standard iOS preferences containing settings, derived progress and achievement totals, and the device-local statement fingerprint may remain in a device or iCloud backup according to the user's Apple backup settings and may be restored by Apple when the app or device is restored.
  • Believe's router-pending and unconfirmed TelemetryDeck product-event records remain local only for bounded offline delivery or duplicate suppression. Pending envelopes and full unconfirmed receipts expire after 30 days; each local collection is capped at 1,000 records. Compact content-free one-time keys remain until Delete All Believe Data. Analytics opt-out clears pending and unconfirmed product envelopes, terminates the SDK, and removes its known cache, but cannot confirm cancellation of a signal the SDK already accepted, queued, or began transmitting. All-data reset clears all old product-destination state and rotates the anonymous identity; if analytics remains opted in, one new content-free reset_performed event can then be created under that rotated identity. Minimal pending or unconfirmed AppsFlyer records and attempted/completed keys remain across local reset solely to finish or prevent duplicate allowlisted attribution-event handoffs.
  • AppsFlyer's published policy limits end-user data to 24 months unless otherwise directed, required, or allowed by law; aggregated reporting may remain for up to 25 months, and partner restrictions may be shorter.
  • Believe uses TelemetryDeck's Free plan, which provides three months of actively queryable analytics. TelemetryDeck says older signals are moved to cold storage rather than automatically deleted and may become queryable again after a retention upgrade. Nosey Suze Pty Ltd can use the authenticated TelemetryDeck App Settings control to delete the Believe app record and all its insights; provider support and a terminal receipt are used when that deletion is exercised.
  • Apple controls retention and privacy thresholds for App Store analytics, crash, and MetricKit services.
  • Cloudflare controls retention of standard website-hosting and security request logs under its terms.
  • Meta controls retention of consented Pixel events and identifiers under its Business Tools terms, privacy policy, account settings, and applicable law. Selecting Only necessary prevents new Believe event calls but cannot recall data already received by Meta.
  • Website submissions are kept only as long as reasonably needed to provide the requested release notice or support and meet legal obligations.

Children

Believe is not directed to children under 13.

Health disclaimer

Believe is a self-directed wellbeing app and is not medical care, mental health treatment, crisis support, or therapy.

Contact

Support: Believe Support

Email: storm@noseysuze.com