Privacy Policy

RetroPals is a personal wellbeing reflection and goal-setting app. This Privacy Policy explains what information RetroPals collects, why, how it is stored and protected, who it may be shared with, and the choices and rights you have over it. We built RetroPals to keep your data on your own device by default, to minimise what we collect, and to be transparent about every AI feature that touches your reflections.

1. Who we are

RetroPals is developed and operated by Retro Scape Ltd ("we", "us"), a company registered in New Zealand. For the purposes of data protection law, Retro Scape Limited is the data controller for the personal data described in this policy.

• Registered office: Retro Scape Ltd, 17 Albert Street, Auckland Central, Auckland 1010, New Zealand
• NZBN: 9429042032632
• Director and privacy officer: Logan Rasmussen
• Email: legal@retroscape.dev

RetroPals grew out of academic research into wellbeing and reflection, but there is no research programme, and nothing the app collects is used for research or shared with researchers.

2. Scope of this policy

This policy covers the RetroPals mobile apps (iOS, Android) and this website (retropals.app), including its contact, launch notification and account deletion forms. It applies to everyone who uses RetroPals, including guest (anonymous) users. It does not cover third-party websites or services you may reach through links inside the app or on this website (for example, app store pages or your own OpenRouter account), which have their own privacy policies.

3. Information we collect

What we collect depends on how you use RetroPals. Health data, location, media and cloud backup are always optional. The table below summarises each category.

Health Connect and Apple Health

RetroPals can read a small amount of data from Health Connect (Android) or Apple Health (iPhone) to add context to your weekly reflection. Each item is optional, off until you switch it to Automatic, and only read after you grant permission. RetroPals only reads: it never writes to Health Connect or Apple Health.

Individual records are not stored. RetroPals keeps one weekly figure per item, on your device, as part of that week's reflection. It leaves your device only if you back up your reflections, or, with AI features on, as a short summary line your companion reads. Health data is never sold, never used for advertising, and never used to decide eligibility, pricing or access. You can switch any item off in Settings → Attachments, or remove access in Health Connect or Apple Health settings, at any time.

The use of information received from Health Connect will adhere to the Health Connect Permissions policy, including the Limited Use requirements.

4. Local-first storage and optional cloud backup

RetroPals is built local-first. By default, all of your data (reflections, goals, companions, profile, conversations) is stored securely on your own device (using an on-device database) and the app is fully usable offline. Nothing is sent to our servers for storage until you choose to back it up.

Cloud backup

With a full account, you can copy your data to a secure, access-controlled cloud database (Google Firebase) so it can be restored on another device or if you lose your phone. The copy on your device always stays the main one. There are two ways to do it, both in Settings → Backup and sync:

• Back up now (free): backs up only when you tap it.
• Automatic sync (included with Premium, Premium+ and Lifetime): off until you turn it on. Once on, it backs up at most once a day when you open the app, and when you finish a reflection. Turning it on does not upload anything by itself.

Some device-specific settings (theme, reminder preferences, local weather cache, your personal health baselines) always stay on your device only.

You choose what gets backed up

You control each type of data separately under What gets backed up, and you can change any of them at any time:

Your profile and weekly challenges are included in every backup.

Turning a type off stops it being backed up from then on. It does not delete what was already backed up. To remove that, use Delete cloud backup in Settings → Backup and sync (for one type of data or all of it), which keeps everything on your device, or delete your account.

If you use RetroPals as a guest, nothing is backed up to the cloud: there is no account to back up to.

Backup files

Anyone, including guests, can save a backup file from Settings → Backup and sync. It is a zip file holding your data and your photo and voice note files. It goes wherever you choose to send it (for example iCloud Drive, Google Drive or email), and RetroPals keeps no copy of it and never sees it. The file is not encrypted, so keep it somewhere you trust: anyone who has it can read what is inside.

5. AI features and Zero Data Retention

RetroPals includes optional AI features: AI companion chat and AI-generated analysis of your reflections. These are designed to offer general wellbeing support and encouragement. They are not clinical, medical, diagnostic, or therapeutic services, and they are not a substitute for professional care. See ourTerms of Use for the full disclaimer. You can turn AI features off entirely in Settings → AI features.

What an AI request contains

AI requests pass through our server to OpenRouter, which forwards them to the provider of the AI model. A request contains the conversation or reflection being answered, plus short context sentences the app writes for the AI: profile details you entered, averages from your reflections and, only while the matching source is on, weekly health and weather summaries. It never contains individual health readings, your voice notes or photos, your name, your email address or the coordinates of your location. The only account detail passed along is the name of your plan.

Zero Data Retention by default

Settings → AI features has a Zero data retention only switch. It ison by default. While it is on, the app only offers AI models whose providers support Zero Data Retention, and every request tells OpenRouter to use only providers that do. If no such provider is available for a model, the request fails rather than being sent somewhere else.

