Privacy Policy

This Privacy Policy (the "Policy") explains how we collect, use, share and protect your personal data when you use Reya, including our mobile application and our website myreya.app (together, the "Service").

The Service is an entertainment and self-reflection product. It does not provide medical, psychological, legal, financial or other professional advice.

Based on the answers you give in our questionnaire and the birth details you provide, it generates personalised content for you, including an illustrated sketch, astrological readings and related reports, and other features. To learn more, refer to our Terms and Conditions.

This Policy should be read together with our Terms and Conditions. By creating an account or using the Service, you confirm that you have read this Policy.

The Service is intended solely for users aged 18 and over.

The controller of your personal data is:

Tarfion Ltd

Griva Digeni 59, Kaimakliotis Building, 5th Floor, 6043 Larnaca, Cyprus

Contacts: [email protected]

3.1 Data you provide

Some questionnaire answers may indirectly reveal information about your personal life or preferences. You may skip questions you feel uncomfortable with.

What we do not collect:

• We do not use facial recognition, a scan of face or hand geometry, or any other biometric identifier or biometric information from the photos you provide. Your palm photo is read for the pattern of its lines, and your portrait only for its dominant colour. Neither is matched against particular user, nor with any database.
• We do not ask for or knowingly collect data about your sexual life or sexual activity.
• We do not collect precise GPS location.
• We do not receive or store your card number. Purchases made in the App are processed by Apple and Google; purchases made on our website are processed by our payment provider, which handles your card details under its own privacy policy. In both cases we receive only transaction and subscription status data.

3.2 Data the Service collects automatically

iOS App Tracking Transparency

On iOS 14.5 and later, we use Apple's App Tracking Transparency (ATT) framework. When you first open the App, you will see a system prompt asking permission to track your activity across other companies' apps and websites. This ATT prompt is separate from the App permissions described in Section 3.3, which are requested later, at the moment you use the feature that needs them.

• If you allow tracking: We may access your IDFA (Identifier for Advertisers) to measure ad effectiveness and share data with advertising partners (Meta, Google) for attribution and retargeting purposes. For more context, refer to Section 5 below.
• If you decline tracking: We will not access your IDFA. All App features remain available, but advertising measurement will be limited and ads on other platforms will be less personalized.

You can change your tracking choice at any time in your device settings.

The App uses Software Development Kits (SDKs) and similar tracking technologies that serve purposes equivalent to web cookies. These technologies allow us to recognize your device, measure App performance, and deliver relevant advertising.

3.3 On-device processing and permissions

Your birth chart stays on your device. When you enter your city of birth, the name of that city is sent to Apple's geocoding service (CLGeocoder) to be converted into coordinates; Apple processes it under its own privacy policy. The chart itself is calculated locally on your device.

Photos. Your palm photo and portrait are analysed on your device using Apple's Vision framework, the image analysis model built into iOS. The images are not sent to us for this analysis, except where it is needed for debugging.

AI features — Apple's on-device generative models, built into iOS, are used for image generation and content generation.

Permissions. Reya may ask for camera permission and notification access at the moment you use the feature that needs them, on a screen explaining why. Each one is optional: if you decline, only that feature is unavailable and the rest of the App works normally.

3.4 Cookies and similar technologies (website)

On myreya.app we use cookies and similar technologies. Some are strictly necessary to run the site, keep you signed in and keep it secure, and these are always active. The rest are optional and are used for analytics and for advertising.

When you first visit the site from a region where consent is required, we show a cookie banner. Optional cookies are not set until you accept them. You can accept or reject each category separately, and you can change your choice at any time through the cookie settings link in the site footer.

We also honour the Global Privacy Control (GPC) signal. If your browser or a browser extension sends a GPC signal, we treat it as a valid request to opt out of the sale or sharing of your personal information under the CCPA/CPRA and comparable US state laws, and we automatically disable advertising and measurement cookies for that browser without you needing to contact us.

• Performance of a contract — creating your account, generating your sketch, charts and reports, running the AI assistant, processing purchases, providing customer support.
• Consent — permissions for Reya features at the moment of processing (see Section 3 above), marketing messages, advertising identifiers and attribution, and any optional data you choose to provide.
• Legitimate interests — security, fraud prevention, internal product analytics, improving the Service, enforcing our Terms.
• Legal obligation — tax and accounting records, age restrictions, responding to legal requests and handling complaints.

We do not sell your personal data. We share it only with service providers, including SDKs, who process it on our behalf under the respective contract and following privacy commitments, and only as needed:

• Hosting and infrastructure — Google Cloud (Cloud Run, Cloud SQL), Cloudflare (DNS, TLS, CDN)
• Analytics and crash reporting — Sentry, Google Cloud logs and metrics, BigQuery
• Attribution and marketing measurement — Meta, Google, where you have allowed tracking
• Authentication — Firebase Authentication

We may also share data with:

• Law enforcement and authorities: when required by law, legal process, or to protect user safety.
• Affiliates and corporate entities: for internal operations, auditing, and in the context of mergers, acquisitions, or corporate restructuring. In such cases, the acquiring entity will be bound by the terms of this Policy.

Please note: your sketch, charts, reports and assistant conversations are private to your account. Reya has no user-to-user features and does not publish your content. We do not disclose photos to advertising or analytics partners listed in this Section.

In most cases, your data is processed within the territory of the European Economic Area (EEA). When we transmit your personal data beyond the EU/EEA, we rely on Standard Contractual Clauses approved by the European Commission, or, where a recipient is certified under it, the EU-US Data Privacy Framework, together with contractual confidentiality obligations. The underlying health measurements on your device are not transferred anywhere; where a derived indicator is transferred, the same safeguards apply to it.

