Before the legal version, here's the short version. Everything below this section is more detail on the same five points.
The rest of this policy fills in the detail.
This Privacy Policy is published by Innermap LLC, a Florida limited liability company ("Inner Map," "we," "us," or "our"). We operate the Inner Map mobile application available on the Apple App Store and Google Play, and any related services.
You can reach us at:
This policy applies to the Inner Map mobile application and any services we provide directly through it. It explains what data (including your "Personal Data" or "Personal Information," which means any information that can be used on its own or combined with other information to identify you) we collect, how we use it, who we share it with, how long we keep it, and what rights you have.
This policy does not cover third-party services we link to (for example, crisis hotline websites). When you visit those, their own policies apply. Inner Map has no control over and assumes no responsibility for the content, privacy policies, or practices of any third-party sites or services.
By using Inner Map, you acknowledge that you have read and agree to the practices described in this Privacy Policy. If you do not agree, you must immediately cease using the app.
Inner Map is intended only for users 18 years of age or older. Our Service is not directed to individuals under the age of 18, and we do not knowingly collect data from anyone under 18. During signup, you confirm that you are 18 or older. Different countries have different age thresholds for digital consent. Regardless of local law, Inner Map's product policy is strictly 18+ only.
If you are a parent or guardian and believe a minor has provided us with personal information, please contact privacy@my-inner-map.com and we will promptly deactivate the account and take reasonable measures to delete the associated data from our records.
For California residents under age 18: If you are a registered user of the Service under the age of 18, California law permits you to request and obtain removal of content or information you have publicly posted. To make such a request, please send an email with a detailed description of the specific content or information to privacy@my-inner-map.com. Please be aware that such a request does not ensure complete or comprehensive removal of the content or information you have posted and that there may be circumstances in which the law does not require or allow removal even if requested.
We've designed Inner Map to collect the minimum information needed to make the app work. Specifically:
We may receive information from third parties only in these specific cases:
To make our minimization commitments explicit:
If we ever begin collecting any of the above, we will update this policy and notify you in-app before the change takes effect.
We use the information described above for these specific purposes, and no others:
| What we use | Why | Legal basis (for EU/UK users) |
|---|---|---|
| Account identifier | To recognize you across sessions and tie your map to your account | Contract performance |
| Sign-in identity & email (optional) | To sign you in, link your account across devices, and help you recover it | Contract performance |
| Display name | To address you in the app | Contract performance |
| What you tell us when you set up | To give the AI context so it isn't starting from nothing | Contract performance; explicit consent (health) |
| Conversation content | To generate AI replies and maintain session context | Contract performance; explicit consent (health) |
| Inner-experience map data | To persist your work across sessions | Contract performance; explicit consent (health) |
| Private journal entries | Stored on your device to enable journaling | Contract performance (no server processing) |
| Shared journal entries | Stored on our servers, provided to the AI as context, and analyzed for optional map suggestions you approve — when your journal is set to share | Contract performance; explicit consent (health) |
| Safety-check records | To show you support resources, and to avoid repeating the same prompt | Explicit consent; our legitimate interest in your safety |
| Usage counters | To enforce rate limits, prevent abuse, and meter your monthly allowance | Legitimate interest in service stability; contract performance |
| Product usage events | To understand which features are used and improve the app (via PostHog; never includes your content) | Legitimate interest in service improvement |
| Device type / OS / version | For crash diagnostics and compatibility | Legitimate interest in service quality |
| Device push token (opt-in) | To deliver the notifications you turn on — the notification itself never contains your content | Consent |
| IP address | For rate limiting and abuse prevention before sign-in, and for network routing — not stored by us | Legitimate interest in security |
| Any of the above (as necessary) | To enforce our Terms of Service, prevent fraud or abuse, and protect the security of the Service and our users. | Legitimate interest in security and enforcing our terms |
| Any of the above (as necessary) | To comply with legal obligations, respond to lawful requests (like subpoenas), and protect our legal rights. | Legal obligation / Legitimate interest |
| Any of the above (de-identified) | To create aggregated, anonymized data that cannot reasonably identify you, which we may use for research, analytics, and business improvements. | Legitimate interest in service improvement |
We do not use your information for:
Legal, Safety, and Security uses. In addition to operating the app, we may process your data to the extent reasonably necessary to comply with applicable laws, cooperate with law enforcement or judicial orders, enforce our agreements, or protect the rights, property, or safety of Inner Map, our users, or others.
Product analytics. We use PostHog to understand how the app is used — which features people open, and when sessions happen — so we can improve it. These events are recorded by our own server, not by any analytics code inside the app, and they are usage events only: we never send PostHog the content of your conversations, journal entries, messages, or the parts and beliefs on your map. PostHog is not used for advertising, and it does not track you across other apps or websites.
Crash reporting. We use Sentry to capture crash and error reports so we can find and fix problems. The app sends these on every launch; there is no setting that turns it off. They contain technical diagnostics only — the error type, a stack trace, and your device model and OS version. They are configured to exclude your content: no conversations, journal entries, messages, or map data, and no network request contents. Sentry is not used for advertising.
