Privacy Policy

1. WHO WE ARE

This Privacy Policy applies to Don't Panic ("we," "us," "our"). We operate the website at joindontpanic.com and the Don't Panic web application (collectively, the "Platform").

Privacy Officer: Emil Pasini, Founder. Email: emil@epasini.com. This is the person accountable for how your personal information is handled, and the person who answers every privacy request.

2. WHAT THIS POLICY COVERS

This policy explains what personal information we collect, why we collect it, how we use it, who we share it with, where it is stored, and your rights over it. We follow:

• PIPEDA (Personal Information Protection and Electronic Documents Act: Canada) and, for Quebec residents, the Act respecting the protection of personal information in the private sector (Law 25)
• CASL (Canada's Anti-Spam Legislation)
• US state privacy and consumer health data laws, including California (CCPA/CPRA) and Washington's My Health My Data Act
• GDPR / UK GDPR, for users in the European Economic Area and the United Kingdom

Wellness information you give us (check-ins, applications, intake answers) is covered in more detail in our Consumer Health Data Privacy Policy.

3. WHAT WE COLLECT

We collect only what we need to deliver our services.

• Account and contact details: name, email, and password (stored hashed) when you create an account, join the email list, or download The Daily Protocol. If you sign in with Google, we receive your name and email from Google.
• Payment details: processed entirely by Stripe. Card numbers never touch our servers. We see your subscription status, not your card.
• Program activity: which modules you have completed, your daily practice ticks, and your settings.
• Wellness self-reports: your answers to the in-app Check-In (self-ratings such as sleep, energy and regulation) and, if you have a private plan, the plan written for you.
• Proximity application and intake answers: if you apply for or join Proximity, the forms ask about your training history, injuries, sleep, nutrition, and, if you choose to answer, your mental health history, medications, supplements and substance use.
• Community content: posts, replies and reactions you make in The Room, and your display handle.
• Notification data: if you turn on notifications, a push address for your device.
• Basic technical data: IP address and device information processed by our hosting and security providers, to keep the Platform working and protected.

Wellness information is sensitive. The Check-In, application and intake answers can say something about your physical or mental health. We collect them only because you choose to give them to us, we use them only to deliver the program and the coaching you asked for, and they are never sold, never used for advertising, and never shared except with the service providers listed below that store and deliver them. The intake form asks for your explicit consent before you submit it. Every health question is optional unless the form marks it otherwise, and you can skip anything you don't want to share.

What we do NOT collect:

• Medical records from doctors, clinics or insurers
• Biometric data (face, fingerprint, voice prints)
• Precise location
• Social media passwords
• Data from minors (you must be 18+ to use the Platform)

4. HOW WE USE YOUR DATA

• Delivering the service: your account, your programs, your progress, your content access, your Check-In history.
• Coaching: for Proximity clients, reading your application and intake answers to decide fit and to design your work.
• Processing payments: via Stripe.
• Communicating with you: account emails, program emails, support replies.
• Marketing emails: only with your consent (CASL compliant). You can unsubscribe from any of them in one click.
• Security: detecting fraud, preventing abuse, protecting your account.
• Understanding traffic: aggregate, cookieless page-visit counts. No profiles, no individuals.

We do NOT:

• Sell your personal data to anyone. Ever.
• Use your data for targeted advertising on third-party platforms.
• Share your data with data brokers.
• Use your wellness information for any purpose other than the service you asked for.

5. WHO WE SHARE DATA WITH

We share data only with the service providers required to run the Platform. They process it on our behalf and under their own security obligations:

• Supabase: account, progress, Check-In, plan, community and email-list storage, and account emails
• Stripe: payment processing and billing (PCI DSS Level 1). For some purchases Stripe acts as the reseller of record and handles sales tax
• Resend: email delivery
• Formspree: delivery of contact form messages, Proximity applications and intake forms
• Daily: live video sessions inside The Room
• Cloudflare: website and application hosting, security, and privacy-first visit counts (Cloudflare Web Analytics)
• Google: only if you choose "Continue with Google" to sign in
• Apple, Google or Mozilla push services: only if you turn on notifications, to deliver them to your device
• Meta / ManyChat: only if you message our Instagram account; those conversations are processed by Instagram and our messaging automation provider

We may also disclose data if required by law or court order, or to protect someone's safety.

