Privacy Policy

Privacy Policy — Rayzz

Effective date: 2026-04-28 Last updated: 2026-04-28

This Privacy Policy ("Policy") describes how Rayzz ("Rayzz", "we", "our", or "us") collects, uses, stores, shares, and protects information when you ("you", "your", or "User") install, register for, or use the Rayzz mobile application and any related websites, APIs, or services (collectively, the "Service"). By creating an account or otherwise using the Service, you acknowledge that you have read and understood this Policy.

If you do not agree with any part of this Policy, you must stop using the Service and delete your account.

Plain-language summary (not a substitute for the full Policy): Rayzz is an AI-mediated conflict-resolution app for couples. To make the AI mediator ("Ray") work, we send the messages you write inside a conflict session — together with relationship context you have set — to our AI processor (Google Gemini) so that Ray can reply. We never reveal what one partner shared in their Private AI Consult chat to the other partner. We collect only what we need, we encrypt what we store, and you can export or delete your data at any time.

---

1. Who we are and how to contact us

For all privacy-related requests — access, correction, deletion, portability, withdrawal of consent, or complaints — contact privacy@rayzz.com.

---

2. Scope of this Policy

This Policy applies to:

• The Rayzz mobile applications for iOS and Android.
• The Rayzz website at https://rayzz.com and any subdomains.
• Any APIs, edge functions, webhooks, or backend services that we operate to provide the Service.
• Any communications between you and Rayzz (email, in-app, support).

This Policy does not apply to third-party websites, services, or applications that integrate with or are linked from Rayzz; those are governed by their own privacy notices, which we identify in Section 9.

---

3. Eligibility — minimum age

Rayzz is intended exclusively for adults aged 18 years and older who are in a romantic, marital, or partnership relationship and who wish to use AI mediation for conflict resolution.

We do not knowingly collect information from anyone under 18. If we discover that a person under 18 has registered, we will delete the account and all associated data without notice. If you are a parent or guardian and believe a minor has provided us with information, contact privacy@rayzz.com immediately.

---

4. Information we collect

We collect the categories of personal data set out below. The legal bases on which we rely under the EU/UK General Data Protection Regulation ("GDPR/UK GDPR") are listed in Section 6.

4.1 Account and identity data

• Email address (required for account creation, password reset, and service notifications).
• Full name (required so your partner can recognise you when pairing).
• Username (a non-unique display handle).
• Password (stored only as a salted hash by our authentication provider; we never see your plaintext password).
• Profile photo (optional; uploaded to encrypted object storage).
• OAuth identifiers from Google or Apple (only the stable account ID, display name, and verified email — never your social-graph data).

4.2 Pairing and relationship data

• Your partner's user ID (created when one of you accepts a pairing invitation).
• The "Relationship Constitution" you and your partner configure:
  • Relationship rules (free-text rules you both agree to follow).
  • Core expectations and "love languages".
  • Personality profile selections from in-app surveys.
• Counters that track how many conflict sessions have been opened in the current billing period.

4.3 Conflict-session content

When you start a conflict session, the following are stored:

• The "seriousness level" you selected on the Conflict Meter (Annoyed → Breakup).
• Which partner triggered the session and when.
• The resolution status (active/resolved) and resolution timestamps.
• All messages exchanged inside the session, separated by channel:
  • P2P Private Chat (between the two partners — Ray does not read these).
  • Group Chat (both partners + Ray — Ray reads and replies).
  • Private AI Consult — Partner A (only that partner + Ray).
  • Private AI Consult — Partner B (only that partner + Ray).
• Any voice recordings you submit through the "Yell Your Heart Out" feature, plus the text transcription of those recordings.
• Ray's responses, including the resolution summary written when both of you mark the session resolved.

Sensitive content notice. Conflict-session content can be deeply personal and may, depending on what you write, fall within "special categories of personal data" under GDPR (e.g., references to health, sex life, religious beliefs, or political opinion). We process this content based on your explicit consent (Article 9(2)(a) GDPR), which you grant when you start a conflict session and which you can withdraw at any time by deleting the session, the relevant messages, or your account.

