Privacy policy

Last updated: 9 October 2026

1. Who we are

This app, Imbue, is provided by Imbue ("we", "us"). This policy explains how we handle personal information, and we handle it in line with the New Zealand Privacy Act 2020 and its Information Privacy Principles.

Imbue supports people living with persistent pain through a calm, nervous-system approach to recovery. It is for general well-being and education. It is not a medical device, and it does not provide medical diagnosis or treatment.

2. Our approach to your privacy

Your private notes, highlights, reading progress, and settings are stored on your device. You can get started without an account. We ask you to sign in before a purchase, to link custom audio to you, or when you post to the wall or use referrals. Section 5a explains what signing in shares and why.

3. Information stored on your device

The following is saved on your phone. Online features and optional backups use the information described in the sections below:

• A first name or nickname, only if you choose to enter one.
• Your chosen recovery pathway and the answers you give during the short intake, which tailor the content you see.
• Anything you write or save in Imbue: notes, favorites, highlights, reading progress, and your reminder and appearance settings.
• What Genevieve remembers about you, which is a small set of notes she keeps to make her replies more helpful.

Some of this may include health information, which is sensitive. It stays on your device unless you choose to share it with Genevieve (see below), post to the Wall of Support (see section 5), or turn on the optional cloud backup to your own Google account (see section 8). You can view, change, or delete this information at any time within Imbue, and clearing the app data or uninstalling removes it from your device.

4. Information processed when you use Genevieve

When you message Genevieve, your message, recent conversation, enabled memory notes, reply preferences, and first name if entered are sent securely to our server and an AI provider to generate a reply. Your optional onboarding answers help personalize that support. You can turn off memory and chat history in Genevieve's settings. To keep these details off the online service, do not use Genevieve or custom audio. The first time you use Genevieve or custom audio, Imbue tells you what is sent and asks you to agree before anything leaves your phone.

Because of this, please do not share anything with Genevieve that you would not want processed by a third party. We ask our AI provider not to use your content to train their models. The provider may hold the content briefly for security and abuse-prevention purposes before deleting it. Genevieve is an AI assistant and can give incorrect answers; she is not a substitute for professional medical advice.

When you create custom audio, we keep the script and recording on our server under an account or purchase identifier so you can restore them on another phone. Scripts are processed by AI and voice providers to make the recording. A pending script is also kept temporarily so you can return to it. Deleting a recording in Imbue removes its server copy as well.

5. The Wall of Support

The Wall of Support is an optional community space where people on the same pathway send each other short, pre-written messages of encouragement. What you choose to post is stored on our server so that others can see it. You never type a message: you choose from set options, and the only free text is a first name, which is checked automatically before it can appear.

When you post or reply, we store your chosen message options, first name, optional country or US state, and an account-linked identifier. We do not collect your exact location. Your email is never displayed on the wall. Posting requires eligible access and a verified sign-in.

The wall is public, and we cannot promise that only people using Imbue will see a post. Messages use ready-made options. Your first name is shown, while your country and, in the United States, your state are optional. Posts do not include symptom details. Choose a name and location you are comfortable sharing publicly.

You can report anything that seems wrong, and you can hide another person so you never see them on the wall again. Reporting someone does not take their post down: the only thing we ever remove is a first name.

Wall posts and replies are kept for up to six months, then deleted automatically. To remove a post sooner, open it from Your wall and choose Remove this post; to remove a reply, press and hold it and choose Remove this reply. Deleting your account (Settings, then Erase or delete my data) removes all your posts and replies straight away. Erasing Imbue data on your phone does not remove them: they stay with your account.

5a. Your sign-in and email address

We ask you to sign in before paying, when linking custom audio to your account, or when posting to the Wall of Support or using referrals. Google sign-in, or Apple sign-in on supported devices, provides a verified email address. Your account links your purchases, minutes, recordings, wall identity, and referral code so they can be accessed on another phone. When you sign in on a phone, we store that phone's name (as you named it, or its make and model) and when it was last used, so you can see your phones under Your devices and sign one out. An account can be signed in on three phones at once.

