This Privacy Policy explains how Hamood Mehmood, operating as Risyn ("Company," "we," "us," or "our"), collects, uses, discloses, and protects your personal information when you use the Risyn mobile application ("App").
We are based in Winnipeg, Manitoba, Canada and are committed to protecting your privacy in accordance with applicable laws, including:
By creating an account and using the App, you consent to the data practices described in this policy. Where we process sensitive personal data (including mental health information), we obtain your explicit consent as described in Section 3.
| Data Category | Examples | Purpose |
|---|---|---|
| Account Information | Email address, password, display name | Account creation, authentication, and communication |
| Profile Information | Age, gender, occupation, interests, general location (text) | Personalized AI coaching experience |
| Character Map | Personality traits, values, life goals, challenges, relationships, hobbies, dreams, fears | Deep AI personalization stored in Firestore |
| Conversation Data | All messages exchanged with AI coaches, chat session metadata | Contextual AI responses and conversation continuity |
| Mental Health Assessments | PHQ-9, GAD-7, PSS-10, ASRS-6, K-10, ISI-7, PCL-5 Short, AUDIT-C scores and severity ratings | Mental wellness tracking and AI-informed coaching |
| Mood and Habit Data | Mood logs (1-5 score, context tags, symptoms, triggers, coping strategies), habit goals, streak data, completion logs | Progress tracking and personalized guidance |
| Preferences | Notification settings, theme preference, language selection | App customization |
| Avatar Image | Optional profile photo you upload | Profile display |
| Data Category | Examples | Purpose |
|---|---|---|
| Usage Analytics | Screens viewed, features used, session duration | App improvement and feature prioritization |
| Device Information | Device type, OS version, app version | Technical support and compatibility |
| Push Notification Token | Expo push notification token | Delivering push notifications you have enabled |
| Error Logs | Crash reports, error messages | Bug fixing and stability improvement |
The App collects and processes data that may qualify as special category data under the GDPR, specifically data concerning health. This includes:
We process this sensitive data based on your explicit consent (GDPR Article 9(2)(a)). You provide this consent when you:
You may withdraw your consent at any time (see Section 8). Withdrawal of consent does not affect the lawfulness of processing performed before withdrawal.
Risyn is not a medical device, diagnostic tool, or substitute for professional mental health care. Assessment scores are for self-awareness and personal tracking only. If you are experiencing a mental health crisis, please contact a qualified healthcare professional or emergency services.
| Purpose | Legal Basis (GDPR) | PIPEDA Basis |
|---|---|---|
| Provide AI coaching services | Performance of contract (Art. 6(1)(b)) | Consent |
| Personalize coach responses using your Character Map | Explicit consent (Art. 9(2)(a)) for health data; Legitimate interest (Art. 6(1)(f)) for non-sensitive data | Consent |
| Track your personal growth, habits, and mood | Performance of contract | Consent |
| Process mental health assessments | Explicit consent (Art. 9(2)(a)) | Consent |
| Send push notifications you have enabled | Consent (Art. 6(1)(a)) | Consent |
| Provide customer support | Legitimate interest (Art. 6(1)(f)) | Consent |
| Ensure App security and prevent abuse | Legitimate interest (Art. 6(1)(f)) | Reasonable purpose |
| Improve app features and fix bugs | Legitimate interest (Art. 6(1)(f)) | Reasonable purpose |
Your data feeds our Character Map system, which enables AI coaches to:
This data is used exclusively within the App to improve your personal experience. It is never sold, shared with advertisers, or used for any purpose outside of providing you with the Risyn service.
We collect usage analytics via Firebase Analytics to:
Analytics data is aggregated and anonymized where possible. You may opt out of analytics collection through your device privacy settings or within the App's privacy settings.
When you send a message to an AI coach, the following data is transmitted to generate a response:
We use OpenRouter as our AI routing service, which routes your coaching requests to Google's Gemini language models for response generation. Separately, we use Google Cloud Vertex AI to generate text embeddings (numerical representations of your memories and conversations) that power your coaches' long-term recall.
