Privacy Policy
1. Who we are and how to reach us
Rabiata LLC, a Wyoming limited liability company, operates InnerReset and decides how and why your personal data is used. For any question or request about your data, write to support@innerreset.life with "Privacy" in the subject line, or to the postal address above.
2. Words we use
- Creation: a Carry (a short spoken message made from what you share) or a Mind Track (a short self-talk track whose lines you approve before they are spoken). A creation includes its text, title, audio, optional cover art, and the settings you chose.
- Expression: what you type, the text of what you say, and any answer you give to a clarifying question, when you ask for a creation.
- Guest: a person who uses the app without signing in.
- Account: the record we create when you sign in. It keeps your library, plan and credits across devices.
- Provider: a company that processes personal data for us under a contract.
3. What we collect
| Category | What it includes | Where it comes from |
|---|---|---|
| Account data | The identifier Apple gives us when you sign in with Apple, or the email address you sign in with; the email address Apple shares with us, if any (it may be a private relay address); your first name if you give it; your app language; optional profile details you add (display name, handle, up to three links) | You and Apple |
| Guest identity | A random token our server issues to your device when you first use the app without an account | Our server |
| Expressions | What you type, the text of what you say, your answers to a clarifying question, and short answers you give to reflection questions in your Journey | You |
| Creations | Scripts, titles, approved lines, audio files, optional cover art, the voice, atmosphere and listening mode you chose, and the versions of each creation | Made for you by the service |
| Interpretation and safety data | The reading our language model makes of your expression (for example the kind of support you ask for, the relationship involved, the emotional tone), the safety level and topic of the safety check, and the resulting route | Our systems |
| Aggregate-insight summary | A short set of these interpretation and safety fields, kept with each Carry version when you have opted in (section 8) | Our systems |
| Consent records | Your consent to the processing of sensitive data, with your confirmation that you are 18 or older; your optional consent to aggregate statistics; your acknowledgement of the "Subliminal" Mind Track mode; each with date, version, language and a fingerprint of the text you saw; and any withdrawal | You |
| Subscription and credits | An account identifier for our subscription-management service, the product you bought, the subscription's status, type and dates, Apple's transaction references, and your credit ledger (allocations, holds, spends, returns) | Apple, our subscription-management service, and our servers |
| Technical data | IP address, request identifiers and error details in server logs; app version; timing and cost records of each processing step, which contain no content | Your device and our servers |
| Emails and support messages | The emails we send you (sign-in codes, notices) and their delivery status; what you write to us and our replies | Our systems and you |
We never see your card number or your Apple ID password. Payments happen entirely inside Apple's App Store. We do not collect precise location, contacts, photos, health-app data, advertising identifiers or browsing history.
4. Sensitive information about your emotional life
What you share with InnerReset is about your inner life: feelings, relationships, loss, stress. It may reveal information about your mental health, even when you do not say so directly. The reading our model makes of your words and the result of the safety check can reveal the same kind of information. We treat all of these as data concerning health, a special category of personal data under Article 9 of the GDPR, wherever you live.
Legal basis: explicit consent (Article 9(2)(a) GDPR). We process this data only with your explicit consent, for three purposes: using your expressions to make and store your creations with the providers named in section 6; the automated safety check described in section 7; and, if you opt in, the aggregate-insight summary described in section 8.
How we ask. Before your first creation, as a guest or with an account, the app shows a consent screen that names these purposes and the providers, explains the automated safety check, and asks you to tick two boxes: that you are 18 or older, and that you agree to this processing of your sensitive data. Nothing is pre-ticked. We record the date, the version and language of the text and a fingerprint of it. Accepting the Terms, or continuing to use the app, is not consent. Without this consent the app does not start a creation.
Withdrawing consent, or objecting. You can do this at any time in Settings → Privacy & data, or by writing to us. After withdrawal the app asks for your consent again before any new creation; what you already made stays in your library, and you can ask us to delete it. Withdrawal does not affect processing that took place before it. For aggregate statistics only, turning off the statistics switch in Settings deletes the summaries linked to you and excludes your creations from every statistic; everything else keeps working.
