iReject Privacy Policy

1. Who is responsible

iReject is a self-help app for emotional detox and breakup recovery. It is developed and published by Sagar Singh, an individual developer based in India, under the developer name “Myx”. iReject is not published by a company.

In this policy, “I”, “me” and “my” mean Sagar Singh. I decide how the information described here is used and I am responsible for it. Under India’s Digital Personal Data Protection Act, 2023 I am the “data fiduciary”, and under the GDPR I am the “data controller”. I am also the grievance contact for iReject.

2. Your account

On first launch iReject signs you in anonymously. That gives you an account ID and nothing else: no email, name or phone number.

If you choose Save progress to an account, you add an email address and password. The password is handled by the authentication provider and stored only as a hash. The email is used to sign you in, to recover your account and to reply when you write to me. It is never used for marketing.

3. What you write

This content is stored with your account so it survives a reinstall and syncs to a new device:

• journal entries, with mood and any prompt used;
• unsent messages written in Talk to Ex, which are never sent to anyone;
• conversations with the AI listener;
• the first name you give and your onboarding answers, such as why the relationship ended, when you last had contact, how you feel and how you heard about the app;
• the text and tags of anchors you save;
• your rules, streak, reset dates, completed tasks, game progress, badges and weekly insights.

Some of this describes your emotional state and relationships, which laws such as the GDPR can treat as sensitive. The app asks for your explicit consent before you start, and this content is used only to run the features you use. It is never used for advertising or profiling.

4. What stays on your phone only

• The photo of your ex, and any photo or screenshot you attach to an anchor. These are copied into the app’s private storage and are never uploaded.
• Your reminder times and notification settings.
• The streak shown on your home-screen widget.

The app uses your camera or photo library only when you tap to add a photo, and only through the system picker.

5. The AI listener

When you talk to the AI listener (Bestie), the messages in that conversation and a short progress summary (day count, first name and streak state) go to my server, which sends them to Anthropic’s API to generate a reply. Under its commercial terms, Anthropic does not use this data to train its models. It may keep the data for a limited period for safety and legal compliance.

Replies are generated by AI, are not reviewed by a person and can be wrong. If a message looks like a crisis, the app shows helpline information instead of a chat reply. iReject is not therapy, counselling or a crisis service. If you are in danger, contact your local emergency number.

6. Usage analytics

The app records simple product events, such as a screen being opened or a task being completed, with your account ID and a timestamp. These events are sent to my own database, not to a third-party analytics company. They never contain the text of anything you write.

7. Subscriptions

Purchases go through the App Store or Google Play and are managed by RevenueCat, which receives your account ID and the store’s purchase records. I receive only your subscription status. I never see your card details or store account credentials.

8. Notifications

Reminders are scheduled and generated on your device. No server sends them to you. If you deny notification permission, the rest of the app still works.

9. Legal bases

• Contract: storing and syncing your content, generating AI replies and unlocking purchases.
• Explicit consent: the sensitive details about feelings and relationships you choose to share.
• Legitimate interests: privacy-respecting analytics, preventing abuse and keeping the service secure.
• Legal obligation: where the law requires records or disclosure.

Under India’s DPDP Act, processing is based on the consent you give when you start using the app. You can withdraw consent by deleting your account.

10. Service providers

• Supabase: database, authentication and server functions.
• Anthropic: generates the AI listener’s replies.
• RevenueCat: subscription management.
• Apple: App Store distribution, payments and iOS notification delivery.
• Google: Google Play distribution and payments.

I do not sell personal information, share it for cross-context behavioural advertising, or pass it to data brokers or advertisers. I disclose data only when legally required, and I will tell you when I am allowed to.

11. How long data is kept

Your content is kept while your account exists. When you delete your account, your profile, streak history, journal, unsent messages, anchors, conversations, badges, insights, subscription record and analytics events are deleted from my database straight away, and this cannot be undone. Copies may stay in encrypted provider backups for up to about 30 days before those backups expire. App stores and RevenueCat keep purchase records as tax law requires.

12. Your rights and choices

In the app you can read, edit and delete anything you have written, use the app without an email address, and delete your account and all data from Profile → Delete account and all data. You can also request deletion without the app: contact me from the address on your account, or with enough detail for me to find it.

Depending on where you live, you may also have the right to:

• access the personal data I hold about you and get a copy in a portable format;
• correct information that is wrong or incomplete;
• have your data erased;
• restrict or object to certain processing;
• withdraw consent where processing is based on consent;
• nominate someone to exercise your rights if you die or become unable to (India).

To make a request, contact me. I will reply within 30 days and may need to confirm that the data is yours first. If you are not satisfied with my answer, you can complain to the Data Protection Board of India or, in the EEA or UK, to your local data protection authority.

13. Security

Traffic is encrypted with TLS, database access is restricted to your account by row-level security, release builds are obfuscated and the app contains no server secrets. No system is completely secure, but if a breach affects your data I will notify you and the relevant authorities where the law requires.

14. Children

iReject is not intended for anyone under 18 because it handles sensitive emotional information. I do not knowingly collect personal information from anyone under 18. If you believe a child has provided information through iReject, contact me and I will delete it.

15. Where your data is processed

I am based in India. The service providers named above may store or process data in other countries, including the United States and the European Union. Where data leaves the EEA or UK, the transfer relies on safeguards such as the European Commission’s Standard Contractual Clauses in the provider’s terms.

16. Changes to this policy

If I change this policy, I will update the date at the top of this page. For significant changes I will also let you know in iReject before they take effect.

17. Contact

For questions about this policy, data requests or complaints, contact me by email. I built the app, so I will answer your message myself.

Sagar Singh (developer “Myx”), India