4.4 Subscription and billing data

We use RevenueCat as our subscription-management partner, and the underlying purchases occur on Apple App Store or Google Play Store. We do not receive your full payment-card number, bank account, or billing address. We do receive:

• Your platform subscription identifier and entitlement status.
• The product identifier you purchased (e.g., com.rayzz.app.beginner.monthly).
• The renewal/expiration date, trial state, refund state.
• An anonymous RevenueCat App User ID linked to your Rayzz user ID.

If you contact us about a refund, we may receive a redacted purchase receipt from Apple or Google solely to verify the transaction.

4.5 Push-notification and device data

• Expo push tokens and APNs/FCM device tokens, used solely to deliver the notifications you have opted into.
• Device type, OS version, app version, locale, and time zone — used to render the right notification format and to debug crashes.

4.6 Diagnostic, crash, and performance data

We use Sentry to collect:

• Stack traces, breadcrumbs, and device metadata when the app crashes or throws an unhandled error.
• Anonymous performance traces for slow operations.

Before sending events to Sentry we apply scrubbing rules that remove email addresses, phone numbers, bearer tokens, and other obvious identifiers from log messages. Sentry events are retained for the period configured in our Sentry project (typically 30–90 days).

4.7 Information you provide to support

When you contact support@rayzz.com we receive your email address, your message, and any attachments you choose to send. We retain support correspondence for as long as is necessary to resolve the issue and meet our legal obligations.

4.8 Information we do not collect

• Precise GPS location.
• Contacts, calendar, SMS, or call logs.
• Photos or files outside what you explicitly upload to the app.
• Health, biometric, or fitness data.
• Browsing history outside the Service.
• Data about people who are not Rayzz users (other than the partner you pair with, who must also be a Rayzz user).

---

5. How we use your information ("Purposes")

We use the data described above for the following purposes:

We do not make automated decisions that produce legal effects or similarly significantly affect you within the meaning of Article 22 GDPR. Ray's responses are advisory and are not used to grant or deny any legal right, employment opportunity, financial product, or similar benefit.

---

6. Legal bases for processing (EEA / UK users)

Where you are located in the European Economic Area, the United Kingdom, or Switzerland, we process your personal data on the legal bases identified in the table in Section 5. Specifically:

• Performance of a contract — to deliver the Service to you under our Terms of Use.
• Consent — for sensitive content inside conflict sessions, voice recordings, marketing emails, and any analytics that require consent under local law. You may withdraw consent at any time without affecting the lawfulness of past processing.
• Legitimate interests — for fraud prevention, security, diagnostic logging, and aggregate product analytics. We have conducted a balancing test and concluded that these interests do not override your rights.
• Legal obligation — for tax, accounting, and lawful requests from public authorities.

---

7. AI processing — how Ray works with your data

Rayzz uses Google Gemini (operated by Google LLC / Google Ireland Limited) as the large language model that powers Ray. To generate Ray's reply, our backend (Supabase Edge Functions) sends Gemini:

1. The new message you wrote, wrapped in markers that flag it as untrusted user input.
2. Recent message history from the same chat channel, only — i.e. the Group Chat or your own Private Coach chat.
3. Your couple's Relationship Constitution (rules and expectations).
4. A read-only summary of the Group Chat when you are in a Private Coach chat (so Ray remembers context), but never the contents of your partner's Private Coach chat.

Key guarantees:

• Strict channel isolation. Database row-level security (RLS) prevents one partner from reading the other partner's Private Coach messages, and our prompt construction never includes the other partner's private channel.
• No cross-couple leakage. Each request to Gemini is scoped to a single conflict session belonging to one couple. We do not cross-pollinate data between couples.
• No model training on your data. Under the Google Generative AI API terms in effect for our project, prompts and responses are not used to train Google's foundation models. We do not train, fine-tune, or otherwise build derivative ML models on your messages.
• Prompt sanitisation. User-provided text is wrapped between [UNTRUSTED_BEGIN] / [UNTRUSTED_END] markers and screened for prompt-injection attempts.
• Output filtering. Replies in Private Coach chats pass through a "group-chat leak detector" before they are persisted, so that Ray cannot quote the Group Chat back into a private coaching context.

Gemini API requests are processed in Google's infrastructure, which may include data centres outside your country (typically in the European Union and the United States). Google acts as our sub-processor; the safeguards in Section 11 apply.

