Privacy Policy
The short version
Rhythmwyze is a personal rhythm-tracking app. We store the minimum we need to run it, we don't sell your data, and you can export or delete your account at any time. Questions go to support@rhythmwyze.com.
What we collect
- Account info — your email address and a hashed password (argon2id). Optional profile fields you enter in Settings: display name, screen name, and phone number. We never store passwords in the clear.
- Check-in data — the categories you create, the 1–6 ratings you log, and any notes you attach. Your schedule preferences for when reminders fire. Your device timezone, so reminders arrive at the right local time.
- Push subscriptions — if you enable reminders on the web app, your browser's push endpoint + keys (not your identity, just where to send the push). Revoked from Settings anytime.
- Operational logs — standard server logs (IP address, user agent, request path) kept for up to 30 days to debug issues and detect abuse. We don't link these to your check-in history.
What we don't collect
- Analytics or ad-tracking identifiers. There's no third-party tracker on Rhythmwyze.
- Device-level contact lists, location, camera, microphone, or photo library.
- Data from third-party health platforms (Apple Health, Google Fit) — we don't integrate with any.
How we use what we collect
- To run your account: sign in, sync between devices, fire the reminders you asked for.
- To maintain the service: fix bugs, keep the lights on, respond when you email us.
- To improve the product: aggregate, de-identified signals like "% of users who complete onboarding." We never read individual check-in content.
We don't sell, rent, or trade your data. We don't serve ads. We don't build profiles for marketers.
Where it lives
Your data is stored on Amazon Web Services in the United States. It's encrypted at rest (DynamoDB SSE with AWS-owned keys) and in transit (TLS 1.2+). Access to the production database is restricted to the Rhythmwyze operator and audited through AWS CloudTrail.
Coach sharing (Phase 2, not yet active)
A future Professional tier will let you grant a coach read-only access to selected categories. When that ships, access will be explicit, revocable at any time, and logged so you can see exactly which of your data has been viewed. Until you opt in, no coach can see anything.
Your rights
- Export. Settings → Download my data. Gets you every check-in as CSV.
- Delete. Email support@rhythmwyze.com from your account email asking for deletion. We remove your profile, categories, logs, and push subscriptions within 14 days. Backup retention is 30 days, after which the data is unrecoverable.
- Correct. Edit any field from Settings → Profile.
- EU/UK residents (GDPR / UK GDPR). You additionally have the right to restrict processing, object to processing, and lodge a complaint with your local data-protection authority.
- California residents (CCPA/CPRA). You have the right to know what we've collected, delete it, and opt out of any sale — though we don't sell data to begin with.
Children
Rhythmwyze is not intended for users under 13. If you believe a child under 13 has created an account, email support@rhythmwyze.com and we'll remove it.
Cookies and local storage
The web app uses browser localStorage to keep you signed in and to queue check-ins when you're offline. We don't use tracking cookies. We set a single rw_token HTTP-only cookie as an alternate place to keep your auth token — it's scoped to rhythmwyze.com and expires in 7 days.
Changes
If we update this policy we'll bump the "Last updated" date and, for material changes, email the address on file at least 14 days before the change takes effect. If you don't agree with a change, email us to delete your account before the effective date.
Contact
Rhythmwyze · support@rhythmwyze.com