Privacy Policy
This policy explains how Spry Labs ("we", "us") handles personal information in A Player Mode: the iPhone and Android apps, the web app, and the services behind them ("APM"). The short version: we collect what APM needs to plan your days, we never sell your data, AI providers may not train on it, and you can export or delete it in the app at any time.
1. What we collect
- Account details: your email address, and the identifier from Sign in with Apple or Google if you use them. Sign-in by email uses a one-time code; we do not store passwords.
- What you tell APM: your setup answers (goals, routines, values, boundaries, wake time, life areas), daily check-ins and close-outs, mood and energy levels you choose to record, diary entries, coaching conversations and weekly reviews. Some of this can be sensitive (for example, health or fitness goals you choose to share). We use it only to provide APM to you. Health information is collected only with your separate consent; our Consumer Health Data Privacy Policy lists exactly what it covers and how to withdraw.
- Connected accounts (only if you connect them):
- Google: calendar read (
calendar.readonly) and event creation (calendar.events); Gmail read (gmail.readonly), drafts (gmail.compose) and send (gmail.send). - Microsoft:
Calendars.Read/Calendars.ReadWrite,Mail.Read/Mail.ReadWrite/Mail.Send, andoffline_accessto stay connected. - Your phone's calendar, read on the device only for the calendars you choose.
- Google: calendar read (
- Subscription status: your plan, store (App Store or Google Play), renewal and expiry dates, from RevenueCat. We never receive your card or bank details; Apple and Google handle payment.
- Device and usage data: a push-notification token if you allow notifications, your time zone, app version, and product events (which screens and steps were used, and timings). Product events never contain the text you write.
- Security logs: an audit record of sign-ins, permission changes and every action APM takes on your behalf, so you can see them in Settings → Privacy → Activity.
2. How we use it
- To provide APM: build your plan, print each day's agenda, run check-ins, weekly reviews and coaching, send the reminders you turn on, and take the actions you approve or allow under Autopilot.
- To keep your plan in step with your subscription.
- To keep APM secure, prevent abuse, and fix problems.
- To improve APM using aggregated, de-identified product events. We do not use your private content (answers, diary, email, calendar, coaching messages) to train AI models, and we do not allow our AI providers to.
- To contact you about your account, security, and changes to these policies.
We do not sell or rent your personal information, we do not share it for cross-context behavioural advertising, and APM shows no ads.
3. AI processing
Some features send the relevant part of your data to an AI model to produce a plan, a coaching reply or a draft. These requests go through OpenRouter to model providers we have approved. For private data we require providers that do not train on it and do not retain it (OpenRouter's "data collection: deny" and zero-data-retention settings), and we send only what the task needs. Several features (for example, the built-in coaching steps) run without any AI model; the app says so. Settings → Privacy → How AI works shows which features use AI.
4. Who we share it with
We share personal information only with service providers that process it for us under contract, only to run APM:
- Supabase (database and sign-in), with your data stored in the United States.
- Cloudflare (the APM API and web app hosting).
- OpenRouter and the approved AI model providers it routes to (see section 3).
- RevenueCat, Apple and Google (subscriptions and purchases).
- Google and Microsoft, only for the accounts you connect, to read and act on your calendar and email as you allow.
- Expo, Apple and Google push services, to deliver notifications you turn on.
We may also disclose information if the law requires it, to protect someone's safety, or as part of a merger or sale of the business (in which case this policy continues to apply to your data).
5. Google user data
APM's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google data is used only to provide the calendar and email features you see in APM, is never used for advertising, is never sold, and is never used to train AI models. People at Spry Labs do not read it unless you ask us to for support, it is needed for security, or the law requires it.
6. How long we keep it
- Your plan, goals, history and diary: for as long as you have an account, until you change or delete them.
- Connected-account tokens: until you disconnect the account or delete your APM account.
- Raw email and calendar content: only as long as needed to derive the facts APM uses.
- Security and action audit records: as long as needed for security and legal purposes.
- When you delete your account, we delete your data from our active systems; residual copies in encrypted backups expire on the providers' backup schedules.
7. Your choices and rights
- Export: download a copy of your data any time in Settings → Privacy → Export & Delete.
- Delete: delete your account and all of its data in Settings → Privacy → Export & Delete. Deleting your account does not cancel a store subscription; cancel that in your App Store or Google Play settings.
- Correct: edit your answers, goals and settings in the app.
- Disconnect: remove a Google or Microsoft connection in Settings → Privacy → Connections, or from your Google or Microsoft account.
- Notifications: turn them off in Settings or in your phone's settings.
- Health data consent: give or withdraw it in Settings → Privacy → Consumer health data (see the Consumer Health Data Privacy Policy).
Depending on where you live (for example, California or the EU/UK), you may have rights to access, correct, delete, port or restrict use of your personal information, and to complain to a data-protection authority. Use the in-app controls above or email support@aplayermode.com; we will not treat you differently for exercising them. If you are outside the United States, your data is transferred to and processed in the United States.
8. Security
Data is encrypted in transit, connected-account credentials are encrypted at rest, database access is limited per user by row-level security, and every action APM takes for you is logged. No system is perfectly secure; if we learn of a breach affecting your data we will notify you as the law requires.
9. Children
APM is for adults 18 and over, and asks you to confirm you are 18 or older before an account is created; we keep a dated record of that confirmation. We do not knowingly collect information from children. If you believe a child has given us information, contact us and we will delete it.
10. Changes
We will update the "Last updated" date when this policy changes and tell you in the app or by email before a material change takes effect.
11. Contact
Spry Labs · support@aplayermode.com
Consumer Health Data Privacy Policy · Terms of Service · Open A Player Mode