All and any transfer of the personal data is done only for the purposes specified in this Policy and the Terms of Use.

We keep your data only as long as needed, particularly:

• Account, birth data, questionnaire answers, generated content and AI assistant history - while your account is active, and deleted within 30 days of deletion request.
• Photos - we will retain on our servers up to 1 hour for debugging purposes.
• Technical logs and diagnostics - up to 90 days.
• Support correspondence - up to 3 years.

We may retain certain types of Account, Technical logs and Support correspondence data beyond the periods above where we still need it for lawful purposes: to establish, exercise or defend legal claims; to handle a complaint, dispute, audit or investigation; and to comply with a legal, regulatory, or accounting obligation; or to prevent, detect and address fraud, abuse, or security incident.

We may also keep aggregated (the data that does not contain personal identifiers) for internal analytics and statistics, as well as to evaluate our products.

8.1 Deleting your account

You can delete your account and all associated data at any time in the app settings.

You can also delete your account by email: write to [email protected] and we will process your request.

Please note: Deleting your account does not automatically cancel a subscription. If you subscribed through Apple or Google, cancel it in your App Store or Google Play account settings. If you subscribed on our website, cancel it in your account settings on the website or by writing to support.

8.2 EU/EEA Rights (GDPR)

If you are in the European Economic Area, you have the following rights:

8.3 UK Citizens Rights Under UK GDPR Addendum

This section provides details about individuals residing in the United Kingdom and details additional rights they have under the United Kingdom Data Protection Act 2018 (DPA) and the EU General Data Protection Regulation (GDPR) which is retained EU law after Brexit. Therefore, this section applies only to UK residents.

Your Rights and Choices in the UK

As a UK resident, You have the rights in relation to Your Personal Data under this Privacy Notice, including:

Right to be informed: You have the right to be provided with clear, transparent, and easily understandable information about how we use your personal data and your rights. This is why we’re providing you with the information in this Addendum.

Right of access: You have the right to obtain access to your personal data (if we’re processing it) and certain other information (similar to that provided in this Privacy Notice). This is so you’re aware and can check that we’re using your personal data in accordance with data protection law.

Right to rectification: You are entitled to have your personal data corrected if it’s inaccurate or incomplete.

Right to erasure: This is also known as ‘the right to be forgotten’ and, in simple terms, enables you to request the deletion or removal of your personal data where there’s no compelling reason for us to keep using it. This is not a general right to erasure; there are exceptions.

Right to restrict processing: You have the right to ‘block’ or suppress further use of your personal data in certain circumstances. When processing is restricted, we can still store your personal data, but may not use it further.

Right to data portability: You have the right to obtain and reuse your personal data in a structured, commonly used, and machine-readable format in certain circumstances. In addition, where certain conditions apply, you have the right to have such information transferred directly to a third party.

Right to object to processing: You have the right to object to us processing your personal data for our legitimate interests or for direct marketing purposes (including in each case any related profiling).

Right to withdraw consent: If we have obtained your consent to process your personal data for certain activities (for example, for optional features that rely on your consent), or consent to market to you, you may withdraw your consent at any time.

Rights related to automated decision-making and profiling: You have the right not to be subject to a decision when it’s based on automatic processing, including profiling, if it produces a legal effect or similarly significantly affects you, unless such profiling is necessary for entering into, or the performance of, a contract between you and us.

To exercise any of these rights at any time, please contact our Customer Support.

8.4 US Rights (CCPA/CPRA and State Privacy Laws)

If you are a resident of California or another US state with applicable privacy legislation, you have the following rights:

Right to Know — request details about categories and specific pieces of personal information we collect, purposes, sources, and third-party recipients.

Right to Delete — request deletion of your personal information, subject to certain legal exceptions.

Right to Correct — request correction of inaccurate personal information.

Right to Opt-Out of Sale/Sharing — opt out of the "sale" or "sharing" of your personal information as defined under applicable law.

Do Not Sell or Share My Personal Information

We may share certain personal information with advertising partners for purposes of targeted advertising. Under the CCPA/CPRA and similar state laws, this may constitute a "sale" or "sharing" of personal information. If you want to exercise Do Not Sell or Share My Personal Information, contact our Customer Support with subject line "CCPA Opt-Out Request". On our website you can also opt out without contacting us, either through the cookie settings link in the footer or by sending a Global Privacy Control signal from your browser, which we honour automatically as described in Section 3.4.

California also provides its residents with additional access rights. Under Shine the Light law, the residents may ask companies once a year what Personal Data they share with third parties for those third parties' direct marketing purposes.

To obtain this information from us, please send an email message to our Customer Support, which includes “Request for California Shine the Light Privacy Information” on the subject line and your state of residence and email address in the body of your message. Please be aware that not all information sharing is covered by the “Shine the Light” requirements and only information on covered sharing will be included in our response.

These rights also apply, to the extent provided by their respective laws, to residents of: Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Texas (TDPSA), and Oregon (OCPA).

8.5 Marketing

You can unsubscribe from marketing emails using the link in any marketing e-mail. You can turn off push notifications at any time in your device settings.

We use encryption in transit and at rest, access controls, and regular review of our systems. No service can guarantee absolute security, but if a breach is likely to result in a high risk to your rights and freedoms, we will notify you and the relevant authority without undue delay.

The Service is for users aged 18 and over only. We do not knowingly collect data from anyone under 18. If we learn that a user is under 18, we will close the account and delete the data. If you believe a minor is using the Service, contact us at [email protected].

Reya is in active development and our features will change. We will update this Policy accordingly. For material changes we will notify you by email or in-app notice before they take effect, and will ask for renewed consent where the law requires it.