5. Why we use your data, and on what legal basis
| Purpose | Data used | Legal basis (GDPR) | How long |
|---|---|---|---|
| Creating and running your account; signing you in; keeping your library across devices | Account data, technical data | Contract (Art. 6(1)(b)) | Until you delete your account |
| Making your creations: reading your expression, asking at most one clarifying question, writing, checking and voicing the text, storing and playing the result | Expressions, creations, interpretation data | Contract (Art. 6(1)(b)) and explicit consent (Art. 9(2)(a)) | Until you delete the creation or your account (section 13) |
| Optional cover art, when you ask for it | A short image description written by our language model from your creation | Contract (Art. 6(1)(b)) and explicit consent (Art. 9(2)(a)) | With the creation |
| Automated safety check and crisis resources | Expressions, safety data | Contract (Art. 6(1)(b)) and explicit consent (Art. 9(2)(a)) | Stopped text: removed within minutes. Safety record: section 13 |
| Aggregate statistics about how InnerReset is used | Aggregate-insight summary | Explicit consent (Art. 9(2)(a)) and legitimate interests (Art. 6(1)(f)): understanding and improving the service | With the Carry version, while your consent is on |
| Subscriptions, trials and credits; showing the cost before each action; returning credits | Subscription and credit data | Contract (Art. 6(1)(b)) | While your account exists, then accounting records as required by law |
| Sending you sign-in codes and the notices these Terms and this policy require | Account data, emails | Contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)) | Section 13 |
| Keeping proof of your choices | Consent records | Legal obligation (Art. 6(1)(c) with Art. 7(1)) | Until you delete your account |
| Answering support requests | Support messages, account data | Contract (Art. 6(1)(b)) or legitimate interests (Art. 6(1)(f)); health information you choose to include: explicit consent (Art. 9(2)(a)) | Section 13 |
| Security, abuse prevention, rate limits, cost limits, fixing errors | Technical data | Legitimate interests (Art. 6(1)(f)): keeping the service safe and working | Section 13 |
| Tax, accounting, responding to lawful requests | Subscription records | Legal obligation (Art. 6(1)(c)) | As long as the law requires |
| Establishing or defending legal claims | Relevant records | Legitimate interests (Art. 6(1)(f)); for health data, Art. 9(2)(f) | Only as long as the claim requires |
Our legitimate interests. We rely on them for security and abuse prevention, fixing errors and controlling costs, and aggregate statistics about how the service is used. None of them involves advertising, profiling for marketing, or selling data. You can object at any time (section 16).
6. How a creation is made, and which AI providers take part
Each creation passes through a few steps. Our server runs them; the providers below do the model work.
- Reading and safety. A language model reads your expression, checks it for safety (section 7), and forms a reading of what you want to say. It may ask you one clarifying question.
- Writing and checking. A language model writes the script of a Carry or the lines of a Mind Track, then checks that the result stays true to what you said. You approve the exact lines of a Mind Track before they are spoken.
- Voicing. A speech-synthesis model turns the approved text into speech in the voice you chose.
- Cover art (optional). If you ask for cover art, an image model makes a picture from a short description that our language model writes from your creation.
| Provider | What it receives | What it does |
|---|---|---|
| OpenAI (United States) | The text of your expression and clarifying answer, and the text generated from it | Reading, safety check, writing, checking; cover art, only if you ask for it |
| ElevenLabs (United States) | The approved text to be spoken, and the voice settings | Speech synthesis |
We send these providers only the text needed for the task, without your name, email address or account identifier, although your own words may contain names you chose to write. They do not receive your voice. Each provider acts under data-processing terms that limit it to providing its service to us and require it to protect your data. We do not use your content to train AI models. OpenAI may keep the data it receives for up to 30 days to detect abuse, and then deletes it.
Scripts, voices and cover art are made by AI models. The voices are synthetic performance voices; they are not the voice of any real person, and InnerReset does not clone voices. A creation is never rewritten without your action. InnerReset is not a medical service, and none of these steps makes a diagnosis.
7. The automated safety check
Before anything is written, a language model classifies your expression into one of four levels, from S0 (no concern) to S3 (signs of immediate risk to you or someone else), and records the topic of any concern. Our server applies fixed rules to the result: at S0 and S1 the creation is made normally; at S2 (signs of distress that are not immediate) it is made, written in a more protective way; at S3 it is stopped, no audio is made, and the app shows crisis resources for your language and region instead.
When a creation is stopped, the text of the expression is deleted from our database within minutes. We keep a short safety record: the level, the topic, the route applied, the version of the check, and the time; it contains none of your words. The credits held for the creation are returned. The provider that ran the check may keep the text for up to 30 days to detect abuse (section 6).
This is an automated decision. No person reviews it before it applies. It has no legal effect on you, but it can affect you, because it stops a creation you asked for, and a check of this kind can be wrong. We use it because we cannot safely make audio from words that suggest someone is in immediate danger. Its legal condition is your explicit consent (section 4); the consent screen tells you about this check before you agree.