Inner Map relies on third-party providers to power its AI and voice features. While these providers may change over time as we improve the Service, they currently include, but are not limited to:
Your text-based conversations are sent to Anthropic's API to generate AI replies. What is sent is not only the message you just typed: it includes the recent conversation, the relevant parts of your inner-experience map, any journal entries you have shared, and the past material the app has retrieved as context. Per Anthropic's API terms:
We use OpenAI for three things: transcribing your voice notes into text, generating spoken audio (such as the "hear this spoken" feature), and creating the embeddings that power the app's memory. Embeddings are numeric representations of text that let the app find and recall relevant past context; to build them, the text of your chat messages, the AI's replies, session summaries, and any journal entries you have shared is sent to OpenAI's embeddings API. (Journal entries you keep private are never sent — see below.) Per OpenAI's API terms for paid tiers:
The live voice feature (Map Voice) turns your speech into text and speaks a reply back. To do this, the audio of what you say is sent to a speech-to-text provider (Cartesia), and the text of the reply is sent to a text-to-speech provider (ElevenLabs) to generate the audio you hear. ElevenLabs also voices the “Hear what Self would say” message in a part’s folder; if it is unavailable, that audio is generated by OpenAI instead. Chat replies you have read aloud are voiced by OpenAI. Voice notes recorded outside the live voice feature are transcribed by OpenAI, not Cartesia.
These providers process that audio or text to perform the conversion; the reply itself is written by Anthropic as described above. We do not use these providers for advertising.
While your journal is set to share, each entry's text is included in the context sent to Anthropic (for chat) so the AI can draw on it — handled exactly like your conversation content above: not used to train any model, and not retained by Anthropic beyond its standard operational window. A shared entry is also analyzed by AI to see whether it suggests anything worth adding to your inner map; any such suggestion is sent to your in-app inbox for you to accept, edit, or decline, and nothing is added to your map automatically. (Shared entries are also embedded for memory, as described under OpenAI above.) Journal entries kept private are never transmitted to Anthropic, OpenAI, or any other third party — they are not analyzed, embedded, or sent anywhere.
Beyond the AI providers above, a small number of services help us run Inner Map. These currently include, but are not limited to:
Each of these providers processes data only to supply its service to us, under agreements that prohibit any other use.
We do not sell your personal data. We only share your data with the following categories of third parties:
Your conversations are not kept on your device. They are stored on our servers and loaded when you open the app, so there is no offline copy of your chat history on the phone.
The encryption key for your journal is generated on your device at first launch and stored in your phone's secure keystore. The key never leaves your device. We do not have access to it. We cannot decrypt your private journal entries even if compelled to do so. Because this data and the encryption key reside locally on your device, you are solely responsible for preventing unauthorized access to your device (e.g., by using a strong passcode or biometric lock).
All server-side data is stored on Railway's managed PostgreSQL. Railway encrypts it at rest, and all communication between your device and our servers uses TLS (HTTPS/WSS) encryption in transit.
We've designed Inner Map with security-by-design and privacy-by-design principles. Specific measures include:
User Responsibility: You are responsible for protecting your account credentials and limiting access to your devices. Inner Map will never send you an email requesting your account identifiers. A sign-in link we email you is a credential — treat it like a password and do not forward it. If you receive a suspicious email claiming to be from us, please notify support@my-inner-map.com.
We periodically review our security practices internally. As Inner Map grows, we plan to engage external auditors for formal annual reviews.
No system is perfectly secure. We can't promise we'll never have an incident, but we can promise we'll handle one transparently and quickly.
WHILE WE USE REASONABLE PHYSICAL, TECHNICAL, AND ADMINISTRATIVE CONTROLS, WE CANNOT GUARANTEE THE SECURITY OR INTEGRITY OF DATA TRANSMITTED OVER THE INTERNET. YOU ASSUME THE RISK THAT UNAUTHORIZED ENTRY, HARDWARE OR SOFTWARE FAILURE, AND OTHER FACTORS MAY COMPROMISE THE SECURITY OF YOUR DATA.
We keep your data only as long as we have a reason to.
When you delete your account, your data is removed from our active systems immediately and from backups within 30 days.
De-identified Data: We reserve the right to retain and use de-identified and aggregated data indefinitely after your account is deleted. This data will no longer contain any personally identifiable information and is used strictly for analytics, research, and improving the Service.
You have the following rights regarding your data:
You can request a copy of the data we hold about you on our servers. The app has a built-in export function: Settings → Privacy, Data & Safety → Export My Data. The export is delivered as a JSON file via your phone's share sheet (so you can save it to Files, send it to yourself via email, etc.). The file is written to your phone so it can be shared, and the app removes it once you have.
The export contains your content and activity: your account and settings, your conversations, your inner-experience map, the history of the belief you've been building, any readings the app has written for you, journal entries shared with the AI, your activity timeline, session summaries, a record of the times the app's safety check paused the conversation, offered you a referral, offered a quieter line, or checked back in with you, and usage counters. Some records are not in the file: sign-in identity records, notification tokens, in-app inbox cards, feedback you've submitted, subscription and credit records, internal diagnostic logs, records of sign-in collisions, and the working copy of your conversations and shared journal entries that the app keeps alongside the numeric representations it uses to find relevant past material. If you'd like a copy of those too, email privacy@my-inner-map.com and we'll provide them. Everything — in the export file or not — is permanently removed when you delete your account.
