WorryTree Privacy Policy (Made Simple)

Last updated: 15 October 2026
Brought to you by the team at Calverra Holdings LLC.

The short version – in plain english

• We use encryption and other security measures to help protect your information.

• We use your information to provide WorryTree, save your entries, manage your account and help when you need support.

• You choose what to write. Your entries may contain sensitive information.

• We use service providers to operate WorryTree. This policy explains the information involved and why it is used.

• If you use AI habit suggestions, your goal, reason, target date and selected value are sent to Google Gemini.

• We do not sell personal information or share it for cross-context behavioural advertising.

• You can ask about your information, exercise your privacy rights or request account deletion at hello@worry-tree.com.

Your Questions, Answered

Who’s behind the app?

WorryTree is run by Calverra Holdings LLC, based in Maryland, United States. We are responsible for deciding how the personal information described in this policy is used. In data protection law, this makes us the “data controller”.

This policy covers the WorryTree app (called Luma from September 2025 to October 2026) and our websites and related services that link to this policy.

WorryTree was previously operated by WorryTree Ltd. Calverra received existing account and service information as part of the transfer of the WorryTree business so that it could continue providing the service.

Email: hello@worry-tree.com

Postal address: Calverra Holdings LLC, 2631 Housley Road, PMB 1301, Annapolis, Maryland 21401, United States.

ICO registration: Calverra Holdings LLC is registered with the UK Information Commissioner’s Office under registration number ZC263573.

Our UK representative

Our representative in the United Kingdom is Prighter Ltd, 20 Mortlake High Street, London SW14 8JN, United Kingdom.

If you’re in the UK, you can also contact us through our representative using our privacy portal (https://app.prighter.com/portal/13019297940), quoting ID-13019297940, or email us at hello@worry-tree.com.

Our EU representative

Our representative in the European Union is Prighter EU Rep GmbH, Schellinggasse 3/10, 1010 Vienna, Austria.

If you’re in the EU or EEA, you can also contact us through our representative using our privacy portal (https://app.prighter.com/portal/13019297940), quoting ID-13019297940, or email us at hello@worry-tree.com.

What personal data do you collect and why?

We use information to make WorryTree work, support you and improve the app. Some comes from you, some is generated when you use our app or websites, and some comes from sign-in and subscription providers. We also received existing account and service information from WorryTree’s previous operator, as explained above.

Here’s a simple overview:

We do not collect precise GPS location or access your phone’s microphone, call logs or movement sensors. Analytics providers may estimate your country or city from your IP address.

How do the AI features use my information?

For AI habit suggestions, WorryTree sends your goal, reason, target date and selected value to Google Gemini.

Saved worry and emotional-weather entries are not sent automatically. Anything you type into the goal or reason fields is included, so avoid information you do not want sent to the AI provider.

Google’s processing can include safety and security checks. Information sent to AI is not necessarily deleted immediately after a response.

AI suggestions support reflection. They are not medical advice, diagnosis or treatment.

Who receives my information?

Providers help us host WorryTree, store information, manage subscriptions, deliver messages, provide support, operate websites and forms, understand usage and provide AI features.

They include:

• Hosting and databases: Heroku and MongoDB Atlas.

• Subscriptions: RevenueCat, with Apple and Google, to manage purchases and subscription access.

• Notifications: OneSignal, to deliver reminders and notifications through Apple’s and Google’s push services.

• Analytics and app links: Google Analytics for Firebase and Branch.

• AI: Google Gemini, for AI habit suggestions.

• Email: MailerLite, for marketing emails if you opt in, and Microsoft 365 and Google Workspace, for support email.

• Websites, quiz and forms: Squarespace, for our websites; Lovable, which hosts our overthinking quiz; Resend, which emails quiz results; and Make, which passes sign-up and quiz opt-ins to our email list.

• Privacy requests: Prighter, our UK and EU representative, which runs our privacy portal.

Our newsletter is published on Substack, which handles subscriber information under its own privacy policy.

Information is shared for the relevant service, subject to applicable data-protection requirements.

