Effective Date: July 27, 2026
This Privacy Policy describes how PSYCHE PROJECT PBC ("Psyche," "we," "us," or "our") collects, uses, and protects your information when you use our psychological assessment services. It covers Peli, our mobile app for iOS and Android, and our website at psyche.you (together, the "Services").
Peli is the app; Psyche is the company that operates it. Where this policy distinguishes them, "the app" means Peli and "the website" means psyche.you. Some things we describe below happen only on one or the other, and we say so where that is the case.
By using the Services, you agree to the collection and use of information in accordance with this policy.
Sexual orientation, religious affiliation, ethnicity, and race constitute special category data under GDPR Article 9 and are processed only with your explicit consent. All demographic fields beyond age and biological sex are entirely optional
When you use the Services, we automatically collect:
We use third-party services that may collect information about you:
We rely on consent for analytics on our website (via the cookie banner) and on legitimate interest for first-party product analytics and error monitoring in the Peli app. In the app you can opt out at any time under Settings → Privacy & Data → Usage analytics; on the website, through the cookie banner. These controls govern analytics sent from your device. Section 1.6 describes analytics our servers send, which those toggles may not cover — read it before relying on them.
Neither voice feature runs unless you start it, and both require microphone permission that you grant and can withdraw in your device settings. If you never use them, nothing in this section applies to you.
Dictation — you tap the microphone and speak instead of typing. This uses your device's own speech recognition: Apple's on iPhone, Google's on Android (the app requests the Google speech recognition service). Whether your speech is processed on the device or sent to Apple's or Google's servers is determined by your device and its settings, and their handling of it is governed by their privacy policies, not this one. We receive only the resulting text.
Voice mode — a hands-free spoken conversation with Peli. Here your microphone audio leaves your device and is processed by:
What is processed: your microphone audio for the duration of the conversation, the text transcribed from it, and the reply. We keep the conversation transcript so Peli can follow the thread and so you can return to it, on the same basis as your other Ask Peli conversations. You can delete these conversations in the app, and they are deleted with your account.
If you buy a subscription or in-app currency, the purchase is made through the Apple App Store or Google Play, not from us directly.
We never receive your payment card, bank details or billing address. Apple or Google processes the payment and tells us only that a valid purchase occurred.
If you subscribe through our website rather than the app, payment is processed by Stripe. Stripe receives your payment details directly — we do not see or store your card number. We receive a record that the subscription exists and its status.
Separately from the analytics your device sends, our servers record telemetry about each AI generation so we can monitor quality, cost and failures. These events are linked to your account identifier, and they include assessment-derived content:
We want to be plain that this is broader than "we exclude your assessment responses." Your raw item-by-item answers are not sent, but scores derived from them, the narratives written about you, and your conversations with Peli are.
The analytics toggle in Settings governs what your device sends. It may not stop these server-side events. If you want this stopped for your account, contact us at support@psyche.you and we will action it. We are working to bring this under the same in-app control as everything else.
Using Psyche means your responses support internal research on a pseudonymized basis — direct identifiers are removed and replaced with a research identifier — to build normative datasets, enhance assessment validity and reliability, train models that improve scoring and insights, and produce aggregate research findings. Under this baseline, your individual-level data is never shared with any third party; only aggregate findings that cannot identify you are ever published or shared outside Psyche. We rely on legitimate interest for this baseline research, and you can object as described in Section 7.
If you opt in to Contribute to Science in your settings, you allow more: your pseudonymized, individual-level data — keyed to a research identifier, with direct identifiers removed — may be included in datasets we share with vetted external researchers under a data-use agreement, and we may contact you about research studies you're eligible to join. A researcher only learns your identity if you separately agree to join a specific study. This consent also authorizes us to store your special-category answers (see Section 12).
