Privacy Policy

Meaningful — Taigoa Oy

Effective date: 21 September 2026

1. Who we are

Meaningful is a personal growth and happiness application developed and operated by Taigoa Oy, a limited liability company registered in Finland (Business ID: 3393494-2).

Taigoa Oy acts as the data controller for all personal data collected through the Meaningful mobile application and website (https://meaningful.mobi).

Contact: meaningful@taigoa.fi

2. Meaningful is not medical care

Meaningful is a tool for personal reflection, everyday wellbeing, goals and habits. It is not a medical device, healthcare service, therapy service, crisis service, or a substitute for a doctor, psychologist or other qualified professional. It does not diagnose, treat or prevent a medical or mental-health condition.

If you think you may be in immediate danger or need urgent help, contact your local emergency service or an appropriate crisis service. Do not rely on Meaningful or any AI-generated reflection in an emergency.

3. What data we collect

We collect the following categories of personal data.

3.1 Data you provide directly

• Account information: email address and chosen display name when you create an account. Your profile image and your birthday if you choose to add them.
• Wellbeing data: life aspect ratings, mood check-ins, written reflections, journal and writing-desk entries, letters to your future self, the happiness exercises and challenges you run and whatever you write inside them, and goal descriptions that you enter in the app.
• Goal data: personal goals you set, including target states, progress notes, and completion records.
• Moments: photos, notes, and tags you save as personal highlights or gratitude moments.
• Feedback you send us: if you provide us your value feedback, we receive your message, your account email address, an internal account identifier, any screenshots you attach, and, unless you switch off the "include device info" option, your device model, operating system version and app version. A screenshot you attach is uploaded to your own private folder in our photo storage and stays there until you delete your account.
• Your settings and preferences: the reminder times and quiet hours you choose, whether reminders are on, the life aspects you pick as a starting focus, the note and starting mood you enter when you first set up the app, and your app language and theme.

3.2 Data collected automatically

We do not use advertising networks, we do not track you across other apps or websites, and we do not sell or share your data for marketing purposes. We use no analytics service and no third-party crash-reporting service, and we do not record which screens you open or which buttons you tap. The data generated automatically is limited to the following:

• Crash and error reports: technical diagnostic records created when the app encounters an error: the error type, the screen you were on, a redacted error message, a stack trace of our own code, and whether you are on iOS or Android together with your operating system version and app version. They do not identify your device model. They are sent to our own servers, not to any third party, and the text is stripped of personal content before it is sent. They never include the content of your wellbeing entries, reflections, goals, letters or photos. If your device is offline, a report waits on the device until it can be sent.
• Server logs: when the app communicates with our servers, our cloud infrastructure records technical operational logs (such as timestamps, request types and error messages). These are used to keep the service running securely and to diagnose faults.
• AI usage records: one record per AI request, linked to your account, noting which feature made the request, which model answered it, how much text was processed and what it cost us to run. These records contain no part of what you wrote and no part of the answer you received. We keep them so that a single account cannot drain the AI budget for everyone, and so we can reconcile what the service costs.
• Device and app version: collected as part of crash and error reports, and attached to a feedback report unless you switch that option off (see section 3.1).

3.3 Data processed by the AI features

The Sol feature is using AI to analyse the wellbeing data you enter, life aspect ratings, mood patterns, reflections and goal progress to generate personalised suggestions. This processing happens on our servers within the European Union. It is not processed on your device, and it is not sent to any third-party AI company's own service.

We use Amazon Bedrock, a managed AI service operated by Amazon Web Services, running Anthropic's Claude models. Because the models are hosted by AWS inside Bedrock, your data is processed only by AWS as our data processor: Anthropic does not receive your data, has no access to it, and your data is never used to train any AI model.

AI requests are configured to run exclusively on EU inference endpoints, and our infrastructure policy explicitly blocks any AI request from being routed outside the EU. Only the text relevant to the specific feature you are using is sent; your account email address and identity are not included in the AI request.

Before any text reaches the AI, it passes an automated safety check on our own servers. If that check detects language suggesting a crisis or a risk of self-harm, we reply with a supportive message rather than an AI response, and your text is not sent to the AI service at all. This check is an automated keyword safeguard, not an assessment of you and not a crisis service — please read section 2.

4. Why we collect your data

We collect and process your data for the following purposes:

• Providing the service: to operate the app, store your entries, and deliver the core features you use.
• Personalisation: to tailor exercise suggestions, morning intentions, and Sol’s recommendations to your individual patterns.
• Improving the app: to act on the feedback you choose to send us, and to diagnose crashes and faults reported through crash and error reports and our server logs.
• Keeping the service available: to enforce a per-account limit on AI requests and to identify an account consuming the AI features far beyond normal use, so that one account cannot degrade or drain the service for everyone else.
• Technical support: to diagnose and fix bugs and compatibility issues.
• Safety: to detect language indicating a crisis or a risk of self-harm, and to respond with a supportive message instead of an AI-generated one.
• Legal obligations: to comply with applicable law, including Finnish and EU data protection requirements.

5. Legal basis for processing (GDPR)

Under the General Data Protection Regulation (GDPR), we rely on the following legal bases:

Contractual necessity (Art. 6(1)(b)): Processing your account information and wellbeing data is necessary to provide the Meaningful service you have signed up for.

Legitimate interests (Art. 6(1)(f)): We process technical server logs and crash reports to keep the service secure, available and working correctly; we keep AI usage records to enforce per-account limits and to prevent abuse of the AI features; and we process feedback you actively choose to send us in order to improve the app. Our interest in operating and protecting the product is balanced against your privacy — crash reports and AI usage records carry no wellbeing content, we do not profile you as an individual, and we do not use your wellbeing entries for this purpose.