---

8. Voice recordings ("Yell Your Heart Out")

If you choose to send a voice message:

• Audio is uploaded over HTTPS to Supabase Storage with per-object access control.
• Audio is sent to a speech-to-text service (provided by Google as part of the Gemini API) for transcription.
• The transcript is then processed like any other text message in that channel.
• The original audio file is retained by default so you can replay it; you can delete it from inside the chat. When you delete the parent conflict session, the audio file is deleted with it.

You may decline microphone access in your device's settings; the rest of the Service will continue to function normally.

---

9. Third parties we share data with

We share personal data only with the following categories of recipients, and only to the extent necessary to provide the Service:

We require each of these recipients to (i) protect your data with appropriate technical and organisational measures, (ii) use it only to provide the contracted service, and (iii) honour the rights you exercise through us. Where required, we have entered into Data Processing Addenda and the European Commission's Standard Contractual Clauses with these recipients.

We do not sell your personal data and we do not share your personal data for cross-context behavioural advertising as those terms are defined in the California Consumer Privacy Act (as amended by the CPRA), the Colorado Privacy Act, the Connecticut Data Privacy Act, the Virginia Consumer Data Protection Act, or analogous statutes.

We may disclose personal data:

• To enforce our Terms of Use, prevent fraud, or protect the safety of users or third parties.
• To comply with a valid legal process (court order, subpoena, warrant), where we will seek to narrow the scope and notify you unless prohibited by law.
• In connection with a merger, acquisition, financing, or sale of business assets, in which case we will provide notice and continue to honour this Policy or notify you of any material change.

---

10. How long we keep your data ("Retention")

When data reaches the end of its retention period, we delete or irreversibly anonymise it.

---

11. International data transfers

Rayzz is operated from [YOUR COUNTRY]. Some of our service providers process personal data in the United States, the European Union, the United Kingdom, India, and other jurisdictions.

When personal data is transferred from the EEA, the UK, or Switzerland to a country that has not received an adequacy decision, we rely on:

• The European Commission's Standard Contractual Clauses (SCCs) with the relevant recipient.
• The UK International Data Transfer Addendum to the SCCs, where applicable.
• Supplementary technical measures (encryption in transit and at rest, access controls, sub-processor flow-down).

You may request a copy of the safeguards in place by contacting privacy@rayzz.com.

---

12. Security

We implement and maintain technical and organisational measures designed to protect personal data, including:

• TLS 1.2+ for all network traffic.
• Encryption at rest for Supabase databases, Storage, and our client-side cache (react-native-mmkv) keyed by a secret stored in the platform keychain.
• Row-Level Security (RLS) policies on every table, enforcing per-user and per-couple access control.
• Strict separation between the four chat channels: even a direct Supabase query from a logged-in user cannot return another partner's Private Coach messages.
• Server-only API keys (Gemini, RevenueCat webhook secret, push-server keys) stored in Supabase Function secrets and never embedded in the mobile app.
• Multi-factor authentication on administrative access.
• Routine dependency, container, and infrastructure patching.
• Logging and anomaly monitoring for authentication and billing events.

No system is perfectly secure. If we become aware of a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours and inform affected users without undue delay where required by law.

---

13. Your rights

Subject to local law, you have the following rights with respect to your personal data:

• Access — obtain a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure / "right to be forgotten" — delete your account and associated data; see Section 14.
• Restriction — limit how we process your data.
• Objection — object to processing based on legitimate interests or for direct marketing.
• Portability — receive your data in a structured, commonly used, machine-readable format.
• Withdraw consent — at any time, where processing is based on consent. This does not affect the lawfulness of past processing.
• Lodge a complaint — with your local supervisory authority. In the EEA, the relevant authority is determined by your country of residence; in the UK, it is the Information Commissioner's Office (ico.org.uk).
• Designate an authorised agent — where allowed by law (e.g., CCPA).
• Non-discrimination — we will not deny service, charge a different price, or provide a different level of quality because you exercised your rights (CCPA/CPRA).

To exercise any right, email privacy@rayzz.com from the address associated with your Rayzz account, or use the in-app "Delete my account" / "Export my data" controls in Profile → Privacy. We will respond within 30 days (extendable by a further 60 days for complex requests, with notice).

