Who we are

Vektorsion is a reflection app for adults 18 and older, operated by Riversmythe LLC. Contact privacy@vektorsion.com for privacy questions and requests. This policy covers the app, its subscriptions and app-related support. Visits to vektorsion.com, including these policy pages, are covered separately by the Website Privacy Policy and its cookie choices at https://vektorsion.com/privacy-policy/. If we learn that a minor has provided personal information contrary to our age requirements, we take appropriate steps to remove it, subject to legal obligations.

Your Practice and account

Readings, reflections, experiments and saved conversations stay on your device unless you choose a feature that sends them elsewhere. An account is optional for free local reflection. Temporary Conversations are not saved to Your Practice unless you choose to keep them; they still involve AI processing. Device or browser backups may retain local copies.

For sign-in, Supabase processes your account identifier, email and authentication information. Apple or Google can provide an identifier, name, email and basic profile information when you choose their sign-in. Resend delivers sign-in emails. Automatic Sync uploads saved Practice to Supabase only after you enable it on that device. Signing in or subscribing does not itself enable Practice sync. Pausing sync stops future automatic syncing; it does not erase existing cloud copies.

Optional AI features

AI responses come from software, not a human. When you request AI assistance, relevant text and context pass through our server to OpenAI, including automated safety processing. This can include prompts, selected readings, reflections, experiments and relevant conversation history, including past reflections you choose as context. We ask permission before the first AI request in an app session. You can decline and continue without AI. Avoid including information you do not want processed by these services; your words can identify you.

OpenAI states that API inputs and outputs are not used to train its models by default unless the customer opts in. This does not mean zero retention: provider security, abuse-monitoring and legal retention may apply.

Subscriptions

Apple or Google Play processes payment details. RevenueCat processes your Vektorsion account identifier, purchase history, subscription status and device/store metadata to verify purchases, restore access, administer subscriptions and provide subscription reporting. Metadata can include device/operating-system information, connection times, country, locale and currency. This data is linked to your account. RevenueCat can receive a randomly generated SDK identifier and device/store metadata before sign-in so we can display subscription offers. When you sign in, RevenueCat associates subscription access with your Vektorsion account identifier. These requests can occur even without a completed purchase. We do not send your reflection text as RevenueCat customer attributes or receive your full payment-card number from store checkout.

Reports and support

An AI-content report includes the response you select, your reason and optional details. You can redact text before sending. Reports are stored separately for safety review; account identity and other messages are not automatically attached. The text you submit can still identify you. Keep the report receipt if you want us to locate or delete a report. Support correspondence includes your email and what you choose to send. Bluehost and Microsoft provide support-email services.

Usage, diagnostics and service operations

Optional usage and diagnostic sharing with Expo EAS Observe is off by default. You can allow or stop it in Privacy & Data on each device without affecting Premium access. When enabled, it includes installation identifiers, app/device information, screen names, timings and feature counts. Product events exclude private reflection and conversation text; diagnostics can include error messages and stack traces. Stopping sharing does not erase information already sent.

Vercel hosts our server; Upstash supports request counters, abuse prevention and a temporary encrypted cache of AI responses. The cache lets a retry recover the same response without another allowance charge. Cached responses expire automatically within 15 minutes; request prompts are not stored in this cache; Supabase also stores submitted reports. These providers and our authentication and delivery services process necessary technical information, such as IP addresses and operational logs, for delivery, security and reliability. Necessary account, purchase, requested AI and security processing is separate from optional diagnostics. Reflection reminders are scheduled locally. We do not sell personal information or share it for cross-context behavioral advertising. Signing in or subscribing does not opt you into promotional email. We do not use browser Do Not Track signals to change these app practices.

Security and other disclosures

We use encrypted network connections and access controls. Authorized access is limited to service operation, support, safety, security and legal needs. No system guarantees absolute security. Providers may process information in the United States and other countries where they operate, subject to applicable transfer requirements. We may disclose necessary information to comply with law, protect rights or address fraud or safety threats. A business transfer involving service data remains subject to applicable law and notice.

Retention and deletion

We retain your account and synced Practice until deletion. We aim to remove raw safety reports 90 days after submission and support correspondence 90 days after closure. Optional Observe records may remain for up to 120 days; aggregate app billing counts can remain afterward. Subscription records are kept as needed to administer purchases and access and are included in verified personal-data deletion requests. Limited transaction, security or legal records may be retained when necessary for fraud prevention, financial or legal obligations, or legal claims. Provider backups, security logs and recovery copies can persist under their separate retention schedules and obligations. These exceptions do not authorize keeping all private reflections indefinitely.

Use Account > Delete Account or email privacy@vektorsion.com. Requests cover the account, synced Practice and associated service-provider personal data, subject to lawful exceptions. We verify ownership and explain any information retained. Erase device copies separately in Privacy & Data on each device; cloud copies remain after device-only erasure. Deleting an account does not cancel an Apple or Google Play subscription. Stores retain their own transaction records under their policies and legal obligations. Restoring or repurchasing can create new purchase records, without restoring deleted reflections.

Your choices and policy updates

You may request access, a copy, correction or deletion of your information by emailing privacy@vektorsion.com. Depending on applicable law, you may also have portability, objection or appeal rights. We verify only what is reasonably needed, respond within applicable legal periods, explain any lawful refusal and available appeal route, and do not discriminate for exercising applicable rights. You can stop using AI, pause sync and withdraw optional diagnostics sharing. We will date policy updates and notify you of material changes as required. A revised policy does not replace consent required for a new use.