Privacy policy

Website privacy

The public website serves its own fonts, screenshots, and Chika artwork. It does not collect assessments, mood entries, account credentials, or consultation requests. Screenshot and theme selections remain in the current page; no website cookies, local storage, advertising, or analytics are implemented.

The hosting provider receives technical requests needed to serve the site, which may include IP addresses and browser information. Email, telephone, and external support links open another service with its own privacy practices. This website does not monitor those conversations.

The account-deletion page explains the app process. It does not accept requests or connect to student accounts. The app and related administrative data practices are described below.

Who is responsible for your information

ginhawa is developed by the capstone research team listed in About Us. The team proposes to operate the student pilot. The accountable operator, designated privacy representative, and responsibilities of any participating institution have not yet been formally finalized. Identifying STI College Caloocan as the project’s school does not establish institutional control, endorsement, or approval.

For support, deletion assistance, or privacy concerns, contact ginhawa.support@gmail.com. The appointment of an accountable operator and designated privacy representative still requires confirmation before real-student release.

Information you provide

Account and student details: your account identifier, name, email, sign-in method, and student information such as student number, course, and section. Student-number ownership information helps prevent duplicate use. Firebase Authentication handles credentials; ginhawa does not store your password in your wellbeing profile.

Wellbeing records: assessment answers, scores, categories, dates and histories; mood check-ins and optional custom reflections; selected stress factors and calibration; general and AI recommendations, including saved guides; and recommendation feedback and preferences. These entries may reveal sensitive health or educational information.

Consultation records: the requesting student, selected Associate, appointment time, status, notifications, booking references, and related request or status details. Avoid including information about other people that they have not authorized you to share.

Optional problem reports

If you use Report a problem in Settings, ginhawa stores your account identifier, chosen category, title, description, submission date, and report status in Firestore for troubleshooting. Active Super Admins can review the report, change its status, and leave an update that you can read in the app. The most recent update records the responsible administrator and date. Reports do not automatically include assessment answers, mood records, device logs, or screenshots. Do not put passwords or private wellbeing details in a report. Reports are included in the proposed account-deletion scope and are not an emergency-support channel.

Device storage and service information

The app can keep account-owned drafts, pending uploads, and cached records on your device. It also stores preferences such as theme, music, and onboarding acknowledgments. Firebase and Google services may handle technical information, including network, device, authentication, and security information, to provide and protect their services.

Protect access to devices you share with others. Signing out does not mean every device or service cache has been erased, and uninstalling the app does not delete online records.

Why information is used

Information supports account registration and authentication, account isolation, student-number uniqueness, saved assessment and mood history, personalized wellbeing guidance, consultation scheduling and updates, and access by authorized support personnel. Related administrative features provide assessment monitoring, wellbeing summaries, and consultation management within the permitted role.

The intended pilot evaluates functionality, usability, reliability, and user acceptance, not clinical effectiveness. A lawful basis appropriate to each purpose and any sensitive information must be established before collection. This notice is an explanation of processing, not blanket consent to all uses. Optional entries and any additional research use must be handled under appropriate notice and permission where required.

AI-Assisted Recommendations and Third-Party Data Processing

ginhawa uses Cloudflare Workers AI (Gemma), through an authenticated Cloudflare Worker, for AI-assisted recommendations when the service and your account preference are enabled. Previously saved recommendations remain available; opening results or See More does not generate again.

When a configured app contacts the gateway, Cloudflare processes Firebase authentication and App Check tokens to verify the account and application. Those tokens contain account or technical identifiers; they are not sent to the language model. Authorized Firebase reads supply the saved assessment, selected factors and relevant same-day mood context.

The model input is limited to the assessment type, score and classification, selected stress factors, relevant same-day moods or optional reflections, and assigned General Recommendations. Names, email addresses, student numbers and Firebase UIDs are not intentionally included in model input. Known identifiers and obvious identifying patterns are removed from free text, but this does not guarantee anonymity. Do not enter identifying information in custom fields. Wellness context can still reveal sensitive information.

Cloudflare states that Workers AI inference content is not used to train models and is not retained after processing, subject to its documented legal and security exceptions. Operational metadata and the terms for any separately enabled storage features are distinct. ginhawa does not enable prompt/output logging, AI Gateway storage or model response caching. Provider terms and safeguards must be reviewed for the pilot; no complete-anonymity or immediate-provider-erasure promise is made.

AI guidance is supportive and educational, not diagnosis or treatment. General Recommendations use predefined rules without model processing. Agreeing to the Terms or acknowledging this Policy does not enable AI. On the first-use medical disclaimer, the AI toggle starts on for the full ginhawa experience and you can turn it off before continuing. Continuing saves the separate choice; no AI generation is started by that screen. Personalized AI guidance sends selected wellness data to Cloudflare. Turning the toggle off uses non-AI General Recommendations. You can change this choice in Settings → Privacy & AI → AI recommendations. The choice is saved on your own Firebase profile and applies across devices using this version after synchronization. When off, new recommendation requests are not sent to Cloudflare; assessments continue to be saved in Firebase for history and General Recommendations. If an off-setting cannot synchronize, it remains off locally and the app offers a sync retry for other devices. Re-enabling requires a confirmed connection. Turning AI off does not erase saved guidance or recall requests already sent. A service-wide kill switch and daily quotas override an enabled preference; if your preference cannot be verified, the app uses General Recommendations.

