Privacy Policy

The short version

• You go through the whole introduction — the questions, your profile, your result — as a guest. Until you sign in, nothing you write leaves your phone.
• You sign in when you subscribe, because a subscription has to belong to a person rather than to a phone. Signing in is also what turns on cloud backup. That is all it does.
• There is no analytics, no advertising, no tracking, and no third-party SDK watching what you do in the app.
• We do not sell your data, and we never will.
• You can delete your account and everything in it from inside the app, in Settings.

What the app stores on your phone

Everything you do in Seya is written to your device first. This happens whether or not you have an account, and it is the only copy that exists until you sign in.

• Your name, which the first question asks for. It is only used to address you in the app, and you can change or clear it in Settings.
• Your answers to the onboarding questions: your goal, your triggers, when and where urges tend to hit, how long this has been going on, who knows about it, and how you want the app to talk to you.
• Your streak: start date, current and longest streak, check-ins, Restores used, and a day-by-day history.
• Anything you write yourself — your reason for stopping, reflections after a setback, and the notes you add when you log what set you off.
• Changes you make to your plan, the daily goals you tick off, and which of the one-off environment changes in your plan you have marked as done.
• Once you sign in, the identifier of the account this data belongs to. It is a random string, and it is what stops your data from being handed to the next person who signs in on the same phone.

What leaves your phone, and when

Only if you sign in. From that moment your app data is copied to your private row in our database so it survives a lost phone and follows you to a new one.

That moment is the one where you subscribe: the introduction and the questions happen as a guest, and the answers you gave there are uploaded along with the rest once you sign in. Everything you filled in before signing in is kept — you never have to answer it twice.

Until then there is no account, no upload, and no copy of your answers on our servers.

One thing does happen without an account, and it would be misleading to leave it out: the check with the store. Seya has no free version, so from the moment you open the app it has to be able to tell whether a subscription is running — and that question goes to Apple and to RevenueCat. It carries none of your answers, none of your notes and nothing about your streak. Until you sign in, that check knows you only as a random identifier the app generated for this installation. The RevenueCat entry below says exactly what it does carry.

• Your account: the email address and, if your provider supplies one, the name attached to the Google or Apple account you signed in with.
• Your app data: the same information listed above, stored as a single record that only you can read.

The sensitive part, said plainly

Seya is about compulsive sexual behaviour. That means some of what you write — the trigger notes, the reflections, the fact that you use this app at all — counts as special category data under the GDPR (Article 9). It deserves more care than an ordinary email address, and the law agrees.

That is why signing in is a deliberate act and not the default, and why it comes as late as it can: you answer the questions as a guest, and are only asked for an account at the point where you subscribe. When you tap Continue with Apple or Continue with Google, the screen tells you that your streak, your plan and what you log along the way will be backed up to your account. That is your explicit consent, and it is the legal basis we rely on for storing this category of data.

You can withdraw it at any time by deleting your account — in Settings, or straight from the subscribe screen if that is as far as you got. That erases the server copy immediately and permanently.

Where your data is stored

Our database and authentication run on Supabase, hosted in the European Union (Ireland, AWS eu-west-1). Everything you write in Seya stays within the EU on our side.

Two things do not, and it would be misleading to leave them out: the payment itself, which Apple handles, and your subscription status, which RevenueCat manages from the United States. Neither of them receives anything you write in the app — the section below says exactly what they do get.

For that one transfer out of the EU we rely on the European Commission’s Standard Contractual Clauses, the safeguard the GDPR provides for exactly this situation. RevenueCat publishes them as part of its data processing agreement at revenuecat.com/dpa, and you can ask us for a copy at any time.

Every row is protected by row-level security: the database itself enforces that a signed-in user can only ever read or write their own record. Not-signed-in requests have no access to these tables at all. Data is encrypted in transit, and on your phone your login session is kept in the device keychain rather than in ordinary app storage.

Who else is involved

We use as few third parties as we can get away with, and none of them are advertising or analytics companies.