Your right to human review. If you think a creation was stopped by mistake, write to support@innerreset.life. A person will review the decision, taking account of what you tell us; you can explain your point of view and contest the decision. Because the stopped text is deleted, we may ask you to send it again or describe it. If the decision was wrong, we will help you make the creation.
InnerReset is not a crisis service. If you are in danger, contact local emergency services or a crisis line.
8. Aggregate statistics about how InnerReset is used
If you opt in, we keep a short summary with each Carry version: the type of Carry and its point of view; the kind of relationship involved, if any; a short description, written by our language model, of the support you asked for and of the emotional tone; the safety level and topic; the form of the text and the language. It never contains your expression, the script, the lines or the title.
This summary is pseudonymous, not anonymous: it is stored with your creation, so it stays linked to your account or guest identity. It is never shown in the app and never used to make decisions about you. We use it only to produce aggregate statistics across many creations. Our reports count creations and never show a row per person; any relationship, tone or safety category that appears in fewer than five creations in a report is merged into "other". We never try to identify a person from a report.
Your choice. The consent screen offers this as a separate, optional switch that is off by default, and you can turn it on or off at any time in Settings → Privacy & data. When you turn it off, we delete the summaries linked to you and exclude your creations from every statistic. The summary is also deleted with the Carry, or with your account.
9. Speech and voice
When you hold the Speak control, your iPhone captures audio from the microphone and passes it to Apple's speech recognition. Depending on your iPhone and its settings, Apple processes it on the device or on Apple's servers, under Apple's own terms and privacy policy. InnerReset receives only the resulting text. We never receive, record or store your voice. You can always type instead of speaking, and you can allow or revoke microphone and speech-recognition access at any time in iOS Settings → InnerReset.
10. Information about other people
What you share often involves other people: a partner, a parent, a child, a friend, someone who has died. A Carry can also be written as imagined words from someone in your life; that imagined speech is written by AI at your request and is not a recording, not that person's voice, and not a statement by them.
We process information about other people only as part of your creation, for the same purposes and with the same protection as your own data. We do not contact the people you mention and we do not build profiles of them. Share only what you need for your creation, and avoid full names, contact details and sensitive facts about others that your creation does not need. You are responsible for having the right to share what you tell us about others. If you believe someone has shared information about you through InnerReset, write to us; we will help as far as we can without revealing the other person's data.
11. Who receives your data
We share personal data only with the recipients below, and only so they can provide their service to us or because the law requires it.
| Recipient | Role | What it receives |
|---|---|---|
| AI providers named in section 6 (United States) | Processors | The text described in section 6 |
| Hosting, database and storage providers (United States) | Processors | All data held by the service, including audio files and cover images |
| Subscription-management service (United States) | Processor | Our account identifier for you, App Store purchase and subscription records, and the basic app and device information its software needs |
| Email delivery service (United States) | Processor | Your email address and the content of the emails we send you |
| Our business email provider | Processor | Messages you send to support@innerreset.life |
| Apple | Independent controller for its own services | Sign in with Apple, speech recognition, App Store purchases, TestFlight |
| GitHub | Independent controller | Standard server logs when you visit innerreset.life (section 20) |
| Authorities and courts | Independent controllers | Only what the law requires |
We do not sell personal data, and we do not share it for advertising. If we are required by law to disclose data, we will tell you unless the law forbids it. If InnerReset were acquired or merged, your data would remain covered by this policy, and we would tell you before any change to how it is used.
12. International transfers
Rabiata LLC is in the United States. Our servers, database and storage are in the United States, and so are the providers listed in section 11. If you are in the European Economic Area, the United Kingdom or Switzerland, your data is therefore transferred to the United States.
We protect these transfers with the European Commission's Standard Contractual Clauses, which form part of the data-processing terms accepted with our providers, with the UK addendum and Swiss adjustments where relevant. Where a provider is certified under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions, that certification also applies. We also send providers only the text needed for a task, without your name, email address or account identifier; we encrypt data in transit; and we limit what each provider may do with it. You can ask us for a copy of the safeguards, with commercial terms removed.
