Privacy Policy

This Privacy Policy explains how Artem Sobolev, an individual operator (“ReflectAloud”, “we”, “us”), collects, uses, and protects your personal data when you use the ReflectAloud application (the “Service”). For any privacy question or to exercise your rights, contact privacy@reflectaloud.com.

We apply GDPR-level data protections to all users, regardless of where they are located.

• Account data — via Google sign-in: your email, name, profile picture, and a Google account identifier.
• Session content — the messages you write during a session. We delete a session’s individual messages once its summary has been generated.
• Session summaries — the AI-generated summary kept after a session.
• Payment records — order id, package, and amount. Payments are processed by Lemon Squeezy; we never see or store your card details.
• Token ledger — a record of token purchases and usage.
• Safety records — when a message is flagged by our automated safety check, we store the message text and category for safety and compliance.
• Technical data — cookies, IP address, and device/browser information.

• To provide the AI support sessions and generate summaries.
• To give new sessions context from your previous session summaries — you can turn this off in Settings at any time.
• To process payments and maintain your token balance.
• To run automated safety and crisis detection.
• To comply with our legal obligations.

• Performance of our contract with you (providing the Service).
• Our legitimate interest in keeping the Service safe.
• Your consent (for non-essential cookies).
• Compliance with legal obligations.

To generate responses and run safety checks, your messages are sent to our AI provider (OpenRouter) and the underlying model providers. We instruct our providers not to use your conversations to train their models; provider terms may change, so please also review their policies.

We rely on the following processors and do not sell your personal data:

• Google — authentication.
• Lemon Squeezy — payments (Merchant of Record).
• OpenRouter and model providers — AI responses and moderation.
• Our hosting provider — running the Service.

• Session messages are deleted after a summary is generated.
• Summaries remain until you delete them or your account.
• Safety records are retained for up to 90 days (we are implementing automated deletion).
• Account data is kept until you delete your account.

You have the right to access, rectify, erase, restrict, port, and object to processing of your data, and to withdraw consent. To exercise any right, email privacy@reflectaloud.com. You may also lodge a complaint with your local data protection authority.

Our providers may process your data outside your country, including in the United States. Where required, transfers rely on appropriate safeguards such as Standard Contractual Clauses.

The Service is not intended for anyone under 18, and we do not knowingly collect data from children.

We protect your data with encryption in transit and access controls. No method of transmission or storage is completely secure, but we work to protect your information.

We may update this policy. We will post the new version here and update the “Last updated” date above.

Questions? Email privacy@reflectaloud.com. See also our Cookie Policy and Terms of Service.