This participation is entirely voluntary. You can change your preference at any time in your settings; we then stop including your individual data in future external datasets, stop contacting you about studies, and delete the sensitive answers stored only under this consent. Your baseline internal-research participation (above) continues. For full detail, see our Research Data Policy.
We never sell data that identifies you — to anyone, for any reason. For everyone, we may share fully anonymized, aggregate datasets — where no individual can be identified, even by us — with organizations advancing health, science, or human wellbeing. If you opt in to Contribute to Science, we may additionally share your pseudonymized, individual-level data with vetted researchers under a data-use agreement — direct identifiers removed, and the mapping that could re-identify you is never shared. We never license data to advertisers or for behavioral targeting.
Baseline (everyone):
If you opt in to Contribute to Science:
Permitted recipients and purposes (including but not limited to):
Prohibited recipients and purposes:
Important: Individual responses are never sold, and individually identifiable data is never shared with third parties without your explicit opt-in. See our Research Data Policy for details.
We do not sell your personal information. We may share information only in these circumstances:
We share information with third-party service providers who perform services on our behalf. Current sub-processors:
| Sub-Processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Supabase | Authentication & database | Account data, assessment results, phone number if you sign in by phone | United States |
| Google / Apple | Sign-in providers, if you choose them | The account identifier and email address the provider releases | United States |
| Twilio | SMS delivery — the one-time code sent to you when you sign in with a phone number (reached through Supabase Auth) | Your phone number, and the code sent to it | United States |
| Vercel | Website hosting & delivery | IP address, browser information | United States (edge) |
| Railway | Application server hosting — our API runs here, so it processes everything you send us | Account data, assessment responses and demographics (including special-category answers), Ask Peli content, voice transcripts, IP and log data | United States |
| Stripe | Payment processing for website subscriptions | Payment details (Stripe receives these directly; we do not store your card number), subscription status | United States |
| Google Analytics | Website usage analytics (consent-based; website only) | Anonymized usage data, IP address | United States |
| PostHog | Product analytics, session replay, app error tracking, and server-side AI-generation telemetry (§1.6) | Usage data; session replay (web: page interactions. App: screen recording with all text masked, images unmasked). From our servers: Ask Peli messages and replies, trait scores, generated narratives, and free-text blend context | United States |
| Sentry | Error monitoring — website and internal admin tools only, not the Peli app | Error messages, stack traces, browser/OS info, request URLs | United States |
| Ably | Real-time messaging for live features, and push notification dispatch | Connection metadata, user identifiers, device push token | United States |
| Cloudflare | Bot/abuse detection (Turnstile) | IP address, device/browser signals | United States (edge) |
| Apple (APNs) / Google Firebase (FCM) | Push notification delivery network | Device push token, notification content | United States |
| RevenueCat | Purchase & subscription entitlements (Peli app) | Psyche account identifier and app store receipt only — no email, name, phone or push token | United States |
| Expo (EAS) | Builds and over-the-air updates for pre-release app builds (TestFlight / internal testing) | App version, device identifier | United States |
| Anthropic (Claude) | AI-generated insights, and Ask Peli conversations | Assessment scores (no PII); the messages you send to Ask Peli | United States |
| LiveKit | Live audio transport for voice mode, and transcription brokering — only when you use voice mode | Microphone audio for the duration of the conversation | United States |
| Deepgram | Speech-to-text for voice mode (reached via LiveKit) — only when you use voice mode | Microphone audio, resulting transcript | United States |
| ElevenLabs | Text-to-speech for Peli's spoken replies — only when you use voice mode | The reply text to be spoken | United States |
| Apple / Google speech recognition | Dictation — only when you tap the microphone. Governed by Apple's and Google's own privacy policies, not this one | Microphone audio, resulting transcript | Per Apple / Google |
| Resend | Transactional email | Email address, name | United States |
We may change service providers as needed to improve our platform. All providers are contractually obligated to protect your data and process it only according to our instructions.
We may disclose information if required by law, court order, or government request, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
If Psyche is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change.