13. How long we keep your data
| Data | How long |
|---|---|
| Account data | Until you delete your account. Deletion happens at once when you confirm it in the app |
| Creations (text, audio, cover art, versions, aggregate-insight summary) | Until you delete the creation or your account. A deleted creation leaves your library at once and is permanently deleted after 14 days (section 14) |
| Your original words (the expression and any clarifying answer) | Until the creation made from them is permanently deleted: 14 days after you delete it, or at once with your account, unless another creation of yours still uses them |
| Text of an expression stopped by the safety check | Deleted within minutes |
| Safety records (level, topic, route, version, time; no words) | While your account exists. When your account is deleted, the record loses every link to you and is kept only for safety statistics |
| Guest data | Until you delete the creation, or until you sign in, when it becomes part of your account. Guest data unused for 30 days may be deleted |
| Consent records | Until you delete your account |
| Credit ledger | Until you delete your account |
| Subscription records | While your account exists. At account deletion we remove their details and their link to you; the rest is kept as long as tax and accounting law requires |
| Records of each processing step (provider, model, time, cost; no content) | Kept for cost accounting; at account deletion their link to you is removed |
| Server logs (IP address, requests, errors; content is removed before logging) | 30 days |
| Job-queue entries | Removed 24 hours after a task completes, or 7 days after it fails |
| Emails we send you | Delivery records are kept by our email delivery service for 30 days |
| Sign-in codes | 10 minutes |
| Sign-in sessions | Access tokens expire after 30 minutes; refresh tokens after 60 days, or at once when you sign out or delete your account |
| Download links | Expire after 24 hours |
| Audio downloaded to your iPhone | Until you remove it (Settings → Remove downloaded audio) or delete the app |
| Support messages | 3 years after our last exchange |
| Backups | Deleted data disappears from our database backups within 30 days |
| Aggregate reports | Kept without limit. They count creations and contain no row about any individual |
14. Your controls in the app
- Export: Settings → Privacy & data → Prepare data export gives you a machine-readable file (JSON) with your account, profile, consent records, subscription history, creations with their versions, approved lines, and Journey settings and listening history. You need an account. For anything not in the file, write to us.
- Delete a creation: use the creation's menu or swipe. An Undo line appears for a few seconds. For 14 days after that, we can restore it if you write to us. Then it is permanently deleted, with its audio and image files and the words it was made from.
- Delete your account: Settings → Privacy & data → Delete account. When you confirm, we delete your account and everything linked to it: creations, expressions, consent records and credits. Safety records and processing-step records lose every link to you. A background job removes the audio and image files from storage shortly afterwards, normally within 24 hours. This cannot be undone. Deleting your account does not cancel an Apple subscription; cancel it in your Apple ID settings.
- Consent: Settings → Privacy & data shows the consent you gave, lets you withdraw it, and holds the statistics switch.
- Microphone and speech: allow or revoke at any time in iOS Settings → InnerReset.
- Downloads: Settings → Remove downloaded audio deletes the copies on your iPhone.
- Subscription: managed in your Apple ID settings, or from the plan sheet in the app.
15. Your rights
Wherever you live, you can ask us to: access the personal data we hold about you, including the reading our model made of your expressions and your safety records, and receive a copy; correct data that is wrong or incomplete; delete your data; restrict our use of your data, for example while we check a complaint; receive your data in a portable, machine-readable format; object to our use of your data based on legitimate interests (section 16); withdraw your consent at any time (section 4), without affecting what was done before; and not be subject to a decision based solely on automated processing without the safeguards in section 7, and obtain human review of it.
How to use your rights. Use the app's controls (section 14), or write to support@innerreset.life. To protect your data, we may ask you to confirm the request from the app or from the email address linked to your account. If you used InnerReset as a guest, we can find your data only with information from the device that holds the guest identity. You can use an authorised agent; we will check the agent's authority.
When we answer. Within one month. For complex or numerous requests, we may extend this by two more months; we will tell you within the first month. Requests are free, unless they are manifestly unfounded or excessive.
Complaints. You can complain to a data-protection authority: in France the CNIL (cnil.fr), or the authority of the EU country where you live, where you work, or where you think the problem happened; in the United Kingdom the ICO (ico.org.uk); in Switzerland the FDPIC (edoeb.admin.ch). You do not need to contact us before you complain.
Instructions for after your death (France). If you live in France, you can give us instructions on what happens to your personal data after your death, and name a person to carry them out. Send them to support@innerreset.life. You can change or withdraw them at any time.
16. Your right to object
You can object at any time, for reasons relating to your particular situation, to our use of your data based on legitimate interests, including aggregate statistics (section 8), security logging and error fixing. Write to support@innerreset.life. We will stop, unless we have compelling legitimate grounds that override your interests, rights and freedoms, or we need the data to establish, exercise or defend legal claims. We do not use your data for direct marketing.
