Reulay is an applied neuroscience company using AI to improve how people feel, think, and perform. Reulay, Inc. is responsible for the personal information described in this policy. Reulay is mindset and wellness training; it is not a medical service and does not diagnose or treat any condition.

• To provide the Services: run your account, recommend experiences, show your feed, journeys and progress, and power Cali.
• To personalize: tailor recommendations to your mindset profile, check-ins and history.
• To communicate with you: account and security emails, service updates, support, and newsletters you can unsubscribe from.
• To process subscriptions and payments.
• To improve and research: understand what helps people most, using aggregated or de-identified data where possible.
• To keep the Services safe: detect and prevent fraud, abuse and security incidents, and debug problems.
• To comply with the law and enforce our terms.

We do not sell your personal information, and we do not use your health data or check-in answers for advertising.

We share personal information only as described here:

• Service providers who process it on our behalf under contracts that limit its use: Amazon Web Services (hosting and storage), Vercel (website and connector hosting), OpenAI (Cali), Twilio SendGrid (email), Stripe and RevenueCat (payments and subscriptions), OneSignal (push notifications), Mixpanel and Google Analytics, including Firebase (analytics).
• Sign-in providers: Google and Apple, when you choose to sign in with them.
• AI assistants you connect, as described in Section 4.
• Your employer or organization, if you access Reulay through a company program: its administrators can see the account and usage information needed to manage the program, such as your name, email address and participation. We never share your Apple Health data or Cali conversations with your employer.
• Legal and safety reasons: to comply with law or valid legal process, or to protect the rights, safety and property of Reulay, our users or others.
• Business transfers: in a merger, acquisition or sale of assets, subject to this policy.

Our website uses cookies from analytics and advertising partners, which may count as “sharing” for targeted advertising under some US state laws. You can opt out as described in Section 9. Apple Health data is never shared for advertising.

• Account, session, check-in, assessment and health data: kept while your account is active, so your history and progress stay with you.
• When you delete your account: you can delete it in the app (Edit Profile → Delete account) or by emailing us. Your account and the data linked to it are deleted from our production systems right away, and residual copies in backups are overwritten within 30 days. Ask us at product@reulay.com and we will also delete your Cali conversation history held by our AI provider.
• AI connector: sign-in tokens expire as described in Section 4; the connector keeps no copies of your data.
• Support emails: kept as long as needed to help you and to keep a record of our communications.
• Analytics and logs: usage analytics are tied to a pseudonymous identifier and kept for no longer than five years; server logs are kept only as long as needed for security and troubleshooting.
• Legal obligations: we may keep limited information longer where the law requires it, such as tax and payment records, or to resolve disputes and enforce our agreements.

De-identified or aggregated information that can no longer identify you may be kept for research and to improve the Services.

We protect personal information with administrative, technical and physical safeguards, including encryption in transit (HTTPS), hashed passwords, access controls and monitoring. No system is perfectly secure. If a breach affects your personal information, we will notify you and the authorities as the law requires.

• Access and correction: view and edit your profile in the app, or ask us for a copy of your data.
• Deletion: delete your account in the app, or email us.
• Apple Health: change or turn off access at any time in the Health app.
• AI assistant connector: disconnect at any time in your assistant's settings.
• Emails and notifications: unsubscribe using the link in any marketing email, and turn off push notifications in your device settings.
• Consent: where we rely on your consent, you can withdraw it at any time.

To make a request, email product@reulay.com. We will verify your identity before acting on it.

Residents of California, Colorado, Connecticut, Utah, Virginia and other states with consumer privacy laws have the following rights, subject to the exceptions in those laws:

• Know and access the personal information we collect, use and disclose about you.
• Correct inaccurate personal information.
• Delete personal information we collected from or about you.
• Portability: receive a copy of your information in a readily usable format.
• Opt out of targeted advertising, the “sale” or “sharing” of personal information, and profiling with legal or similarly significant effects. We do not sell personal information for money.
• Sensitive data: we process sensitive data, such as health information, only with your consent and only to provide the Services to you.
• Non-discrimination: we will not treat you differently for exercising your rights.

Categories (California): in the past 12 months we collected identifiers (such as name, email, IP address); customer records (name, email); internet and app activity; and sensitive personal information (health data you connect, and account log-in credentials). We disclosed identifiers, customer records and internet activity to the service providers in Section 5 for business purposes. Sources and purposes are described in Sections 2 and 3, and retention in Section 6.

How to exercise your rights: email product@reulay.com with the subject “Privacy request.” You may use an authorized agent. We respond within 45 days, and may extend this by another 45 days when reasonably necessary. Requests are free up to twice a year.

Appeals: if we decline your request, you can appeal by replying with the subject “Privacy appeal.” We respond to appeals within 60 days and, if we deny an appeal, will explain how to contact your state Attorney General.

California “Shine the Light”: California residents may ask which personal information, if any, we disclosed to third parties for their direct marketing in the prior year. We do not disclose personal information for third parties' direct marketing.

If you are in the European Economic Area, the United Kingdom or Switzerland, Reulay, Inc. is the controller of your personal data, and you have the right to access, correct, delete, restrict or object to our processing of your data, to data portability, and to withdraw consent at any time. You can also complain to your local data protection authority.

Our legal bases for processing are:

• Contract: to provide the Services you signed up for.
• Consent: for health data, optional analytics cookies and marketing emails.
• Legitimate interests: to secure, understand and improve the Services, where those interests are not overridden by your rights.
• Legal obligation: where the law requires us to process or keep data.

The Services are not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has given us personal information, contact us and we will delete it.

Reulay is based in the United States, and we and our service providers process data in the United States and other countries. When we transfer personal data out of the EEA, UK or Switzerland, we rely on safeguards such as the European Commission's Standard Contractual Clauses.

We may update this policy from time to time. We will post the new version here with a new effective date, and if the changes are significant we will notify you in the app or by email before they take effect.

For privacy questions or requests, email product@reulay.com. Reulay, Inc.