You can delete your entire account from within the app. Tap Settings, then Delete account under ACCOUNT — or open Privacy, Data & Safety and use Delete My Account there. Either route opens the same confirmation screen.
This removes your data from our active systems immediately. It cascades to all related records — sessions, parts, journal entries (including any you shared with the AI) and the material the app kept to recall them, sign-in identity, notification tokens, your in-app inbox, and feedback — and triggers your device to clear its local storage, including the encrypted journal, your sign-in tokens and your account identifier.
Deletion is permanent. We cannot restore an account once deleted.
If something we've stored is wrong (an email address typo, for example), you can correct it via Settings, or by contacting privacy@my-inner-map.com.
If you've consented to specific uses of your data (for example, notifications you've turned on), you can withdraw that consent at any time by turning the feature off or removing the relevant data in Settings. Turning notifications off deletes your push token from our servers.
The export function described above gives you a machine-readable copy of your data so you can move it elsewhere if you choose.
If you object to any specific processing we do, or wish to restrict processing, please contact privacy@my-inner-map.com.
The fastest way is in-app: Settings → Privacy, Data & Safety has export and deletion buttons that handle most requests instantly. Account deletion is also directly in Settings, under ACCOUNT.
For anything not handled in-app, email privacy@my-inner-map.com. We aim to respond as quickly as we can, and in any case within the time the law allows.
Identity Verification & Authorized Agents: To protect your privacy, we may take reasonable steps to verify your identity before fulfilling certain requests (such as asking you to log into your account or confirm your email address). You may also designate an authorized agent to submit requests on your behalf, provided you give the agent written permission and we can verify your identity.
If you don't think we've handled your request appropriately, you have the right to lodge a complaint with your local data protection authority.
Inner Map is a reflection tool, not therapy. The AI is not a licensed mental health professional. It cannot diagnose, treat, or replace clinical care.
If you are in crisis or considering harm to yourself or others, please reach out to:
To help ensure the app is used only as intended, the Service is configured to recognize certain language that may indicate a user's needs have exceeded the scope of a self-reflection tool. This feature is not intended to act as a mental health triage or diagnostic tool to identify when a mental health crisis is occurring. The AI will not detect every critical situation, and you should never rely on it to do so. No one is alerted on your behalf. Please reach out to a human if you need help.
Inner Map is not HIPAA-covered. We are not a healthcare provider, we do not bill insurance, and we do not have a clinical relationship with you. While we treat your data with care comparable to clinical privacy standards, we are not a "covered entity" under HIPAA.
Inner Map is available worldwide. Our servers are located in the United States.
If you access Inner Map from outside the United States, your data will be transferred to and processed in the United States. We treat all users' data according to the same privacy standards described in this policy, regardless of where you live.
For users in the European Economic Area, the United Kingdom, Switzerland, or other regions with strict data protection laws, we apply GDPR-equivalent protections globally. See the EU/UK-specific section below for details on your rights under GDPR.
If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):
To exercise these rights, use the in-app tools or contact privacy@my-inner-map.com.
If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have rights under the EU General Data Protection Regulation (GDPR), UK GDPR, and Swiss Federal Act on Data Protection:
Special categories of data. Conversations in Inner Map are likely to concern your mental and emotional health, which is special-category data under Article 9 of the GDPR. We process it on the basis of your explicit consent, given when you accept these terms and begin using the Service. You may withdraw that consent at any time by deleting your account.
Legal bases for processing: We process your data based on (1) the performance of our contract with you (delivering the app's core functionality), (2) your explicit consent (for special-category data, and for optional features such as notifications), and (3) our legitimate interest in maintaining service stability and security (for usage counters, rate limiting, and crash diagnostics).
Data Protection Officer: Inner Map has designated a contact for privacy matters at privacy@my-inner-map.com. You can also write to Innermap LLC, 7100 Camino Real, Ste 302, Office 42, Boca Raton, FL 33433, United States.
Right to lodge a complaint: If you believe we have not handled your data appropriately, you have the right to lodge a complaint with your local data protection authority.
International transfers: Your data is transferred to and processed in the United States. We rely on Standard Contractual Clauses (SCCs) and equivalent safeguards to ensure your data receives equivalent protection.
We will respect your privacy rights to the fullest extent possible. There are a few cases where we may not be able to fully honor a request:
If we cannot fulfill a request, we will tell you why and offer an alternative where possible.
We may update this Privacy Policy from time to time. When we do:
We encourage you to review this policy periodically.
For privacy questions, data subject requests, or concerns about how we handle your information: privacy@my-inner-map.com
For general support: support@my-inner-map.com
For legal and compliance matters: legal@my-inner-map.com
For everything else:
By mail:
Innermap LLC
7100 Camino Real, Ste 302, Office 42
Boca Raton, FL 33433 United States
This privacy policy was written in plain language because privacy matters and policies should be readable. If anything here is unclear, please ask — privacy@my-inner-map.com.