Privacy Policy

1. Scope and operator

This policy covers the public Iara iOS app and the Iara website. The verified legal name of the service operator must be configured before public release; until then, the release is blocked.

Iara is a note-first relationship assistant. The public iOS v1 does not import contacts or location, process payments, sell subscriptions, coordinate group gifts, or send messages to other people automatically.

2. Data the iOS app handles

• The original notes you write and the details they contain about you and people in your life.
• Relationship context inferred from those notes, assistant responses, corrections, reminders, outreach drafts, action receipts, and deletion status.
• An anonymous device identity, consent receipt, app preferences, push-installation identifier, APNs token, locale, and notification privacy choice.
• Privacy-minimized operational records such as build, event outcome, error code, trace ID, and turn ID. Raw relationship content is excluded from default logs and traces.
• The website may process page and campaign events through PostHog or Meta only when the corresponding deployment configuration is enabled. Website analytics are separate from the native app privacy declaration.

3. AI processing and purposes

Before the first note is transmitted, the app asks for explicit consent to server and third-party AI processing. If you decline or later revoke consent, new notes are not sent for AI processing and the core AI experience remains unavailable until you consent again.

With active consent, Iara sends note and relationship context to its server and to OpenAI to organize relationship memory, understand requests, and compose assistant responses or editable outreach drafts. Iara keeps original notes, inferred context, and actions distinguishable so that you can inspect and correct them.

4. Service providers and disclosures

• OpenAI processes content required for the requested AI operation.
• Braintrust receives minimized decision and performance traces. Raw notes are off by default and may be enabled only for a time-bounded incident under operational controls.
• Railway and PostgreSQL infrastructure host Iara services and account data.
• Cloudflare R2 may store Iara-controlled objects associated with the anonymous identity; the public native v1 does not promise media import.
• Apple Push Notification service receives the delivery token and a name-only or generic alert. Push payloads do not contain notes, reasons, relationship details, or suggested openers.
• Iara does not sell native-app relationship content or use it for cross-app tracking.

5. Retention and deletion

Iara-controlled original notes, derived context, receipts, and account records are kept until you request permanent deletion. Deletion is server-first and resumable: if processing is interrupted, the app keeps the private receipt and identity needed to check or retry instead of claiming success.

A hashed, non-PII deletion tombstone is retained for up to 30 days so receipt-only status and recovery can work, then it is purged. Iara deletes attributable Braintrust records and Cloudflare R2 objects before clearing the local identity. OpenAI may retain API content in abuse-monitoring logs for up to 30 days by default, with longer retention when legally required or reasonably necessary to prevent harm.

Completed APNs deliveries cannot be recalled. Revoking AI consent blocks future AI transmission but does not itself delete existing data.

6. Anonymous identity and device storage

Public v1 creates an anonymous identity tied to credentials stored on this device. There is no account recovery or cross-device recovery in v1. Reinstalling the app, resetting the device connection, losing the device, or losing its credentials may make server data inaccessible. Reset is not deletion.

Local journal data uses iOS file protection, and credentials, consent, notification registration, and deletion receipts use the Keychain. Supported relaunch and update paths are intended to preserve data; any supported-path loss is a release blocker.

7. Your choices and rights

• Inspect original notes separately from Iara’s inferred context and actions.
• Correct or undo supported AI actions and revoke future AI processing.
• Choose name-only or generic notification text, mute a person, or disable automatic outreach.
• Request permanent deletion from Settings and use the retained private receipt to resume an interrupted cleanup.
• Ask for access, correction, portability, information, objection, or deletion rights available under applicable law.

8. People mentioned in notes

A person described in your notes may never use Iara. Their information receives the same safeguards as your own relationship content. You are responsible for using Iara respectfully and for entering only information you have a lawful basis to keep.

9. Age, security, and changes

Iara is intended for adults and is not directed to children. The publisher must complete the final App Store age-rating questionnaire before release.

Iara uses access controls, encrypted transport, protected device storage, privacy-minimized logs, kill switches, and incident procedures. No system is perfectly secure. Material changes to this policy will be dated and communicated through the app or website when appropriate.

10. Contact

Use the localized Support page for privacy requests and deletion issues. A verified support address and legal operator identity must be configured before this policy is published for App Store review.