Privacy Policy

1. Who we are

Rhythmi is a personal wellbeing app that helps you build daily rhythm across three areas: Energy, Recovery and Mindset. Rhythmi is the controller of the personal data described in this policy. You can reach us at support@rhythmiapp.com.

2. Data we collect

We only collect what we need to run the app and improve your experience.

• Account data: email address, authentication identifiers, and (if you sign in with Google or Apple) the basic profile details those providers share with us.
• Profile data: display name, avatar, age, bio and preferences you enter yourself.
• Wellbeing data: your check-ins, mood and energy ratings, journal entries, goals, streaks, completed activities and derived scores such as your Life Rhythm Score.
• Health and activity data: the current version of Rhythmi does not read data from Apple Health, Google Health Connect or wearables. If we introduce such an integration later, it will only be used after your explicit consent and this policy will be updated first.
• Subscription data: your subscription status, plan and renewal dates. Payment card details are handled by our payment providers and never reach our servers.
• Technical data: device type, app version, language and basic usage events used to keep the app working and improve the product.

3. Why we use your data and our legal basis

We process your data to provide the app and the features you ask for (performance of a contract), to keep the service secure and functioning (legitimate interest), and to comply with legal obligations.

Wellbeing data you enter yourself (such as mood, energy and journal entries) may be considered special category data under Article 9 GDPR and is processed on the basis of your explicit consent, which you can withdraw at any time by deleting the data or your account.

4. Subscriptions and in-app purchases

Rhythmi Plus is offered as an auto-renewing subscription and as a one-time lifetime purchase. On the web, payments are processed by our payment provider Paddle (merchant of record). In the Android app, purchases are processed by Google Play and are governed by Google's terms; purchase status is relayed to us through our subscription partner RevenueCat. We receive the purchase status, plan identifier and renewal date so we can unlock Plus features on your account. We never receive your full payment details.

5. Sharing your data

We do not sell your personal data and we do not use your wellbeing or health data for advertising.

• Cloud backend and database hosting, used to store your account and app data securely.
• Payment and subscription providers, used to process purchases and keep entitlement in sync.
• Email delivery, used for account emails and your weekly recap (which you can turn off at any time).
• Reminders: in the Android app, reminders are scheduled locally on your device; on the web, browser notifications are delivered through your browser's push service.
• Product analytics (PostHog, EU hosting), only where enabled, used to understand usage in aggregated form.
• Other users only where you choose to share, for example when you share an exercise link.

6. International transfers

Some of our providers process data outside the European Economic Area. Where that happens, transfers are covered by appropriate safeguards such as the European Commission's Standard Contractual Clauses.

7. How long we keep your data

We keep your account and app data for as long as your account exists. When you delete your account, your personal data is deleted immediately. Purchase records kept by Google Play or Paddle are retained by them as required by tax law, and if you unsubscribed from emails we keep your address on a suppression list so we never email you again.

8. Deleting your account

You can delete your account at any time in the app via Profile → Settings → Legal & Account → Delete account. Without the app, visit https://app.rhythmiapp.com/delete-account or email support@rhythmiapp.com. Deleting your account does not cancel a Google Play subscription; cancel it in Google Play.

9. Security

Data is encrypted in transit and at rest. Access to your records is restricted at the database level so that only you (and, where you explicitly share it, people you invite) can read your data. We review our security posture regularly.

10. Your rights

Under the GDPR and comparable laws you can request access to your data, correction, deletion, restriction of processing, portability, and you can object to processing based on legitimate interest. Where processing is based on consent, you may withdraw it at any time without affecting prior processing.

To exercise any of these rights, contact support@rhythmiapp.com. You also have the right to lodge a complaint with your local data protection authority.

11. Children

Rhythmi is not intended for children under 16. We do not knowingly collect data from children under 16. If you believe a child has provided us with personal data, contact us and we will delete it.

12. Not medical advice

Rhythmi supports general wellbeing. It does not diagnose, treat or prevent any medical condition, and it is not a substitute for professional medical advice.

13. Changes to this policy

We may update this policy as the app evolves. Material changes will be announced in the app before they take effect, and the effective date above will be updated.