Legal obligation (Art. 6(1)(c)): We process data where required by Finnish or EU law.

Consent (Art. 6(1)(a)): Where we rely on consent, for example, attaching device information to a feedback report, which you can switch off before sending, you can decline and withdraw it at any time.

Because your wellbeing entries (mood ratings, reflections, health-related goals) may constitute special category data under Art. 9 GDPR, we rely on your explicit consent for this processing. You can withdraw this consent at any time by deleting your data or account.

6. How long we keep your data

• Account and wellbeing data: kept for as long as your account is active. If you delete your account, your entries, photos, goals and account record are erased from our live systems straight away.
• Local copy on your device: the app keeps a copy of your data on your device so it works offline. It is removed when you sign out or delete the app.
• Backups: we keep rolling encrypted backups so that the service can be restored after a fault. A backup is never used to bring a deleted account back, and every copy of your data ages out of the backup window within 35 days of deletion.
• Feedback messages: kept in our support inbox for as long as needed to resolve your issue and to keep a record of the change it led to. A screenshot you attached is deleted together with your account.
• AI usage records: deleted automatically after 90 days, and immediately if you delete your account.
• Crash and error reports: deleted automatically after 30 days.
• Technical server logs: deleted automatically after 30 days.

7. Who we share your data with

We do not sell your personal data. We share it only in the following limited circumstances:

Service providers: We use third-party companies to help operate the service. These providers act as data processors under GDPR and are contractually bound to process your data only on our instructions. Our processors are:

The two AWS entries are the same corporate processor. The AWS GDPR Data Processing Addendum, which forms part of the AWS Service Terms, applies to our use of these services.

Sign-in providers you choose: if you sign in with Google or with Apple instead of a password, that company handles the sign-in and tells us the email address linked to it. We never receive your Google or Apple password. Their own privacy policies apply to that step.

Feedback you send us: when you submit the in-app feedback form, your message, your account email address, an internal account identifier and any screenshots you attached are delivered by email to the Meaningful team's support inbox so we can read and respond to it.

Legal requirements: We may disclose data if required by Finnish law, a court order, or other legal process.

Business transfers: If Taigoa Oy is acquired or merges with another company, your data may be transferred as part of that transaction. We will notify you in advance.

8. International data transfers

Your account data, wellbeing entries, goals and photos are stored in the European Economic Area, in the AWS Europe (Stockholm) region in Sweden. AI processing takes place on EU-based endpoints and is technically restricted from being routed outside the EU.

Feedback you send us arrives in a mailbox hosted on Google Workspace, provided to us by Google Ireland Limited. Google's Data Processing Addendum incorporates the EU Standard Contractual Clauses for the limited situations in which access from outside the EEA can occur.

Our cloud provider, AWS, is part of a group with a US parent company. We contract with AWS EMEA SARL in Luxembourg, and the AWS GDPR Data Processing Addendum incorporates the EU Standard Contractual Clauses and supplementary safeguards for the limited circumstances — such as technical support — in which access from outside the EEA could occur. We have not authorised any other transfer of personal data outside the EEA.

9. Your rights under GDPR

As a user in the European Economic Area, you have the following rights:

• Right of access: you can request a copy of all personal data we hold about you.
• Right to rectification: you can correct inaccurate data directly in the app or by contacting us.
• Right to erasure: you can delete your account and all associated data at any time from the app settings. If you cannot access the app, email meaningful@taigoa.fi and we will delete it for you. Deletion removes your entries, photos, goals and account record from our live systems straight away; the last copies age out of our encrypted backups within 35 days (see section 6).
• Right to data portability: you can export your own data at any time from the app — Settings → Export my data — as a structured JSON file you can save or pass on. You can also ask us for it by email.
• Right to restriction: you can ask us to limit how we process your data in certain circumstances.
• Right to object: you can object to processing based on legitimate interests.
• Right to withdraw consent: where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at meaningful@taigoa.fi. We will respond within 30 days. You also have the right to lodge a complaint with the Finnish Data Protection Ombudsman (tietosuojavaltuutettu.fi).

10. Data security

We take the security of your personal data seriously. Measures we apply include:

• Encryption of data in transit using TLS.
• Encryption of data at rest on our servers, and of our backups.
• On your device, the offline copy of your data is held inside the app's private storage and protected by your phone's own device encryption.
• All data stored in the AWS Europe (Stockholm) region within the EEA.
• Photos and files stored in per-user isolated storage, with an access policy that permits each account to reach only its own files.
• Your login session stored in your device's hardware-backed secure keystore (iOS Keychain / Android Keystore).
• Access to AI services restricted by infrastructure policy to EU endpoints only.
• Access controls limiting who within Taigoa Oy can access personal data.
• Regular review of our security practices.

No system is completely secure. If a data breach occurs that is likely to result in a high risk to your rights, we will notify you without undue delay and report to the Finnish Data Protection Ombudsman within 72 hours as required by GDPR.

11. Children's privacy

Meaningful is not intended for children under the age of 16. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we make significant changes, we will notify you through the app or by email at least 14 days before the changes take effect. The current version is always available at https://meaningful.mobi.

13. Contact us

If you have any questions about this Privacy Policy or how we handle your data, please contact us:

Taigoa Oy

Punavarpusentie 12 A
02660 Espoo
Finland

Email: meaningful@taigoa.fi

For formal data protection enquiries, you may also contact the Finnish Data Protection Ombudsman:

Tietosuojavaltuutetun toimisto
PO Box 800, FI-00531 Helsinki

https://tietosuoja.fi