Your email identifies your account. It is not used for marketing or shown on the wall. We use it to send the reminder emails before your subscription renews (on unless you turn them off), one email confirming those reminders, and, if you delete your account, to tell you the date it will be deleted and to confirm when it has been. You can sign out from Settings, under About you. To delete the account, open Erase or delete my data and choose Delete my account. That erases Imbue’s data on your phone straight away and removes your Wall of Support posts. Seven days later we delete your account and everything we hold with it: your email address, your custom audio recordings and the scripts they were made from, and your audio minutes and their history. Signing in again before then cancels the deletion. Minutes you have not used are lost, including any still to come from a lifetime purchase, and deleting your account does not cancel a Google Play subscription. We keep only a note that a deleted account existed and which store purchases it used, under a random number that does not identify you, so the same purchase cannot be credited twice. So the reminder emails arrive at a sensible hour, we keep your next renewal date, the price and currency, and your time zone, which is worked out from your internet connection.

If you share your referral code, we record the code and which accounts used it, so the bonus minutes can be paid to both of you when your friend first pays. Your friend sees only the code, never your name or address, and you are told only how many people used it, never who.

5b. Shared Picture Puzzles

Shared Picture Puzzles sends your pathway, the picture and word IDs, and your completed answers so the server can check them. For each day's shared picture we store the set of revealed words and, under an opaque code made from your install or account, a count of how many words you helped with. No name or country is stored with a shared picture, and nobody is named or counted on one. We never store your letters or your solving history. The pictures are public domain paintings and freely licensed photographs served from our server, which sees only which picture files your phone asks for. Your unfinished puzzles stay on your device unless you choose a backup. Network requests use Cloudflare and Play Integrity; the existing network abuse controls also apply.

5c. The Mini Golf leaderboard

The Mini Golf competition keeps a leaderboard of the ten best rounds. If your round makes the top ten, we store and show your first name, your country if you choose one, and your putts and times for each hole, under an opaque code made from your install or account. A round that drops out of the top ten is deleted, and deleting your account removes yours.

6. What we do not collect

To be clear, Imbue does not:

• Use analytics, advertising identifiers, or tracking tools.
• Detect your location (the only exception is the time zone used for reminder emails, described in section 5a), or access your contacts, photos, or microphone. The Wall of Support shows a country or US state only if you choose one.
• Track your symptoms, or build any profile of you for marketing.
• Sell or rent your personal information to anyone.

6a. Crash reports

If Imbue hits an error it cannot handle, it writes a technical report to your phone and sends nothing. The next time you open Imbue we ask whether you would like to send it, and you can read the whole report before deciding. Nothing is sent unless you tap Send, and declining deletes it.

A report contains the error, its technical trace, your app version, your phone's model and Android version, and a short trail of which screens were open and what Imbue was doing just before, as screen and action names only. It contains nothing you have written or read: no name, no notes, no messages to Genevieve, no reading history. File paths and anything shaped like an email address are removed before the report is saved. Reports are emailed to us, kept only while we work out what went wrong, and used for nothing else. You can switch the offer off entirely in Settings, under Your data & privacy.

6b. Diagnostic log

To help us fix problems - especially with payments, subscriptions, backups or your recordings - Imbue keeps a small diagnostic log on your phone. It records technical events only: things like “a restore found no subscription” or “a reminder could not be scheduled”, each with the time it happened and your app version and Android version. It contains no name, no notes, no messages to Genevieve, and nothing else you have written or read; file paths and anything shaped like an email address are removed. It holds the last ten days, and older entries are dropped automatically.

The log is not sent on its own. Contact us includes it automatically when you choose Bug / app issue, Payment or subscription, or Custom audio or Genevieve. The form explains this before you send. Erasing your app data also erases the local log.

6c. Telling us when something is broken

This is not analytics. Imbue does not measure what you tap, read, listen to, or how long you spend anywhere, and it never will. There is no tracking of any kind in this app.

What this is: Imbue has a handful of safeguards that catch a serious fault on our side and quietly work around it, so that you are not left stuck. The clearest example is a payment one - if the payment service cannot see a subscription you have genuinely paid for, Imbue checks with Google Play directly and lets you in anyway, rather than telling you that you have not paid.

The catch is that those safeguards work so well that you would have no reason to tell us anything was ever wrong - so the fault could carry on affecting other people, unseen, for weeks. When one of them steps in, Imbue therefore sends us a single word naming the fault, from a short fixed list, and nothing else at all.