We implement appropriate technical and organizational measures to protect your information:
While we strive to protect your information, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.
You have the following rights regarding your data:
To exercise these rights, contact us at support@psyche.you or use the relevant features in your account settings.
You can delete your account and its data at any time in the app under Settings → Delete Account. You do not need the app to make this request. Our public Data Deletion page explains what gets deleted and how to request deletion by email, with no sign-in required.
Psyche is operated from the United States. If you access the Services from outside the United States, your information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your country.
For users in the European Economic Area (EEA), United Kingdom, or Switzerland:
We rely on the European Commission's Standard Contractual Clauses (SCCs) as the legal mechanism for transferring personal data to the United States. Our service providers who process EU personal data have entered into appropriate data processing agreements incorporating these clauses.
You may request a copy of these safeguards by contacting us at support@psyche.you.
The Services are intended for users who are 16 years of age or older. We do not knowingly collect personal information from anyone under 16. If we learn that we have collected personal information from a user under 16, we will delete that information promptly.
The Services may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies.
We may update this Privacy Policy from time to time. We will notify you of material changes by:
Your continued use of the Services after changes become effective constitutes acceptance of the revised policy.
Under GDPR, we process your personal data based on the following legal grounds:
| Processing Activity | Legal Basis (GDPR Art. 6) |
|---|---|
| Account creation and authentication | Contract performance (Art. 6(1)(b)) |
| Providing assessment results | Contract performance (Art. 6(1)(b)) |
| Transactional emails | Contract performance (Art. 6(1)(b)) |
| Processing purchases and managing what you are entitled to | Contract performance (Art. 6(1)(b)) |
| Ask Peli conversations | Contract performance (Art. 6(1)(b)) |
| Voice features — dictation and voice mode | Consent (Art. 6(1)(a)), given through the microphone permission you grant and can withdraw on your device |
| Service security and fraud prevention | Legitimate interests (Art. 6(1)(f)) |
| Product analytics — website | Consent (Art. 6(1)(a)), via cookie banner |
| Product analytics — Peli app | Legitimate interests (Art. 6(1)(f)); opt-out in Settings → Privacy & Data |
| Error monitoring and crash reporting | Legitimate interests (Art. 6(1)(f)) |
| Server-side AI-generation telemetry, including assessment-derived content (§1.6) | Legitimate interests (Art. 6(1)(f)) — monitoring quality, cost and failure of AI features. Object at support@psyche.you |
| Internal research, normative development, and internal AI model training (pseudonymized) | Legitimate interests (Art. 6(1)(f)) |
| Behavioral response signals for measurement quality and internal research | Legitimate interests (Art. 6(1)(f)) |
| External research contribution and study recruitment (with consent) | Consent (Art. 6(1)(a)) |
| Storage of special-category answers | Explicit consent (Art. 9(2)(a)) |
Special Category Data: Psychological assessment results may constitute special category data under GDPR Article 9. We process this data based on your explicit consent (Art. 9(2)(a)), which you provide when agreeing to take assessments.
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):
Contact us at support@psyche.you or use the controls in your account settings. We will verify your identity before processing requests.
The data controller responsible for your personal data is:
Data Controller: PSYCHE PROJECT PBC, a Delaware Public Benefit Corporation
Mailing Address: 47 Wintermist, Irvine, CA 92614, United States
Email: support@psyche.you
For privacy-related inquiries, complaints, or to exercise your data protection rights, contact our Data Protection team at support@psyche.you.
We will respond to all legitimate requests within 30 days (or as required by applicable law).
If you have questions about this Privacy Policy or our data practices, contact us at:
General Support: support@psyche.you
Privacy Inquiries: support@psyche.you
Data Controller: PSYCHE PROJECT PBC, a Delaware Public Benefit Corporation
Mailing Address: 47 Wintermist, Irvine, CA 92614, United States
Last Updated: July 27, 2026