Privacy Policy

The controller is ByteGuard S.L., established in Spain, and its full statutory identity is published in the legal notice. For anything related to privacy — access, deletion, objection, a question about a specific processing operation — write to [email protected]. We have not appointed a data protection officer, and we do not claim to be exempt from doing so: if that changes, this section changes with it.

Some of it you give us, some is produced as you use the service. The public demo on the website is different: what you paste or upload there is processed in memory for that single request and no file and no history is created.

• Account: email address, name, sign-in provider, country and app version.
• Preferences: style, gender, language, age, type of relationship, goals and your custom prompt.
• Content you submit: chat screenshots, conversation text, full chat exports in Analyse, messages to Coach and messages to support.
• Use and billing: generations, credits, ads watched, plan, purchases and renewals.
• Device and technical data: device identifiers, app version, and your IP address in server logs, promo-code redemptions and administrative access logs.

Different parts of the service rest on different legal grounds under article 6 of the GDPR.

• Performance of the contract: your account, the generations you ask for, your history, subscriptions, credits and service communications.
• Legitimate interest: third-party data contained in the screenshots and exports you upload, security and anti-fraud, and product analytics inside the app (see the section on advertising and analytics).
• Consent: rewarded advertising where the law requires it, marketing communications, and all website analytics.
• Legal obligation: accounting and tax records for purchases.

The generations are produced today by Google's Gemini models, reached either directly or through the Vercel AI Gateway. What travels is the screenshot or the text you submit, the style and gender you selected, your custom prompt, and — in Coach — a profile of your way of writing derived from your recent generations. Your email address, your name, your user id and your IP address are not sent. Be aware that a screenshot carries whatever it carries: the other person's name, their photo, their phone number. The gateway's request cache is enabled, so that content may be stored temporarily in its infrastructure. We do not train our own models on your content.

The person on the other side of the conversation never agreed to anything, and we take that seriously. We store their messages as part of your generation and, in Analyse, their display name, whole-conversation metrics and literal quotes from what they wrote. That data is used only to produce the result you asked for: it is never cross-referenced between users, never used to build a profile of that person, and we never contact them. The legal basis is our legitimate interest in providing the service you requested, balanced against the impact on them; because notifying each of those people individually would require a disproportionate effort, article 14.5.b of the GDPR allows this public notice to take the place of individual information. If you are that person, you can write to [email protected] to exercise your rights, even without an account.

Every provider below receives only what is listed, and each one is bound to process it on our instructions.

• Google (Gemini) and Vercel AI Gateway: the generations, as described above.
• Discord: today it receives your name and your email address when you sign up and every time a reply is generated. It is an internal alerting integration with no consent gate, and messages already sent are not retracted when you delete your account. We are working to remove those identifiers from the alert.
• PostHog (hosted in the European Union): in the app it receives your id, email, name, gender, country, plan and credit balance, together with usage events and uncaught errors; on the website only pseudonymous events and only after you accept analytics. Session replay is off in both.
• Google AdMob: rewarded video ads for free users, receiving the device's advertising identifier and request data.
• Firebase (Google) and the TikTok Business SDK: analytics and install attribution in the mobile app.
• RevenueCat and Stripe: subscriptions and payments; Stripe also receives your email address for purchases made on the web.
• Apple, Google and Meta: sign-in only, limited to the identifier, name and email you authorise.
• Resend: delivery of the emails carrying your login code or link.
• Linear: when you send feedback, a ticket is created containing your email, id, name, plan and the full text of your messages. Deleting your account does not delete that ticket.
• Expo: push notifications, receiving your device token and the notification content.
• Cloudflare Turnstile: abuse prevention in the public demo, which exposes your IP address to Cloudflare.
• Google Analytics and Microsoft Clarity: measurement of the public pages, only after your consent. Clarity records interaction with the page.

Product analytics starts when the app opens, without asking you first and with no off switch in Settings, and it sends PostHog your id together with your email and your name. Rewarded ads are requested from AdMob in personalised mode and the app shows no advertising consent form in the EEA: on iOS only the system tracking prompt stands in the way, and on Android nothing does. We rely on legitimate interest for product analytics in the meantime, we are reviewing this, and we will update this policy when it changes. You can object at any time by writing to [email protected], and you can limit tracking in your device settings.

Some of our providers process data outside the European Economic Area. Where that happens we rely on the mechanisms of Chapter V of the GDPR — standard contractual clauses, or the EU-US Data Privacy Framework where the provider is certified. PostHog runs in its European region. For the others we do not assert a fixed processing location here, because it depends on each provider's active contract; write to [email protected] and we will tell you which mechanism applies to a specific provider.

Most content lives as long as your account: there is no fixed automatic expiry for uploads, history or analyses. Session tokens last 8 hours for access, with a rotating refresh token; email login codes expire after 24 hours; the account-deletion record is kept for 365 days. Deleting your account from Settings immediately removes the account itself, your generation history and its content, your uploads and their files, credits and movements, ad sessions, push tokens and sessions.

• Not yet reached by that automatic deletion: Coach conversations, Analyse analyses, feedback threads and their Linear ticket, promo-code redemptions (which include a device identifier and an IP address), passkeys, the device roster, prize-draw entries and notification state.
• Those are deleted on request: write to [email protected] and we remove them.
• Messages already sent to Discord are not retracted automatically.

Traffic travels over TLS, passwords are stored hashed with bcrypt, access tokens expire after 8 hours and refresh tokens rotate with reuse detection, and rate limiting and upload validation guard the endpoints. You should know two things we do not hide: screenshots are stored on the server disk without an additional application-level encryption layer, and our administrative staff can access generation content for support and moderation. Every one of those accesses is logged with who did it, when, from which IP address and on which account.

You have the right to access your data, to have it corrected, to have it erased, to receive it in a portable format, to object to processing based on legitimate interest, to ask for processing to be restricted, and to withdraw a consent you gave at any time without affecting what was done before. Write to [email protected] and we will reply within one month. If you believe we have handled your data badly, you can complain to the Spanish Agencia Española de Protección de Datos (www.aepd.es) or to the supervisory authority of your own country.

Cookies and local storage on rizr.me are described in detail in the cookie policy, which is where you also change your decision. The contractual minimum age is 17 and we do not verify it with identity documents; when we learn that an account belongs to a younger person we close it, and a parent or guardian can write to [email protected]. We do not take decisions based solely on automated processing that produce legal effects or similarly significantly affect you within the meaning of article 22 of the GDPR — a generated reply is a suggestion you are free to ignore. In the event of a personal data breach we notify the Agencia Española de Protección de Datos within 72 hours and, when the risk to you is high, we tell you without undue delay.

The CCPA as amended by the CPRA and the comparable laws of Colorado, Connecticut, Texas, Virginia and other states give you specific rights. In the statutes' own vocabulary, we process identifiers, commercial information, internet or network activity, content you provide, inferences and, potentially, sensitive personal information. We do not sell personal information for money. However, sharing device and advertising identifiers with Google AdMob and TikTok for personalised advertising qualifies as a share for cross-context behavioural advertising, and you may opt out through your device settings or by writing to [email protected]. Sensitive information is used only to provide the service you asked for. You have the right to know, access, correct, delete, port and opt out, to appeal a decision we make, and not to be discriminated against for exercising any of them. We honour the Global Privacy Control signal on our website. Under California's Shine the Light law: we do not share personal information with third parties for their own direct marketing purposes.

When this policy changes materially we announce it in the app or by email before the change takes effect, and the date at the top always tells you which version you are reading. For any question, request or complaint about your data, write to [email protected].