Download for iPhone

Privacy Policy

Last updated: 15 September 2026

1. Introduction

Welcome to RiseWithin. Snake Charmer Limited ("we", "us", or "our") operates the RiseWithin mobile application and website. We are committed to protecting your privacy and ensuring compliance with the General Data Protection Regulation (GDPR) and other applicable data protection laws. This Privacy Policy explains our practices regarding data collection and use when you use our mobile application or website.

2. Data Controller

Snake Charmer Limited, located in Waterford, Ireland, is the data controller responsible for your personal information. As the data controller, we determine the purposes and means of processing your personal data and are accountable for ensuring your data is handled in compliance with applicable data protection laws.

3. Information We Collect

3.1 Information You Provide

  • Account Information: An app-generated guest identity from the start of onboarding. Email address, name (optional), and authentication credentials if you choose to create a sign-in account
  • Profile Data: Preferences, quiz responses, and settings you provide to personalize your experience
  • Journal: Mood scores, gratitude, intentions, dates and any other text you choose to save in a check-in. These entries are linked to your account in Firebase. The Journal feature does not send entries to AI providers.
  • Custom sessions: Topics submitted for AI generation, affirmation text, session names and generated narration. Your custom sessions are not published to the public library.
  • My Voice: Reference recordings you submit, the scripts read in those recordings, clip durations, a voice profile and enrollment request timestamp, and affirmation audio generated in your voice. My Voice is optional. We do not use your voice to verify your identity.
  • Subscription information: Subscription status, entitlement and transaction identifiers. Apple or Google processes your store payment; we do not receive your full payment-card details.
  • Contact Information: Information you provide when contacting us for support

3.2 Information Collected Automatically

  • Usage Data: How you interact with the App, including features used, sessions played, and time spent
  • Device Information: Device type, operating system, and unique device identifiers
  • Analytics and diagnostics: Account-linked or pseudonymous activity records, including check-in creation and mood score, session/voice use, generation costs, errors and performance information. This includes guest onboarding steps, content versions, bounded answer IDs, preview readiness and listening, and verified subscription events. Journal text and reference recordings are not included in the app’s lifecycle analytics events. Minimal quota and abuse records are stored separately from audio to prevent repeated unpaid generation.

4. How We Use Your Information

We use the collected information to:

  • Provide and personalize the App experience
  • Select a personalized plan from your quiz responses and save your journal
  • Generate custom affirmations and narration when you request them
  • Store your voice references and create speech in your voice when you enable My Voice
  • Process subscriptions and manage your account
  • Send important notifications about your account or the service
  • Send product update emails about new features, new sessions, app improvements, and related announcements
  • Improve and optimize the App's performance and features
  • Respond to your inquiries and provide customer support
  • Detect and prevent security threats or fraudulent activity
  • Comply with legal obligations

5. Legal Basis for Processing

Under the GDPR, we process your personal data based on the following legal grounds:

  • Contract Performance: Processing necessary to provide you with our services and fulfill our contractual obligations to you
  • Consent: Where you have given clear consent for us to process your personal data for specific purposes, such as optional voice processing and marketing communications where consent is required
  • Legitimate Interests: Processing necessary for our legitimate interests, such as improving our services, ensuring security, and understanding how users interact with the App
  • Legal Obligation: Processing necessary to comply with legal requirements

6. Cookies and Tracking Technologies

Our public website uses Google Analytics to measure page visits, traffic sources, engagement and clicks through to the App Store. Google Analytics uses cookies and processes browser/device information and website interactions. We do not send contact-form contents, account details, journal entries or voice recordings through this website tracking. Analytics is not loaded on our password-reset/email-verification page or admin pages. Google signals and advertising personalization are disabled for this website tag.

We use cookies and similar tracking technologies to enhance your experience. These technologies help us:

  • Remember your preferences and settings
  • Understand how you use our services
  • Analyze App performance and usage patterns
  • Provide personalized content

You can control cookie settings through your browser or device settings. Please note that disabling certain cookies may affect the functionality of our services.

7. Third-Party Services

We use the following third-party services that may collect information:

  • Firebase / Google Cloud: Account authentication, Firestore data including journal entries and sessions, audio/reference file storage, server processing, activity records and diagnostics.
  • Google Analytics: Public website traffic, engagement and App Store click measurement, as described in section 6.
  • RevenueCat: Subscription receipts, identifiers and entitlement management. Store payments are handled by Apple or Google.
  • Anthropic: Receives the topic you submit through Generate with AI to produce affirmation text and a suggested session name.
  • OpenAI: Receives affirmation text to generate standard narration. The app does not send My Voice reference recordings or Journal entries to OpenAI for this purpose.
  • Alibaba Cloud (Qwen) and Fish Audio: Providers supported by My Voice. The configured provider processes reference audio, script text and affirmation text to generate speech. Qwen can retain a reusable provider-side voice until deletion is requested; Fish processes reference audio with synthesis requests.
  • SendGrid: Transactional emails, password reset emails, and product update email list management
  • Expo and Firebase: Push notification delivery
  • Apple/Google: App store services and in-app purchases