You can choose to turn the switch off to use models whose providers do not offer Zero Data Retention (for example, Google's Gemini models). The app explains what changes before you do. While it is off, the provider of the model you choose may keep your prompts and replies under its own terms, which can include using them to improve its services. Turning the switch back on returns you to ZDR-only models.

Bring Your Own AI

If you enable Bring Your Own AI and connect your own OpenRouter API key, your requests still pass through our server with the same Zero Data Retention setting, but they run under your OpenRouter account and also follow its privacy settings. We strongly recommend turning on zero data retention in your own OpenRouter privacy settings as well. The app shows you this recommendation on the Bring Your Own AI screen. Usage on your key is billed to you by OpenRouter.

With your own key you can also choose All models, which lets you pick any model from OpenRouter's full list rather than only the ones we have reviewed. The same Zero data retention setting applies: while it is on, the list only shows models that support it. Loading the list sends nothing about you.

Reporting an AI reply

If an AI reply or analysis is harmful, inaccurate or inappropriate, you can report it from inside the app. If you report an AI reply, we receive that reply, which AI model wrote it, and the reason and note you give, so we can review it. Reports are stored in your own private area of our cloud database, readable only by us, and are deleted with your account.

RetroPals itself does not use your reflections or chat content to train any AI model.

6. How we use your information

• To provide the core app experience: reflections, insights, goals, and AI companion chat.
• To generate AI analysis of your reflections and respond to your chat messages.
• To personalise content, such as weather insights and challenge suggestions.
• To process purchases, manage your credit balance, and administer subscriptions.
• To back up and sync your data across your devices, if you opt in.
• To review AI replies you report, and to improve the safety of AI features.
• To answer messages and requests you send us, including through the website forms.
• To maintain the security, integrity, and reliability of the app.
• To comply with our legal obligations.

We do not sell your personal data, we do not share it for advertising, and we do not use your reflection, health or chat content for advertising or profiling. We make no automated decisions about you that have legal or similarly significant effects.

7. Legal basis for processing (GDPR)

Where the GDPR applies, we rely on the following legal bases:

• Explicit consent (Article 9(2)(a) GDPR): for health data (the activity and cycle data described in Section 3) and for any faith or beliefs you add to your profile. Each health category asks for its own permission, and nothing is read until you turn it on.
• Consent: for other optional features such as cloud backup, location and weather, voice notes and photos, and the launch notification email. You may withdraw consent at any time in the app's settings, or by contacting us.
• Performance of a contract: to provide the core app functionality you request, including account creation, AI features and paid subscriptions or credits.
• Legitimate interests: to keep the app and website secure, prevent abuse, keep an access log of who has read stored data, diagnose technical problems, review reported AI replies, and answer messages you send us, balanced against your rights and interests.
• Legal obligation: where we must retain certain records (for example, transaction records) to comply with tax or consumer-protection law.

You are never required to provide optional data. If you choose not to, RetroPals still works; only the feature that needs that data is unavailable.

8. Who we share data with

We do not sell personal data. We share limited data with the service providers ("processors") strictly necessary to operate RetroPals, under contractual data protection terms:

We may also disclose information if required to by law, or to protect the rights, safety, and security of RetroPals, its users, or the public.

9. International data transfers

Where your backup is stored. If you back up to the cloud, your records (reflections, goals, companions, chats and the rest of Section 4) are stored in Google Firebase's European Union location, in data centres in Belgium and the Netherlands. Backed-up voice note and photo files are different: they are stored in Google Cloud Storage in the United States (South Carolina). They are only uploaded if you turn on the Reflection media backup, which is off by default.

Health data stays in the EU unless you send it to the AI. The health figures in your backup (Section 3) are stored in the EU and we never access them. The only way they leave the EU is if you use AI features: then the short weekly health summary described in Section 5 travels with your request to the AI, is processed in the United States to produce the response, and is discarded afterwards while Zero data retention only is on. If you do not want that, switch the health sources off, or switch AI features off. A backup file you save yourself goes wherever you send it.

Where it is processed. Stored in the EU does not mean it never leaves the EU. Some services process data in the United States while they run:

• our server functions on Google Cloud (which pass AI requests along, delete accounts, handle credits and fetch weather) run in Google's US region;
• OpenRouter, and most of the AI model providers it reaches, are in the United States;
• RevenueCat, Cloudflare and Resend also process data in the United States.

Where data is transferred outside the EU/EEA, we rely on appropriate safeguards such as standard contractual clauses or the EU-U.S. Data Privacy Framework.

AI requests and Zero Data Retention. With Zero data retention only on (the default), your messages and the AI's replies may be processed in the United States to produce your response, but they are discarded afterwards and not stored there. If you turn that switch off, or use your own API key, the chosen provider's or your own account's terms apply instead, and the provider may keep what you send (see Section 5).