13.1 Special note on partner data

Because conflict sessions inherently involve two people, when you ask us to delete your messages we may retain or pseudonymise limited content (e.g., the fact that a session occurred, your partner's side of the conversation) so that your partner's record remains coherent. Where deletion would compromise your partner's own data rights, we will explain the limits and offer the closest alternative (anonymisation, restriction, or session-level deletion by mutual consent).

---

14. Account deletion

You can delete your account at any time:

1. Open the app → Profile → Account → Delete account.
2. Confirm with your password or biometric.
3. Read the consequences (your conflict history will be erased, subscription will not auto-renew, your partner will see that you have left).

After confirmation:

• Your account enters a 14-day grace period during which you can sign in again to cancel the deletion.
• After 14 days, we permanently delete your profile, pairing, conflict messages, voice files, and resolution summaries.
• Encrypted backups containing residual copies are rotated within 90 days.
• Limited records (subscription invoices, fraud-prevention logs) may be kept for the periods stated in Section 10.

If you only want to cancel your subscription (not your account), manage it inside Apple's Settings → Subscriptions or Google Play → Subscriptions; cancellation does not delete your account.

---

15. Cookies and tracking

The Rayzz mobile app does not use advertising cookies, web beacons, or cross-site tracking pixels. The app uses local encrypted storage (MMKV) and the iOS/Android keychain solely to keep you signed in and to cache application state.

The marketing website at https://rayzz.com may use a small number of strictly necessary and analytics cookies, described in the cookie banner shown on first visit.

We do not use the iOS Identifier for Advertisers (IDFA) and we do not request App Tracking Transparency consent because we do not track users across other apps and websites.

---

16. California-specific disclosures (CCPA / CPRA)

If you are a California resident, in addition to the rights listed in Section 13, you have the right to:

• Know what categories of personal information we collect, the sources, business or commercial purposes, and categories of recipients.
• Know what specific pieces of personal information we have collected about you.
• Request deletion, subject to legal exceptions.
• Correct inaccurate personal information.
• Opt out of "sale" or "sharing" — we do not sell or share personal information for cross-context behavioural advertising, so there is nothing to opt out of, but you may submit a confirmatory request.
• Limit use of "sensitive personal information" — to the extent we process sensitive personal information (e.g., account credentials, conflict-session content), we use it only for permitted purposes under §7027 CCPA Regulations.

We have collected the following CCPA categories in the past 12 months: identifiers, customer-account information, commercial information (subscriptions), Internet/network activity (app usage, crash logs), inferences (limited), and "sensitive personal information" (account credentials, contents of communications).

Submit CCPA requests at aditya@onlyvibeapps.com or via the "Do Not Sell or Share My Personal Information" link at https://onlyvibeapps.com/rayzz/privacy. We will verify your identity by matching at least two data points you supply against our records.

---

17. Children

The Service is not directed to children. See Section 3. We comply with the Children's Online Privacy Protection Act (COPPA) by not knowingly collecting personal information from anyone under 13 (and, by our own age gate, under 18).

---

18. Do Not Track

Rayzz does not respond to browser "Do Not Track" signals, because we do not engage in cross-context behavioural advertising in the first place.

---

19. Changes to this Policy

We may update this Policy from time to time. When we make material changes, we will:

1. Update the "Last updated" date at the top.
2. Post the new version inside the app under Profile → Legal → Privacy Policy.
3. For significant changes, send an email to your registered address and/or display an in-app notice.

Continued use of the Service after the new Policy takes effect constitutes acceptance.

---

20. Contact

Questions, requests, or complaints:

• Email (privacy): aditya@onlyvibeapps.com
• Email (support): aditya@onlyvibeapps.com
• Postal: M/s VIBE APPS Prop ADITYA GUPTA, 2758/ A New Tagore Nagar Ludhiana Punjab 141001 In

You also have the right to lodge a complaint with your local data protection authority. We would, however, appreciate the chance to address your concerns directly first.

---

Disclaimer for the document author: this draft has been prepared as a comprehensive starting point reflecting Rayzz's data flows. It is not legal advice. Have it reviewed by qualified counsel in each jurisdiction where you offer the Service before publishing.