Privacy Policy
Last updated: September 29, 2026
The full policy follows.
What we collect
Bonsai works fully without an account. If you choose to create one, we collect your email address, a username, and a password (handled by our sign-in provider, Supabase, which stores it only in hashed form; we never see it). While you're signed in, the following is synced to our database so it's available on your other devices: your meditation sessions (date and time, duration, whether you finished, practice type, the timer settings you used, and any note or mood you add), your saved timers and breathwork patterns, and your app preferences (such as theme, sound volumes, whether reminders are on, your bonsai's name, and your Guided favorites). Without an account, all of this stays on your device.
Apple Health
If you turn on Apple Health Sync, each session of a minute or longer is written to your Health app as a Mindful Minutes entry (its start and end time, plus the name of the timer you used). Bonsai only writes to Health; it never reads your Health data, and nothing from Health is sent to us or anyone else. You can turn this off in the app, or revoke access in the Health app, at any time.
Reminders and Live Activity
Mindfulness Reminders are local notifications scheduled on your device. There is no push server, and we don't collect a device token. The Live Activity and lock-screen controls shown during a session are also handled entirely on your device.
Messages and the mailing list
If you send us a message or join the mailing list, from the app or from breathebonsai.com, we receive what you submit (your email address, plus your name and message if you include them) and which app or site it came from. It's delivered to our inbox by our email provider, Resend, and used only to reply to you or, for the mailing list, to email you about Bonsai. Email meditate@breathebonsai.com any time to be taken off the list or to have your messages deleted.
How we use it
Your email and username are used only to run your account: signing in (with either one), confirmation and password-reset emails, and syncing your data across devices. Your session data powers the app's own stats, calendar, and bonsai growth features. We don't use any of it for advertising or profiling.
No tracking, no ads
Bonsai has no analytics, advertising, crash-reporting, or tracking SDKs of any kind, in the app or on the website. We don't profile you or your usage, and the website sets no analytics or advertising cookies.
Who handles your data
We never sell your data, and we never share it with anyone for advertising or marketing. The only outside services that handle it are the ones that run Bonsai: Supabase (accounts and the sync database), Resend (delivering contact-form and mailing-list messages), and Vercel (hosting breathebonsai.com, including the contact form). The Guided tab links to outside websites and apps; opening one takes you to that site, which has its own privacy policy. Bonsai doesn't send it anything about you.
Where it's stored
On your device (in the app's local storage; in the web version, your browser's storage), and, only for signed-in users, in a Supabase-hosted database used solely to back up and sync your account data. Each account can read and change only its own data.
Your choices
You can use Bonsai without an account, and your meditation data then never leaves your device. If you have an account, you can delete it at any time from the You tab (More, then Delete account). That permanently deletes your account and all of your synced data from our database; anything already on your device stays there until you remove it or delete the app. You can also email meditate@breathebonsai.com and we'll delete your account for you.
Children
Bonsai is not directed at children under 13, and we do not knowingly collect data from children under 13.
Contact
Questions about this policy or your data? Email meditate@breathebonsai.com.