Retro Scape Ltd is based in New Zealand, which the European Commission recognises as giving an adequate level of data protection.

10. Data security

Who at RetroPals can see your data

Nobody at Retro Scape Ltd reads, browses or exports your reflections, health data, chats, companion memories, voice notes or photos. We have no reason to, and we do not. There is no tool, report or export on our side that shows them. The only personal data we look at is what we need to run your account: your account ID and email address (for example, to carry out a deletion request or answer a support email), your plan and credit history, and any AI reply you choose to report to us.

Our server code only touches your backed-up content to delete it when you ask. It never reads it for any other purpose.

Access logging. Every read of the data held in our cloud database (Google Cloud Firestore) is logged automatically by Google Cloud. That includes reads by your own app, by our automated services, and any access by anyone at Retro Scape Ltd. Each log entry records which account accessed which stored record and when, but not the content of the record. Because a record's location includes your account ID, the log does contain your account ID. Access logs are kept for 400 days and then deleted automatically. We use them only to check who has accessed stored data, never for analytics, advertising or anything else. The log records access; it does not prevent it. It covers the cloud database only: backed-up photos and voice notes in cloud storage are not covered by it.

We apply technical and organisational measures appropriate to the sensitivity of the data involved, including:

• Local-first storage that keeps most data off our servers entirely by default.
• Encrypted connections (HTTPS) for everything the app and website send.
• Encryption of BYO AI API keys (AES-256-GCM) using keys managed in a dedicated secrets manager, never exposed to any client device.
• Access-controlled cloud database rules that restrict every user's backed-up data to that user only.
• Device integrity checks (Firebase App Check) that help block requests that do not come from the genuine app.
• Payment processing delegated entirely to PCI-compliant providers (Apple, Google, RevenueCat); we never handle raw card details.

No system is perfectly secure, and we cannot guarantee absolute security, but we work to protect your information using industry-standard practices proportionate to a personal wellbeing app.

11. Data retention

• On your device: data stays until you delete it in the app or uninstall the app.
• Backup files: you decide where they are kept and for how long. We never receive them.
• Cloud backup: kept only while your account exists. It is removed when you use Delete cloud backup, when you delete your account, or within 30 days of a verified request to us. We do not keep a separate archive of it.
• Deletion markers: when you delete an item, a small marker (with no content) stays in the cloud for up to 180 days so your other devices know to delete it too.
• Reports of AI replies: kept until you delete your account.
• Server logs: short technical logs, which do not contain your reflection or chat content, are kept by Google Cloud for up to 30 days.
• Access logs for our cloud database: 400 days (see Section 10).
• Website form submissions: kept in our inbox only as long as needed to deal with them. Launch notification addresses are deleted once the launch email has been sent.
• Purchase records: limited transaction records are kept for as long as tax and accounting law requires, typically up to 10 years. When you delete your account, we also delete the record our payment provider, RevenueCat, holds about you. Apple and Google keep their own purchase records under their own policies.

12. Your rights

You have rights over your personal data under the New Zealand Privacy Act 2020 and, if you are in the EU, EEA or UK, under the GDPR. You have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data. Most of it you can edit directly in the app.
• Erase your data ("right to be forgotten"): delete items or everything on your device in Settings → Manage data, delete your cloud backup in Settings → Backup and sync → Delete cloud backup, or delete your whole account in Settings → Account → Delete account. You can also request deletion from this website or by contacting us.
• Restrict or object to certain processing.
• Data portability: download a copy of your data in Settings → Manage data → Download my data. You get a zip file containing your data as readable text and as JSON.
• Withdraw consent at any time for anything based on consent (backup, health data, location, profile beliefs), without affecting processing carried out before withdrawal.
• Lodge a complaint with your local data protection supervisory authority, or, in New Zealand, with the Office of the Privacy Commissioner (privacy.org.nz).

Deleting items in the app removes them from your device immediately and, if backup is on, from your cloud backup straight away (or, if you are offline, the next time you connect). If you ever think a copy remains on our servers, contact us and we will delete it.

To exercise any of these rights, contact us atlegal@retroscape.dev. We will respond within the timeframes required by applicable law, normally within one month.

13. Children's privacy

RetroPals is intended for users aged 16 and over. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, please contact us and we will take steps to delete it.

14. Changes to this policy

We may update this Privacy Policy from time to time, for example as features change or to reflect legal requirements. We will update the "Last updated" date above when we do. Material changes will be highlighted in-app where practical.

15. Contact us

Questions, requests, or concerns about this policy or your data can be sent to our privacy officer, Logan Rasmussen, at legal@retroscape.dev, or by post to Retro Scape Ltd, 17 Albert Street, Auckland Central, Auckland 1010, New Zealand.