It carries no name, no account, no device or user identifier, no app version, and nothing you have written, read, bought or done. On our side it becomes a daily count of how many times that particular fault happened: there is no record of individual messages, so there is nothing that could be traced back to you or joined to anything else. It is sent only when something is genuinely broken, never when you simply use Imbue, and at most once a day.

7. How we use information

We use the information only to provide Imbue and the features you ask for: to show you your own content, to generate Genevieve's responses when you message her, and to deliver the reminders you set up. Reminders are scheduled on your device.

8. Storage, security, and backups

Information on your device is protected by your phone's own security. Information sent to Genevieve travels over an encrypted (HTTPS) connection. If you create a manual backup, it is a single file that you save and control, and we never receive it. Keep it somewhere private: it holds everything in your app, including your conversations with Genevieve.

Imbue also offers an optional cloud backup, which is off unless you turn it on (in Settings, under Backup). It uses Android's own backup service: your app data - including notes, favorites, progress, settings, and what Genevieve remembers - is backed up automatically to the Google account already on your phone, so it can be restored on a new device. This backup goes to your own Google account, not to us; we cannot see it. It is encrypted in transit and at rest, and on Android 9 and later it is additionally protected with your device's screen lock, so that not even Google can read it while your phone has a lock screen set. Custom audio recordings are not included in this backup (they are restored from our server as described above). While cloud backup is off, none of your app data is sent to Android's backup service. You can turn it off at any time, after which the next automatic backup pass replaces the stored backup with an empty one, and Android also expires old backups on its own. Google's handling of your backup is covered by Google's own privacy policy.

9. Other organizations involved

A small number of trusted providers help us run the parts of Imbue that need the internet. They process information only to provide their service to us:

• Cloudflare, which hosts the server that relays your Genevieve messages, stores your custom audio sessions for restore, holds the email address from your sign-in, and sends most of our emails.
• Google (or Apple on an iPhone), which confirms who you are when you sign in with the account on your phone. We receive your verified email address from that sign-in and nothing else about your account; Google learns that you signed in to Imbue.
• Resend, which delivers our emails when Cloudflare's email service cannot: the reminder emails before your subscription renews, the confirmation of those reminders, and the two notices sent if you delete your account. It receives the address and the email itself, and nothing else.
• OpenAI, which writes Genevieve's replies, turns your setup answers into the short notes Genevieve keeps on your phone, writes and checks the scripts for custom audio sessions, and checks that a first name chosen for the Wall of Support or Mini Golf is suitable.
• Anthropic, whose Claude AI writes Genevieve's replies and the scripts for custom audio sessions in OpenAI's place whenever OpenAI is not working. It then receives the same information OpenAI would have.
• ElevenLabs, which turns custom scripts into voice recordings. If ElevenLabs is down and you choose the backup voice, Speechify (or, failing that, Cartesia) makes the recording instead. Voice providers receive only the script needed to make the recording.
• RevenueCat, which manages subscriptions and purchases for us. It receives a random identifier for your copy of Imbue, your purchases from Google Play, and basic technical details about your phone and app version.
• Google Play (and the Apple App Store on an iPhone), which deliver Imbue, take payment, and confirm to our server that a purchase is genuine. Each time Imbue contacts our server, Google's Play Integrity service also confirms the request comes from the real app.
• Google's Android backup service, which stores your optional cloud backup in your own Google account, only if you turn cloud backup on.

These providers operate internationally, so information sent to Genevieve may be processed on servers outside New Zealand. Where that happens we take reasonable steps, as required by the Privacy Act, to ensure your information is handled with comparable protections. This list may change as Imbue grows, and we will update this policy when it does.

10. Links to recommended books

Some lessons include an optional "Further reading" link to a recommended book on Amazon. These are referral (affiliate) links: if you buy something through one, we may earn a small commission, at no extra cost to you. You never have to use them, and they do not affect what Imbue costs you.

Tapping one of these links opens Amazon in your browser or the Amazon app. We do not share any of your information with Amazon. Once you are on their site, Amazon's own privacy policy and terms apply, not ours.