Apple and Google also handle information for their own sign-in, app-store and payment services under their own privacy policies.

If you use linked-calendar reminders, a worry title can appear in your calendar. People and services with access to that calendar may see it.

We do not sell personal information, share it for cross-context behavioural advertising or use entries to build advertising profiles.

We may disclose information where necessary and lawful for legal obligations, valid legal requests, professional advice or legal claims. Health information receives additional protections required by law.

If WorryTree is sold, merged or transferred, relevant information may transfer where lawful. We will clearly notify you of an ownership transfer affecting your information. A transfer does not itself permit new uses or remove consent requirements.

What are your legal reasons for using information?

Where UK or EEA data-protection law applies, we rely on:

• Contract: to provide your account and requested features, manage subscriptions and respond to requests needed to deliver the service.

• Legitimate interests: to protect WorryTree, prevent fraud and misuse, investigate technical problems and protect legal rights. These interests must be balanced against your rights and the impact on you.

• Legal obligations: to meet applicable accounting, tax and data-protection duties.

• Consent: where your permission is required for a particular use, including marketing and optional processing that requires consent.

Some information you enter may reveal details about your health. Where the law requires explicit consent for this information, that consent must be separate from accepting our Terms of Service. Using WorryTree or reading this policy does not itself provide that consent.

You can withdraw consent by contacting hello@worry-tree.com. Withdrawal may affect the features we can provide.

We need account information to provide your account. Optional features and marketing are separate choices.

How do analytics and marketing work?

Google Analytics for Firebase helps us understand feature use. This may involve installation identifiers, device and app information, usage events and approximate IP-derived location. Identifiers do not make information anonymous. The current app’s worry and emotional-weather completion events exclude entry text, worry categories and emotional-weather answers.

Where our website offers cookie settings, you can use them to manage optional cookies. Email hello@worry-tree.com for help with analytics choices or to withdraw any consent you have given. Accepting this policy does not itself authorise optional analytics that requires your consent.

We send marketing emails when you opt in. You can unsubscribe using the link in each message or by emailing hello@worry-tree.com. Essential account, security and service messages are separate from marketing.

Quizzes and surveys are optional. We explain how answers will be used when collecting them and obtain separate consent where required. Completing a quiz or survey does not automatically subscribe you to marketing.

Social networks, newsletter platforms and other services you choose to visit have their own privacy policies. Please review those policies before sharing information with them.

How do you protect my information?

We use technical safeguards and working practices designed to protect information against unauthorised access, loss, misuse and disclosure. We are responsible for managing access and the data-protection obligations of providers acting on our behalf.

We investigate security incidents, take steps to limit their effects, and notify affected people and regulators as required by law.

Securing your device and checking access to linked calendars can also help. Our responsibility to protect the service remains.

How long do you keep information?

Different information serves different purposes:

• Accounts and entries: kept while your account remains open so you can use WorryTree and return to your journal. Stopping use, cancelling a subscription or uninstalling the app does not itself delete them. You can request deletion at any time.

• Support correspondence: retained according to the time needed to resolve your request and address any related complaint or legal claim.

• Financial records: retained according to accounting and tax requirements and unresolved payment disputes.

• Consent and request records: retained as needed to demonstrate and respect your choices, including a limited record of marketing opt-outs.

• Technical and analytics records: retention depends on their purpose and sensitivity, outstanding technical or security investigations, and applicable legal requirements.

Deletion from live account records does not necessarily remove every copy at once. Separate copies may exist in backups, technical logs or provider records. Contact us for information about how a deletion request applies to those copies.

When you delete your account, we delete your account and entries from our live systems within 30 days and from backups within 6 months. Our analytics provider keeps user-level analytics data for no more than 14 months.

If we introduce an inactivity-deletion rule, we will explain it before applying it and give affected users advance notice and a way to keep their account.

Where is information processed?

Calverra is based in the United States. Our service providers and support personnel may process information in other countries, including through remote access. International processing is subject to applicable data-protection requirements.

Contact hello@worry-tree.com for information about processing locations and the transfer arrangements relevant to your information, including a copy of applicable safeguards where available under law.