6. WHERE YOUR DATA IS STORED

We are based in Ontario, Canada. Our service providers store and process data outside Canada, mainly in the United States (our database is hosted in the eastern US). Data stored in another country is subject to that country's laws, and courts or authorities there may be able to access it. By using the Platform you understand that your information is transferred to and stored in the United States. For users in the EEA and UK, transfers rely on our providers' standard contractual clauses or equivalent safeguards.

7. EMAIL COMMUNICATIONS (CASL COMPLIANCE)

• You opt in to marketing emails, and you confirm it by tapping a link we email you (double opt-in). We never pre-check consent boxes.
• Every marketing email includes an unsubscribe link. One click. No hoops.
• Unsubscribe requests are processed within 10 business days (usually immediately).
• Transactional emails (account confirmations, receipts, password resets, billing notices) are sent without opt-in because they are required to deliver the service.

8. HOW WE PROTECT YOUR DATA

• All data transmitted to and from the Platform is encrypted (HTTPS).
• Database access is locked per account: you can read and change only your own records.
• Payment processing is handled by Stripe. We do not store card numbers.
• Access to personal data is limited to the founder and to the service providers above.
• If a breach creates a real risk of significant harm, we will notify you and the relevant privacy regulator as the law requires.

No system is 100% secure. We take reasonable measures to protect your data, but we cannot guarantee absolute security.

9. HOW LONG WE KEEP YOUR DATA

• Active accounts: as long as your account is active.
• Deleted accounts: when you delete your account (Profile, then Delete account), your account, progress, Check-In answers, plan and community posts are erased immediately, and your email is removed from our lists.
• Inactive accounts: if a cancelled account is inactive for 12 months, we may delete or anonymize it.
• Email subscribers (no account): until you unsubscribe. After that your email is removed from active lists within 30 days.
• Proximity applications and intake answers: kept for the length of the engagement and up to 12 months after it ends, then deleted, unless you ask for earlier deletion.
• Payment records: kept by Stripe and by us as tax and financial law requires (typically 7 years).

10. YOUR RIGHTS

Wherever you live, you can:

• Access the personal data we hold about you and get a copy
• Correct inaccurate data
• Delete your data, including deleting your account yourself from your Profile
• Withdraw consent at any time, including for marketing emails and for wellness information
• Complain to a privacy regulator: in Canada, the Office of the Privacy Commissioner of Canada (or, in Quebec, the Commission d'accès à l'information); in the EEA or UK, your local data protection authority

California residents also have the right to know what we collect and how it is used, to delete it, to opt out of its sale or sharing (we do neither), and not to be discriminated against for using these rights.

EEA and UK residents: we process your data to perform our contract with you (your account and subscription), with your explicit consent (wellness information and marketing emails), and for our legitimate interest in keeping the Platform secure. You also have the rights to data portability, to restrict processing and to object.

To exercise any right, email the Privacy Officer at emil@epasini.com. We will respond within 30 days.

11. COOKIES & TRACKING

• Privacy-first analytics. We use Cloudflare Web Analytics to count page visits. It sets no cookies, does not fingerprint your device, and does not track you across other sites. We do not run Google Analytics.
• No advertising cookies or pixels. We do not run ads and we do not track you across the web.
• Essential storage only. The Platform uses browser storage (cookies and localStorage) only for what it needs to function: your login session, a saved copy of your progress so the app opens fast, and your own settings, all stored on your own device.

Because the analytics sets no cookies and we only use essential storage, there is nothing to opt in or out of. You can clear browser storage at any time, though you will need to sign in again.

12. CHILDREN'S PRIVACY

The Platform is not intended for anyone under 18. Creating an account requires confirming you are 18 or older. We do not knowingly collect personal data from minors. If we learn that we have, we will delete it.

13. CHANGES TO THIS POLICY

We may update this Privacy Policy. If we make significant changes, we will notify you by email or a notice on the Platform before they take effect.

14. CONTACT

For privacy questions or requests:

Privacy Officer: Emil Pasini · Email: emil@epasini.com · or use the contact form · Location: Ontario, Canada

This Privacy Policy is written to be clear and direct. If something doesn't make sense, email us and ask.