When you tap Generate Affirmations, your topic is sent to Anthropic to generate affirmation text. Creating standard narration sends the affirmation text to OpenAI. When you accept each reviewed My Voice recording, the app uploads it independently. Our AI voice provider processes accepted recordings, script text and affirmation text to create your voice and the two-affirmation preview before account creation or payment. Processing can run while you finish onboarding. Preparing a session in My Voice processes reference recordings and affirmation text with the configured voice provider. You can use other features without setting up My Voice.

Provider information: Anthropic API retention, OpenAI API data controls, Alibaba Cloud Model Studio data handling, and Fish Audio privacy policy. Provider security, abuse-prevention, legal and backup retention can differ from the records visible in RiseWithin.

8. Data Sharing

We do not sell your personal information. We may share your information only in the following circumstances:

  • With service providers who assist in operating the App (under strict confidentiality agreements)
  • When required by law or to respond to legal process
  • To protect our rights, privacy, safety, or property
  • In connection with a merger, acquisition, or sale of assets (with notice to you)

9. Data Retention

We retain your account, saved check-ins and sessions while needed to provide the features you choose, until you remove them or delete your account. New abandoned onboarding voice recordings, provider voices and generated previews are scheduled for deletion 24 hours after the last successful preview generation, or the first upload when no generation succeeds. Active trial, subscription and admin access preserve voice data. After that access actually ends, voice data is retained for 30 days to support reactivation. These new abandonment rules do not retroactively delete historical free-account voice data. Scheduled cleanup and provider retries may take additional time to complete. Records required for legal obligations, security, support, subscription administration and service analytics may be retained separately for those purposes.

  • Journal: Delete a check-in from Journal to remove its saved entry. Activity records, including historical check-in events, are held separately from the entry.
  • My Voice: Delete voice data in onboarding or on the paywall, or Profile → My Voice → Delete My Voice, withdraws permission for future use of that voice and requests deletion of the saved references and generated personal audio. Replacing recordings replaces the active voice profile and invalidates its generated audio. Provider-side voice deletion runs separately and may take longer.
  • Account: Delete account and data during onboarding or Profile → Delete Account starts deletion inside the app. You may need to reauthenticate. Backend cleanup removes the account’s saved journals, owned sessions, voice profiles and associated files. Direct account identifiers are removed from retained service analytics where supported; legal, security and provider records may remain under their retention requirements.
  • On your device: Offline Sessions → Clear All removes downloaded sessions. Local cached files are separate from cloud copies; uninstalling the app removes its local storage.

Deletion is not an instant erasure of every provider log or backup. Contact us if you need help with a deletion request or want details of applicable retention. Deleting an account does not itself cancel a store subscription; manage cancellation in your Apple or Google subscription settings.

10. Your Rights Under GDPR

Under the GDPR, you have the following rights regarding your personal data:

  • Access: Request a copy of your personal data
  • Rectification: Update or correct inaccurate information
  • Erasure: Request deletion of your account and associated data
  • Restriction: Request restriction of processing of your personal data
  • Objection: Object to processing of your personal data based on legitimate interests
  • Data Portability: Request your data in a portable, machine-readable format
  • Withdraw Consent: Decline future AI requests, delete My Voice, or contact us to withdraw consent. Withdrawal does not affect processing already carried out before withdrawal.

To exercise these rights, please contact us using the information below. You also have the right to lodge a complaint with a supervisory authority.

You can opt out of product update emails at any time by using the unsubscribe link included in those emails.

11. Data Security

Account data and files are stored using Firebase / Google Cloud. Access controls protect account content; authorized service providers and personnel may process it to operate the service. This is not end-to-end encrypted storage. We implement appropriate technical and organizational measures to protect your personal information, including:

  • Encryption of data in transit and at rest
  • Secure authentication mechanisms
  • Access controls limiting who can view your data

While we implement industry-standard security measures, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security of your data.

12. International Data Transfers

Your information may be transferred to and processed in countries other than your own. Our company is based in Ireland, but our cloud and AI providers can process data outside the European Economic Area, including in the United States and Singapore. We do not represent that all processing takes place in Ireland. Contact us for information about the providers and transfer safeguards applicable to your data.

13. Children's Privacy

RiseWithin is not intended for children under 16 years of age. We do not knowingly collect personal information from children under 16. If you believe we have collected information from a child under 16, please contact us immediately so we can delete it.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy in the App and updating the "Last updated" date. We encourage you to review this policy periodically.

15. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us:

Contact Form