How can I delete my account?

Request deletion from the Profile section of WorryTree or email hello@worry-tree.com. You do not need to reinstall the app to email us. We may ask for enough information to verify that the account belongs to you.

We handle deletion of your account, entries and associated information, and requests to relevant providers, in accordance with applicable law. We explain any limited retention that applies. Separate copies may exist in backups and logs, as described above.

If you want a copy of your information, request it before deletion.

Deleting the app, cancelling a subscription and deleting your account are separate actions. Account deletion does not necessarily cancel an app-store subscription; manage that separately through Apple or Google.

What rights and choices do I have?

Depending on your location and the law, you may have rights to:

• Know whether and how we use your information and obtain access or a copy.

• Correct inaccurate information or request deletion.

• Restrict particular uses or receive certain information in a portable format.

• Object to processing based on legitimate interests because of your circumstances.

• Withdraw consent at any time. This does not affect the lawfulness of earlier processing.

• Obtain information about recipients of your personal information or consumer health data, and appeal a refusal where the law provides that right.

You can object to direct marketing at any time. If you withdraw consent needed for a particular feature, such as processing health information in your journal, we may no longer be able to provide that feature.

We do not use information for solely automated decisions with legal or similarly significant effects. AI suggestions are ideas for you to consider.

To exercise a right or appeal, use our privacy portal (https://app.prighter.com/portal/13019297940) or email hello@worry-tree.com. We may verify your identity or an agent’s authority. Requests are normally free; rights may have legal conditions or exceptions. We do not unlawfully discriminate against you for exercising them.

We normally respond to UK and EEA requests within one month, explaining any permitted extension or pause. Elsewhere, we follow applicable deadlines. If we refuse, we explain why and any appeal route.

If you live in Washington or Nevada, our Washington Consumer Health Data Privacy Policy and Nevada Consumer Health Data Privacy Policy explain how we handle consumer health data and your rights under those states’ laws.

What if I live in the United States?

Depending on your state, you may have the right to confirm whether we process your personal data, access it, correct it, delete it and get a copy in a portable format. You may also have the right to opt out of targeted advertising, the sale of personal data and profiling with legal or similarly significant effects. We don’t do any of those three.

Information you enter in WorryTree about your worries, feelings or mental health is sensitive data. We process it only to provide the features you use, and only with your consent where the law requires it. You can withdraw consent at any time.

To make a request, use our privacy portal or email hello@worry-tree.com. An authorized agent can also make a request for you; we may ask for proof of their authority. We respond within 45 days. If we need longer, we’ll tell you why within that time, and we may take up to 45 more days.

If we decline your request, you can appeal by emailing hello@worry-tree.com with “Appeal” in the subject line. We’ll reply within 45 days. If we deny your appeal, we’ll tell you how to contact your state Attorney General.

Nevada residents can ask us not to sell their covered information by emailing hello@worry-tree.com. We don’t sell it, but we’ll record your request.

What if I live in California?

California law treats information collected by mental health apps as medical information. We handle what you enter in WorryTree that way. We don’t disclose it without your written authorization, except as the law allows, for example to service providers that process it for us under contract, or where the law requires it.

WorryTree doesn’t respond to browser “Do Not Track” signals, because there is no agreed standard for them. We don’t track you across other companies’ websites or apps for advertising.

How can I raise a concern?

You have the right to complain to us. Use our email, postal address or UK or EU representative’s privacy portal.

We acknowledge privacy complaints within 30 days, investigate without undue delay, keep you informed and tell you the outcome.

You may also complain to the UK Information Commissioner’s Office or the relevant regulator where you live, including an EEA data-protection authority. You need not finish our process first.

How will I know about changes?

We update the date when this policy changes and clearly flag significant changes, for example by email or in-app notice, in advance where required.

If a new use requires your consent, we will ask before making that use. Continuing to use WorryTree does not replace consent required by law.

Need help or have a question?

We’re here to help. Email us at hello@worry-tree.com if you have a question about your information or anything in this policy.