11. Your rights

Under the Privacy Act 2020 you have the right to ask for access to, and correction of, the personal information we hold about you. Because nearly all of your information lives on your own device, you can already see and change it directly in Imbue, including viewing and removing what Genevieve remembers from her chat menu. If you need help with information processed through Genevieve that you cannot access in Imbue, contact us using the details below and we will help.

11a. If you are in the UK or the European Economic Area

Imbue is run from New Zealand, but if you use it from the UK or the EEA the UK GDPR and EU GDPR apply to you as well as the New Zealand Privacy Act. This section says how, in the same plain language as the rest.

Who is responsible. Imbue is the data controller for the small amount of information described above. There is no company structure behind it and no EU or UK establishment, so we have not appointed a representative; you can reach us directly at the address at the foot of this page.

Why we are allowed to process it. Almost nothing reaches us at all. Where it does:

• Genevieve and custom audio - your explicit consent, given when you tap I agree the first time you use either. Because what you tell Genevieve may say something about your health, this is special-category data under Article 9, and we rely on your explicit consent (Article 9(2)(a)). You can withdraw it at any time in Settings, under Your data & privacy, and nothing more is sent until you agree again.
• The Wall of Support - your consent, given each time you post. You choose from set wording; the only free text is a first name, and a country is entirely optional. A post also carries which pathway you are following, which says something about your health, so this is special-category data under Article 9 and we rely on your explicit consent (Article 9(2)(a)). That is why posting asks you each time, why nothing is posted unless you choose to, and why you can delete everything you have posted from Settings.
• The contact form - our legitimate interest in answering you, and yours in being answered.
• Keeping the service standing up - our legitimate interest in preventing abuse. This is why we keep a one-way fingerprint of the network address a wall post came from, rather than the address itself.

Your rights. You can ask us for a copy of anything we hold about you, ask us to correct or delete it, object to or restrict what we do with it, withdraw a consent, and ask for it in a portable form. In practice most of this is already in your hands: your data is on your own phone, Genevieve's memory is viewable and deletable from her settings, and "Delete my account", under "Erase or delete my data" in Settings, deletes your account and what our server holds for it, your wall posts and replies included. Ask us and we will do the rest, free, and normally within a month.

Where your information goes. Our server runs on Cloudflare, and Genevieve's replies and the AI voice are generated by providers in the United States. New Zealand holds an EU adequacy decision; transfers on to those providers are made under the European Commission's Standard Contractual Clauses, which those providers offer as part of their terms.

How long we keep it. Wall posts and replies are deleted automatically after six months. Custom audio recordings are kept until you delete them or your account. Messages to Genevieve are not stored by us at all; our AI provider holds them briefly for abuse prevention and then deletes them. Contact emails are kept only as long as needed to deal with what you wrote about.

No automated decisions. Nothing here makes a decision about you with legal or similarly significant effects, and there is no profiling.

Complaints. If we have not put something right, you can complain to your own supervisory authority - the Information Commissioner's Office in the UK, or your national data protection authority in the EEA - as well as to the New Zealand Privacy Commissioner.

12. Keeping and deleting information

Information stored on your device is kept until you delete it or uninstall Imbue. Imbue gives you ways to clear your reading history and to reset or erase your data. If you keep a chat history with Genevieve, it is stored on your device; from her menu you can choose how long to keep it, turn it off, or clear it at any time (there is no separate export of chat history). Messages processed by Genevieve are held only briefly by our AI provider, as described above, and are then deleted.

13. Children

Imbue is intended for adults managing their own health and well-being. It is not directed at children, and we do not knowingly collect information from children under 16.

14. Changes to this policy

We may update this policy from time to time. The date at the top shows when it last changed. Significant changes will be made clear within Imbue.

15. Contact and complaints

If you use the contact form inside Imbue, your message is sent to us through our server so we can read it and reply. You may include your email address if you would like a response; leaving it blank keeps your message anonymous. We use an email address you provide only to reply to you. So we can help you properly, the message also tells us your subscription status (for example, free trial or paid) and the anonymous billing identifier your purchase is filed under, so we can find it if you ask about it. Nothing else that identifies you is sent.

If you have any questions about this policy or about your information, you can also reach Imbue at the email address below. It is shown as an image to keep it away from spam bots; type it into your email app to contact us.

If you are not satisfied with our response, you have the right to complain to the Office of the Privacy Commissioner in New Zealand, at privacy.org.nz.