Who we are
Ryup is built and operated by Opengram Labs Private Limited, a company registered in India. In the language of India's Digital Personal Data Protection Act, 2023, we are the Data Fiduciary for the information described here, which means we are the ones accountable for it.
You can reach us about anything on this page at privacy@ryup.in. That address is monitored by a person, and it is the right address for a request to see, correct or delete your data.
What we collect, and why each thing exists
We collect five kinds of thing. Nothing here is collected speculatively; each row below names the feature that stops working without it.
| What | Why it exists |
|---|---|
| Your email address and display name, from Google Sign-In | To know that the account on a new phone is the same person, so your alarms, streak and history survive a reinstall. |
| Your phone number, if you give one | Optional. It is a way for us to reach you if a morning goes wrong, and you can leave it blank. |
| Answers you give during setup: your age, gender, life situation, preferred language, country and time zone, and your moon sign if you choose astrology content | These shape what you are given to read and talk about in the morning, and the time zone is what makes an alarm ring at the hour you actually set. |
| Your alarms: the times, the days, the label, the tone and the gentle-wake setting | To ring. These are stored on your phone first and mirrored to your account, so that reinstalling the app does not lose every alarm you set. |
| Voice recordings made during the morning activity | This is the product. Your speech is turned into text and judged, and that is where a score comes from. |
| Your results: the score, the reason behind it, a short summary of your mood, your streak and your badges | To show you your own history, and to keep a streak honest across devices. |
| Crash reports and a notification token from your device | To find out when the app breaks, and to send you a reminder when a morning is left unfinished. |
What happens to a recording
This is the part most worth understanding, so it gets its own section rather than a line in a table.
- You speak. The audio is saved on your phone first, so a bad network at 6am cannot lose your morning.
- The app uploads it to private storage we run on Amazon Web Services, in the Mumbai region. That storage blocks all public access and encrypts every file at rest.
- We send a short-lived, signed link to ElevenLabs, who convert the speech to text. The link expires; the recording is never publicly readable.
- The text, not the audio, goes to Anthropic, whose model produces your score and the summary of your mood.
- The score and summary are saved to your account. The audio is deleted automatically seven days after it was uploaded, by a rule on the storage itself rather than by anyone remembering to run something.
Text lasts longer than audio. When a recording is turned into text, that text is kept with that morning's record until you delete your account. We say this separately on purpose, so that "the audio is deleted after seven days" is not read as meaning nothing you said survives the week.
We do not use your recordings to train any artificial-intelligence model, ours or anybody else's. We do not sell them, and we do not share them with advertisers.
Who else sees your data
We use four outside companies. Each one is a processor working on our instructions, each receives only what its job needs, and none of them is permitted to use your data for their own purposes.
| Company | What they receive | What they do with it |
|---|---|---|
| Google (Firebase) | Your email address and a device identifier. Crash diagnostics. | Signs you in, tells us when the app has crashed, and delivers notifications to your phone. |
| ElevenLabs | A short-lived link to one voice recording. | Converts your speech into text and returns it to us. |
| Anthropic | The text of what you said. Not the audio. | Produces your engagement score and a short summary of your mood. |
| Amazon Web Services | Everything, as the place it is stored. | Runs our servers and holds our database and recordings, in the Mumbai region of India. |
We will also share information where the law requires it of us, and we would tell you if that ever happened unless we were forbidden from doing so.
Some of these companies operate outside India, so some of your data is processed abroad. Where that happens it remains covered by our agreements with them and by this policy.
How long we keep things
| What | How long |
|---|---|
| Voice recordings | Seven days from upload, then deleted automatically. |
| The text of what you said in each morning | Until you delete your account. |
| Your account, alarms and badges | For as long as your account exists. |
| Your scores, streak and the short mood line for each morning | For as long as your account exists, and afterwards without your name or email attached. See the next section. |
| Personal details after you delete your account | Erased. See the next section for exactly which fields. |
| Crash diagnostics | For as long as Firebase Crashlytics retains them under Google’s own policy. |
Your rights, and how to actually use them
Under India's Digital Personal Data Protection Act, 2023, you have the right to know what we hold about you, to have it corrected, to have it erased, to nominate someone to act for you if you die or become incapacitated, and to complain if we handle any of that badly.
Deleting your account is built into the app: open Profile, then Settings, then Delete account. You do not need to email anyone or wait for us to act.
When an account is deleted we erase your email address, your phone number, your display name, your age, your gender, your life situation and your moon sign. We also delete your alarms, your badges, the text of what you said, any recordings still inside their seven days, which stories you were shown, and what we had learned about what you like.
Some things are kept, and we would rather tell you than let you discover it:
| What is kept | Why |
|---|---|
| Your scores, streaks and the short mood line for each morning | Numbers and a few words, no longer attached to a name or an email once the rest is erased. Kept so that totals do not silently change every time somebody leaves. |
| Payment and subscription records | We are required to keep financial records for a period set by law. |
| The identifier your Google sign-in uses | So a deleted account cannot be quietly brought back to life by signing in again. It is kept unreachable, not usable. |
| Your assigned username, time zone, country and language | Settings rather than personal details. The username was assigned by us from a word list, not chosen by you. |
| A record that your phone was given a free trial | So deleting an account cannot be used to claim another trial on the same phone. |
If you want the kept items erased as well, write to privacy@ryup.in and say so. We will do it unless the law requires us to keep something, in which case we will tell you which item and why.
One limit worth stating plainly rather than burying: if you have a subscription that is still active through Google Play, we will ask you to cancel it before we delete the account. Deleting first would erase the account while Play carried on charging you, and you would find out on a card statement.
How it is protected
- Everything between the app and our servers travels over HTTPS.
- Recordings are stored in a bucket with all public access blocked, and are encrypted at rest with AES-256.
- A recording is only ever reachable through a signed link that expires, never through a public address.
- We never receive or store your Google password. Signing in is handled by Google, and we only ever see the result.
No system is perfect, and we would rather say that than imply otherwise. If we ever discover a breach affecting your data, we will tell you and the Data Protection Board of India, as the law requires.
If you believe you have found a security problem, please tell us at security@ryup.in rather than posting it publicly, and we will work with you.
Age, and younger users
You must be at least 13 years old to create a Ryup account. Ryup is not built for children under 13, we do not aim it at them, and if we find that we hold data about someone under 13 we delete it.
If you are between 13 and 18, you need permission from a parent or guardian before you use Ryup. India's Digital Personal Data Protection Act, 2023 treats everyone under 18 as a child, and requires a parent's consent before a child's data is handled. Creating an account is you telling us you have that permission.
Changes to this policy
If we change how we handle your data, we will update this page and change the date at the top. If a change is significant, we will tell you in the app rather than relying on you to notice a date.
Contact and complaints
For anything about your data, including a request to see, correct or delete it, write to privacy@ryup.in.
If you are not satisfied with how we have handled a request, you may complain to the Data Protection Board of India.