Key data handling commitments:
We follow the principle of data minimization when sending data to AI providers. Only the information necessary to generate a contextually relevant coaching response is included in each API request.
| Third Party | Data Shared | Purpose | Data Location |
|---|---|---|---|
| Firebase (Google Cloud) | Account data, profile, conversations, assessments, habits, mood logs, analytics | Authentication, database, file storage, analytics | United States |
| OpenRouter | Conversation content, Character Map context | AI request routing | United States |
| Google (Gemini via OpenRouter; Google Cloud Vertex AI) | Conversation content and Character Map context (for coach replies, routed via OpenRouter); memory and conversation text (for embeddings, via Vertex AI) | AI response generation and text embeddings | United States |
| Expo (React Native) | Push notification token | Push notification delivery | United States |
We may disclose your personal information if required or permitted by law, including:
We will notify you of such disclosures where legally permitted to do so.
We implement appropriate technical and organizational measures to protect your data:
You can help protect your account by:
In the event of a personal data breach:
Under Canada's Personal Information Protection and Electronic Documents Act, you have the right to:
If you are located in the European Union or European Economic Area, you have additional rights under the GDPR:
You can exercise your rights through:
We will respond to all requests within 30 days. For GDPR requests, this may be extended by two further months for complex requests, in which case we will inform you of the extension within the initial 30-day period.
We will verify your identity before processing any data access, correction, or deletion request.
| Data Type | Retention Period |
|---|---|
| Active account data (profile, conversations, assessments, habits, mood logs, Character Map, AI coach memory) | Duration of your active account |
| Data after account deletion request | Permanently deleted within 30 days |
| Usage analytics events | Up to 2 years, then automatically deleted |
| AI safety & diagnostic telemetry (e.g. coach-routing and safety-check verdicts) | 90 days, then automatically deleted |
| Error and crash logs | 90 days |
| Push notification tokens | Until you disable notifications or delete your account |
The 2-year analytics and 90-day telemetry retention periods are enforced automatically by a scheduled cleanup process that permanently deletes records once they exceed their retention window.
When you delete your account, we permanently erase:
Anonymized, aggregated analytics data that cannot be used to identify you may be retained.
Before deleting your account, you may export your data in JSON format through the App's Settings. The export includes your profile, conversations, assessments, habits, mood logs, Character Map data, and your AI coach memory (saved stories, memories, relationships, life chapters, and learned preferences).
Your data is processed and stored using Firebase (Google Cloud) infrastructure located in the United States. AI processing via OpenRouter and Google (Gemini and Google Cloud Vertex AI) also occurs in the United States.
If you are located outside the United States (including in Canada or the EU/EEA), your data will be transferred internationally. We ensure appropriate safeguards for these transfers through:
Risyn may offer subscription plans through the Apple App Store and Google Play Store. All payment processing is handled entirely by Apple or Google, as applicable.
The App does not use cookies. We use Firebase Analytics, which:
We do not use any third-party advertising trackers, pixels, or cross-app tracking technologies.
Risyn is intended for users aged 18 and older. We do not knowingly collect personal information from anyone under the age of 18.
If we become aware that we have collected personal information from a person under 18, we will take steps to delete that information as quickly as possible.
If you believe a minor has provided us with personal information, please contact us immediately at risynai.app@gmail.com.
The App may contain links to external websites or services not operated by us. We are not responsible for the privacy practices or content of these third-party sites. We encourage you to review the privacy policies of any external service before providing your personal information.
We may update this Privacy Policy from time to time. When we make changes, we will:
Your continued use of the App after changes are posted constitutes your acceptance of the revised policy, except where renewed consent is required.
For privacy-related questions, concerns, or to exercise your data rights:
Hamood Mehmood (Risyn)
Email: risynai.app@gmail.com
Location: Winnipeg, Manitoba, Canada
If you are not satisfied with our response to your privacy concern, you may file a complaint with the:
Office of the Privacy Commissioner of Canada
Website: www.priv.gc.ca
Toll-free: 1-800-282-1376
For GDPR-specific inquiries, you may contact your local Data Protection Authority. A list of EU Data Protection Authorities is available at: edpb.europa.eu
By creating an account and using Risyn, you acknowledge that you have read and understood this Privacy Policy and you consent to the collection, use, and disclosure of your information as described herein.
By using Risyn, you understand and agree that: