Privacy Policy

Effective May 12, 2026 · Last revised: August 15, 2026

1. Who we are

MØMENTÜM is an AI wellness coaching application developed and operated by MØMENTÜM Inc. (incorporation in progress, Canada).

Privacy Officer: Alexandre Silva Pessoa
Co-founder, Psy.D: Stéphanie Laforte
Contact: privacy@momentumapp.live

2. Information we collect

We collect only the information necessary to provide our services:

• Identity: first name, email address (via Clerk)
• Profile: pronouns, goals, coaching mode, chosen coach
• Coaching sessions: conversation content (AES-256-GCM encrypted)
• Private journal: personal entries (encrypted)
• Check-ins: mood score, free notes (encrypted)
• Onboarding questionnaire: responses (encrypted)
• Notifications: device token, preferred time
• Audit logs: system actions (Law 25 compliance)

3. Purpose

Your information is used exclusively to:

• Provide personalized AI wellness coaching
• Detect distress signals and redirect to appropriate resources
• Personalize the experience based on your profile and goals
• Ensure security and legal compliance
• Enable quarterly quality review by Stéphanie Laforte, Psy.D

We never sell your data. We do not use it for advertising.

4. Legal basis

Processing is based on your explicit consent obtained at registration, in accordance with Quebec Law 25 (Act to modernize legislative provisions as regards the protection of personal information) and Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

5. Security measures

• AES-256-GCM encryption for all personal data
• Secure authentication via Clerk (SOC 2 Type II)
• Row Level Security on all database tables
• Mandatory 2FA for administrators
• Full audit logging of sensitive data access
• TLS 1.3 transport encryption (HTTPS only)
• Hosted in Canada (Supabase + Vercel)

6. Data retention

• Coaching sessions, journal, check-ins: 2 years after last activity
• Distress episodes: 5 years (safety-related retention requirement)
• Audit logs: 2 years (Law 25)
• Profile: until account deletion
• Push subscriptions: until opt-out or account deletion

7. Your rights

Under Quebec Law 25, you have the following rights:

• Access: view your data via Settings → My data
• Rectification: update your profile in Settings
• Deletion: complete data erasure within 30 days via Settings → Delete my account
• Portability: JSON export on request
• Opposition: disable notifications, delete journal, close account

To exercise your rights: privacy@momentumapp.live

8. Third parties & sub-processors

We engage the following providers, each subject to strict contractual obligations:

• Anthropic (Claude) — Coaching content generation via API. Customer content is not used to train Anthropic models.
• ElevenLabs — Voice synthesis from the coach's text. Use of content for model training disabled; the user's voice is never sent to ElevenLabs.
• Deepgram — Voice transcription. Audio excluded from any training (mip_opt_out) and not retained beyond processing.
• Clerk — Authentication. SOC 2 Type II certified.
• Supabase — Database. Hosted in Canada.
• Vercel — App hosting. SOC 2 Type II certified.
• Resend — Transactional emails.

9. Cookies, technical identifiers and security

MØMENTÜM uses only strictly necessary cookies for the operation of the service (authentication, language preferences, consent). No advertising or third-party tracking cookies are used.

Identification and location (Law 25, s. 8.1). To secure your account and prevent fraud, some of our providers use technologies that collect technical identifiers capable of identifying or locating you: authentication (Clerk) processes your IP address, browser and device type, and an approximate location (city, country) derived from your IP address; payments (Stripe) use technical fraud-prevention signals. These functions are used solely for security and fraud prevention — never for advertising profiling or automated decision-making — and no biometric fingerprint is created.

Clerk technical cookies. On the sign-in and account-creation pages only, Clerk sets two technical anti-fraud cookies (__cf_bm and _cfuvid, provided by its Cloudflare infrastructure) for the duration of the authentication session. These pages are the only ones on the site that load the authentication module — content pages (homepage, legal pages) do not load it and set no Clerk cookies.

10. Changes to this policy

We may update this policy at any time. Material changes will be communicated by email at least 30 days before taking effect. The current version is always available on this page.

11. Contact & complaints

For any questions about this policy or to exercise your rights: privacy@momentumapp.live

You may also file a complaint with the Commission d'accès à l'information du Québec (CAI) if you believe your rights have not been respected.