Privacy notice

12 October 2026

Introduction

This notice describes how personal data is handled when you use the Innerealm website at innerealm.com, the practice offered on that website, and, when it is offered, the same service on app.innerealm.com. It is written for the public pages, the account, Checkout, and the practice.

Innerealm is a guided contemplative practice. It is not medical care, psychotherapy, or a diagnosis. Please read this notice with the Terms of use.

Who we are

The service is offered publicly as Innerealm, the operator of innerealm.com. A separate legal-entity name has not yet been published here. Until it is, “Innerealm”, “we”, and “us” mean that operator. The contact for privacy requests is hello@innerealm.com.

This notice is intended to meet the standard of a notice under the Personal Data (Privacy) Ordinance (Cap. 486) of the Hong Kong Special Administrative Region, together with information residents of other places may need. It does not appoint a separate representative in every country.

Google sign-in

If you choose to continue with Google, Innerealm uses Google solely to authenticate you. We do not use Google user data to advertise, to sell information, or to build a profile of your interests.

From that sign-in we receive:

• your email address; and
• your Google account identifier, which is the subject identifier for that Google account.

Ordinary Google account sign-in may also supply a display name and a profile-image address. The practice does not display a profile image and does not depend on one. We do not ask Google for Gmail, Google Drive, Google Contacts, Google Photos, Calendar, location, or any other Google product. We do not read your mail, files, contacts, or photos.

The only purpose of the email address and the Google account identifier is to create your Innerealm account and to recognise the same account when you return. We do not use them for any other purpose.

What we store from Google

Supabase, our authentication provider, stores the email address and the Google account identifier with your account. A session cookie in your browser keeps that sign-in in place for a later visit. We do not copy your Google contacts, messages, files, or photos into Innerealm. Words you type during a sitting stay in this browser. This version of the service does not upload those words.

What we do not do

• We do not sell personal information.
• We do not share it for advertising, and we do not use it for ads profiling or cross-context behavioural advertising.
• We do not provide medical care, a diagnosis, or treatment, and we do not use account data for a clinical purpose.
• We do not create or distribute non-consensual intimate imagery. We do not use Google APIs, including Google sign-in, to generate, store, or distribute such imagery.

Categories of information

Depending on how you use the service, we handle:

• Account data from Google sign-in, as set out above: the email address and the Google account identifier, stored so that we can authenticate you. If you ask for a sign-in link instead, we receive only the email address you type.
• Session data. A sign-in cookie that lets us recognise the same browser on a later visit.
• Trial data. For a new account, a record that one 15-minute practice was granted, and the time it is used, if it is used.
• Entitlement data. A copy of the subscription we need in order to open the practice: the plan name (Essential or Deep), the status (including active, trialing, past due, or canceled), the billing interval, the period end, and the Stripe customer and subscription identifiers. We do not store your full card number.
• Messages you send to hello@innerealm.com.

Words you type during a sitting stay in this browser, on this device. This version of the service does not upload those words to an Innerealm database. Clearing this site’s data in the browser removes them from the device. We do not use the sitting to build an advertising profile.

Purposes

We use the information above to:

• create and recognise your account, including Google sign-in and email sign-in links;
• grant and record the one-time 15-minute practice;
• open Essential or Deep according to the entitlement on the account;
• take payment, apply a promotion code such as INNEREALM1 when you enter one at Checkout, and show the plan on Account;
• send the sign-in message you requested, from hello@innerealm.com;
• answer a message you send us, and keep records we are required to keep;
• protect the service against misuse.

We do not sell personal information. We do not use it to advertise third-party products to you.

Processors

The following providers process personal data for us, for the purposes above. Each also has its own privacy terms for the data it holds as a controller of its own service.

• Stripe. Stripe Checkout takes the payment. The Stripe Customer Portal is where card changes, invoices, and cancellation are done. Stripe processes the card and the billing relationship. Innerealm does not operate its own card form.
• Supabase. Supabase provides authentication and stores the account, the trial row, and the entitlement copy.
• Vercel. Vercel hosts the website and serves it through its content delivery network.
• Email. Sign-in links are sent from hello@innerealm.com by the mail service configured for that address.
• Google. If you choose Google, Google authenticates you and supplies only the account identifier and email described under Google sign-in. Supabase stores those details for the account. Google user data is not used for any other purpose.

Transfers

Innerealm is operated in connection with Hong Kong. Stripe, Supabase, Vercel, Google, and the mail service may process data in the United States and in other places where they operate. When data leaves Hong Kong, it is handled under those providers’ terms and the contracts we have with them. We do not sell the data as part of that transfer.

Retention

We keep the Google email address and Google account identifier with the account for as long as the account exists. We keep the account, the trial row, and the entitlement copy for the same period, and for longer where a billing, tax, or legal record must be kept. A request to delete the account removes the sign-in and the practice record we hold, except for the billing record Stripe and we must retain. Sitting text that never left your browser is not ours to delete from a server. You remove it by clearing the site data in the browser. Mail you send us is kept long enough to answer and to keep a record of the request.

Cookies

We use a sign-in cookie so the session continues. On hosts that are innerealm.com or a subdomain of it, that cookie may be set for .innerealm.com so the same sign-in is recognised on the marketing site and on the practice host. On a preview host, including vercel.app, the cookie is limited to that host. We do not use an advertising cookie and we do not sell cookie data.

Your rights

Under the Personal Data (Privacy) Ordinance you may ask whether we hold your personal data, ask for a copy, and ask for correction. You may also ask us to delete the account record, to stop using an address, or to explain a purpose in this notice. Write to hello@innerealm.com. We may need to confirm that the request comes from you. We will respond within a reasonable time. Access to a billing record may also be available in the Stripe Customer Portal, opened from Manage billing.

California residents

If you are a California resident, you may ask us to disclose the categories of personal information we collected, the categories of sources, the purposes, and the categories of recipients. You may ask us to delete personal information we hold as a business, subject to the exceptions the law allows, including records we must keep for transactions and security. We do not sell personal information, and we do not share it for cross-context behavioural advertising. We will not discriminate against you for making a request. Use the same address, hello@innerealm.com.

Children

The service is for people aged 18 or over. We do not knowingly collect personal data from anyone younger. If you believe we have, write to hello@innerealm.com and we will delete the account.

Changes

We may update this notice. The date at the top is the date of this version. The page at innerealm.com/privacy is the current notice. If a change is material, we will adjust that date. Where the law requires a further step before a new use, we will not rely on silence alone.

Contact

Privacy requests and questions go to hello@innerealm.com. That is the only public contact address. Please do not send clinical or emergency information. If you need urgent help, contact local emergency services.