Each of them acts as a processor on our instructions, under a written data processing agreement that binds them to protect your data to the same standard set out in this policy. None of them may use it for their own purposes. Where a processor works outside the EU, that transfer rests on the European Commission’s Standard Contractual Clauses.

• Supabase — database, authentication and account storage (EU).
• Google and Apple — only if you choose to sign in with them. They confirm your identity to us and give us your email address. We never receive your password.
• Apple — payment processing for subscriptions, and Sign in with Apple. We never see your card details.
• Expo — delivers updates to the app’s code. When you open Seya it asks Expo’s servers whether a newer version is available, and to ask that question it sends the app version, the platform you are on and a random identifier generated for this installation. It receives nothing you put into the app: not your name, not your email address, not your streak and not a word you write.
• RevenueCat — manages your subscription status, and processes it in the United States. Its software starts when you open the app rather than when you sign in, because the app has to know whether a subscription is running before it can let you in; until you sign in it knows you only as a random identifier generated for this installation. Once you do sign in we hand it your account id — again a random string, not your name and not your email — so that your subscription follows your account instead of the phone you bought it on. Alongside that, it sends what it needs to check a purchase with the store: the receipt from Apple, the app version, your device model and the country your store account is in. It never receives your name, your email address, your streak, or anything you write in the app.

What we deliberately do not do

• No analytics or product-usage tracking of any kind.
• No advertising, and no advertising identifiers.
• No selling, renting or sharing of personal data with anyone.
• No profiling and no automated decisions with legal or similarly significant effects. The plan the app builds for you — which triggers it focuses on, which actions it suggests, what it asks you to change about your surroundings — is worked out on your own device from the answers you gave, by a fixed set of rules. Nothing about you is sent anywhere to produce it, and no artificial intelligence service is involved.
• No notifications are sent to you from our servers. The reminders — your daily check-in and the end of a free trial — are scheduled by the app on your own phone, so no push token is collected and nothing about your streak leaves the device to make one appear. The check-in reminder is timed from your own last check-in, which the app reads on the device and sends nowhere. We only ask for notification permission on a screen of its own after you subscribe, the app works exactly the same if you say no, and you can turn the reminders off at any time in your device’s notification settings.
• No tracking of whether you rated the app. Settings holds a link that opens Seya’s page in the App Store, for if you ever feel like leaving a review. We never learn whether you did, or what you wrote; nothing about your plan or your subscription depends on it, and ignoring it changes nothing.

Why we are allowed to hold it (legal bases)

• Your explicit consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR) — for storing and syncing your recovery data once you sign in.
• Performance of a contract (Art. 6(1)(b)) — for running your account and your subscription.
• Our legitimate interest (Art. 6(1)(f)) — for keeping the service secure and preventing abuse.

How long we keep it

Your account data stays for as long as your account exists. When you delete your account, your authentication record, your profile and your synced app data are deleted from our database straight away — the deletion cascades, so nothing is left behind in a side table.

The copy on your own phone is wiped in the same action. Backups held by our hosting provider roll over on their own schedule and are overwritten within 30 days.

Records of purchases are kept by Apple and by RevenueCat under their own retention rules, because we are legally required to be able to account for transactions.

Your rights

If you are in the EU or the UK you have the right to access your data, correct it, delete it, restrict or object to how we use it, receive a copy in a portable format, and withdraw consent at any time.

Deletion you can do yourself, and it takes effect immediately: Settings → Delete account, or the same link on the subscribe screen if that is as far as you got. For a copy of your data, a correction, or anything else on that list, email us and we will respond within one month.

If you think we have handled your data badly, you can complain to your national data protection authority. In the Netherlands that is the Autoriteit Persoonsgegevens.

Children

Seya is not intended for anyone under 16, and the App Store listing is rated accordingly. We do not knowingly collect data from children. If you believe a child has created an account, email us and we will delete it.

Changes to this policy

If we change how the app handles your data, we update this page and the date at the top of it. If a change materially affects what happens to information you have already given us, we will ask you again rather than assume the old answer still stands.

Contact

Rivo Systems — info@rivosystems.com