Minimal quota records in Cloudflare D1 contain pseudonymous keyed identifiers, UTC dates, counters, timestamps and status, without wellness content. Records older than seven days are removed by maintenance; recoverable provider copies may follow D1 Free Time Travel’s documented seven-day lifecycle. Daily limits reset at 8:00 AM Philippine time. Account-deletion handling must account for this operational metadata and provider lifecycle.

For privacy questions, email ginhawa.support@gmail.com. The responsible operator and designated privacy representative still require confirmation.

Important AI-provider limitation

Changing provider does not itself approve sensitive student-data processing. The Cloudflare processor arrangement, cross-border handling, participant notice and appropriate permission still require review before real-student AI activation. The server remains disabled until separately approved.

Older ginhawa versions may have used Google Gemini/Firebase AI Logic. Their previously generated recommendations remain in saved assessment history until deletion. This release does not send new inference requests to that route. Provider-held historical copies remain subject to the terms and lifecycles that applied when they were processed; this notice does not retroactively change those terms.

Who may access or receive information

Authorized Guidance Associates and administrative personnel access student records only within assigned permissions and authorized purposes. Super Admin account-management permissions do not automatically grant access to all wellness records. Authorized maintainers may need access to operate or secure the system. Administrative testing alone is not authorization to view sensitive student information.

Firebase and Google provide authentication, storage and application security. A configured AI gateway uses Cloudflare for authenticated request handling and minimal quota storage; when enabled for your account and the service, Workers AI processes the minimized model context described above. These providers may process information outside the Philippines. External support links and Google sign-in have their own provider policies. This draft does not authorize advertising use or sale of wellness information.

How long information is kept

Account-linked records are stored to support the disclosed app functions and the agreed pilot arrangements. The retention schedule for active accounts has not yet been finalized; this draft does not authorize indefinite storage or promise a deletion date that the system cannot enforce. The retention schedule and responsible operator must be confirmed and communicated before real-student release.

Wellness information is not to be retained after verified account deletion for future research, analytics, or administrative convenience. Any legal or professional requirement to keep a specific record must be identified, limited to what is necessary, and explained rather than assumed.

Account deletion and remaining copies

The default is to permanently delete student-associated personal information after ownership verification and explicit operator confirmation. This covers Authentication, the profile and all nested collections, student-linked assessment records and guides, moods, stress factors, calibration, feedback, preferences, problem reports, consultations and notifications, reservation references, and identifiable derived reports. Other students’ information and shared guidance associate availability are preserved. An empty student-number reservation remains to prevent reassignment, without the deleted profile or UID mapping. It is a retained number reservation, not a claim that the number is anonymous.

Deletion requests are stored in Firestore with a case reference, requester UID, status, and server timestamps. Recent verified Firebase sign-in and explicit student confirmation are required for submission. Students can read their own request but cannot verify ownership, approve processing, change privileged fields, or complete deletion. The trusted local Admin SDK worker is used only by authorized Super Admin operators. Processing is manual, not an automatic deletion trigger. We target completion within 30 calendar days after verification. Submission alone does not delete the account. A request is received only after server confirmation; refresh status after an uncertain connection before retrying.

While a request is Pending, it awaits verification or processing. Processing means permanent cleanup has begun and protected access ends. Failed means the operator must safely resume the existing case. Completed is recorded only after application-data cleanup and Authentication removal have been verified. You can check status in the app while your account remains active; after access ends, use the verified operator recovery route for follow-up.

Once completed, the request is replaced with minimal audit metadata: case reference, outcome, submission/verification/completion timestamps, verifying and processing operator references, and expiry. It does not retain student name, email, student number, UID, or wellness content. Completed audits are kept for 90 days from completion and removed by the operator’s local maintenance process. Unfinished cases keep only the identity and processing state needed for safe recovery until resolved. The operator must monitor overdue cases and run expiry maintenance regularly; no cloud scheduler or automatic TTL is assumed.

For lost account access, try Firebase password recovery or the original Google sign-in first. If unsuccessful, email ginhawa.support@gmail.com for operator-assisted recovery. Any further identity check must be handled by an authorized operator using the approved recovery procedure and only necessary evidence. A student number by itself is insufficient. Never send passwords or unnecessary identity documents. The support mailbox must be monitored, and authorized recovery personnel and verification procedures must be confirmed before real-student release.

Application-controlled device drafts and caches are cleared when account removal can be detected; a disconnected device cannot be remotely wiped immediately. Deleting Firestore records does not mean all provider-held logs, replicas, or any verified backups have expired. Their actual configured and documented lifecycles govern removal. Permanent processing uses the activated local operator workflow and requires recent operator authentication and explicit confirmation for each case. No blanket retention exception or immediate removal of every copy is promised.

Your rights and choices

Subject to applicable Philippine law, you may request information about processing, access your personal data, seek correction of inaccurate records, object to processing, withdraw consent where consent is the legal basis, and request erasure or blocking where appropriate. Other applicable rights, including portability or remedies, depend on the circumstances. You may raise a complaint with the National Privacy Commission.

For privacy requests, email ginhawa.support@gmail.com. Verification may be needed to protect your account; only information necessary for the request should be sought. Do not submit passwords or unnecessary identity documents. Withdrawing consent does not automatically make earlier lawful processing unlawful, and any specific obligation affecting a request should be explained. Acknowledging this notice does not waive your rights.

Security and updates

ginhawa uses authentication, account separation, role permissions, and security rules to restrict access. These safeguards reduce risk but cannot guarantee absolute security. Keep your sign-in details secure and report suspected unauthorized access to ginhawa.support@gmail.com.

Material changes to the purposes, recipients, or handling of your information should be communicated before the changed processing begins, with renewed permission where required.