17. Do you have to give us your data?
No law requires you to give us personal data. To make a creation, we need your expression and your explicit consent. To keep a library across devices, buy a plan or start a trial, you need an account. Microphone access, profile details and cover art are optional.
18. Children
InnerReset is for adults. You must be at least 18 years old to use it, and the app asks you to confirm this before your first creation. We do not knowingly collect personal data from anyone under 18. If we learn that a person under 18 has used InnerReset, we delete their account or guest data and everything linked to it. If you believe a minor has used the app, write to support@innerreset.life.
19. Security
All data travels encrypted between the app, our servers and our providers. Our server checks your permission on every request; your creations are visible only to you. Audio and images are stored privately and reached only through links that expire. Each provider has its own restricted credentials. Our logs remove the content of expressions, scripts and lines before anything is written. Your sign-in and guest tokens are stored in your iPhone's Keychain, on that device only. When you delete something, our deletion jobs remove the stored files, not only the database records.
No system is perfectly secure. If a breach affects your data, we will notify the competent authorities and you as the law requires; under the GDPR, we notify the authority within 72 hours where required.
20. Analytics, crash reports and cookies
The app runs no analytics or crash-reporting software and does not track you across other apps or websites. If you have chosen in iOS settings to share analytics with app developers, Apple may give us crash reports and usage statistics under Apple's terms. If you test InnerReset through TestFlight, Apple shares your tester details and feedback with us under Apple's terms.
innerreset.life is a static site hosted by GitHub Pages. It sets no cookies, runs no analytics, and has no forms. GitHub may keep standard server logs under its own privacy statement.
21. Notices for people in the United States and other countries
Consumer health data. If you live in Washington, Nevada or Connecticut, or your data is collected in one of those states, our Consumer Health Data Privacy Notice explains what consumer health data we collect, why, with whom we share it, and how to use your rights. It forms part of this policy.
California. We do not sell personal information, and we do not share it for cross-context behavioural advertising, and have not done so in the past 12 months. We use sensitive personal information, including information about your health, only to provide the service you ask for, as permitted by California law. You can ask to know, delete or correct your personal information, and we will not treat you differently for doing so.
Other US states. You can use the rights in section 15. If we refuse a request, you can appeal by replying to our answer with the word "appeal". We will answer within 60 days and tell you how to contact your state attorney general if you disagree.
Canada. We are accountable under PIPEDA for the personal information we hold. It is processed and stored in the United States, where it may be accessible to courts, law-enforcement and national-security authorities under US law. You can complain to the Office of the Privacy Commissioner of Canada. In Quebec, our privacy contact is support@innerreset.life; sensitive information is processed only with your express consent (section 4); before communicating personal information outside Quebec we assess whether it receives adequate protection, and section 12 describes the protections applied to transfers to the United States.
Australia and New Zealand. We disclose your personal information to recipients in the United States (section 11). Those recipients are not bound by the Australian Privacy Act or the New Zealand Privacy Act, and you may not be able to seek redress against them under those Acts; the protections in section 12 apply instead. You can complain to the OAIC or to the New Zealand Privacy Commissioner.
Brazil. You have the rights in the LGPD, including confirmation, access, correction, anonymisation, portability, deletion and information about sharing, through section 15. Your sensitive data is processed with your specific and highlighted consent (section 4). International transfers rely on the mechanisms in section 12 and, where the law requires it, on your specific consent. Our data-protection contact (encarregado) is support@innerreset.life. You can complain to the ANPD.
Japan and South Korea. Your personal information is transferred to and processed in the United States by us and by the providers in section 11, for the purposes and retention periods in sections 5 and 13. The United States has no data-protection law equivalent to Japan's APPI or Korea's PIPA; the safeguards in section 12 apply. In Korea, you may refuse this transfer by not using the service; the transfer takes place when you make a creation, by encrypted network transfer. You can complain to the PPC (Japan) or the PIPC (Korea).
India and Singapore. Our grievance officer (India) and data-protection contact (Singapore) can be reached at support@innerreset.life. You can complain to the Data Protection Board of India or to the PDPC of Singapore.
Everywhere else. The rights in section 15 are available to you wherever you live. If your country's law gives you a right this policy does not mention, write to us and we will honour it wherever it applies to us.
22. Changes to this policy
We will post any change on this page with a new effective date. For a material change, we will tell you in the app or by email before it takes effect. If a change needs your consent, for example a new use of sensitive data, we will ask for it and will not apply the change to you without it.
23. Contact
Rabiata LLC, 5830 East 2nd Street, Ste 7000, Casper, WY 82609, United States support@innerreset.life ("Privacy" in the subject line)