🎯 Onzy

Privacy Policy

Effective date: October 5, 2026  ·  DryDev Professional Services LLC

Onzy ("we," "us," or "our") is operated by DryDev Professional Services LLC. This Privacy Policy explains how we collect, use, and protect your personal information when you use the Onzy application ("Service"). By using the Service you agree to this policy.

1. Information We Collect

We collect information you provide directly and information generated through your use of the Service:

• Account information — email address, display name, password (stored as a secure hash by Supabase Auth), and date of birth (collected at signup to confirm you are 18 or older).
• Profile data — display name, Spotter ID, AI coach preference, and subscription tier.
• Task data — task titles, categories, priorities, due dates, notes, and completion status.
• Vibe check data — mood ratings and optional notes you submit for AI coaching.
• Spotters — connections you create with other users (stored by user ID only).
• Broadcasts — messages and reactions you send to connected users.
• Subscription data — your plan tier, billing status, and Stripe customer ID. We do not store full card numbers; payments are processed by Stripe.
• Usage data — server logs and error reports (collected by Vercel, Supabase, and Sentry), and product analytics (collected by PostHog; see "Analytics and session recording" in Section 3).
• Approximate location — we work out your approximate location from the IP address your requests come from. We save only your country, on your account. The city and region are used for the "Last signed in from" line in Settings → Security, which only you see, and we do not save them. We never use GPS or ask your device for its precise location.
• QR code scans — when you scan an Onzy QR code (for example, on a T-shirt), we record which code it was, the time, the approximate country, region, and city the scan came from, and your browser's identification text (the browser and device type). We work out the location from your network address and we do not save that address. The record is not linked to an account, a name, or an email address, and we use it to count scans and see where they come from.
• Visits to our website — when you visit our public website (onzy.app), PostHog counts page views and clicks on the home page and Sentry reports page errors. This is not linked to an account, a name, or an email address.
• Voice data — when you use voice capture, your spoken audio is sent to Deepgram to be transcribed into text, and Onzy does not keep that recording. Voice notes you send to a Spotter are stored as audio files.
• Photos and screenshots — if you add a profile photo, we store it. If you send a bug report with a screenshot, we store the screenshot. How long each is kept is in Section 6.
• Coach memory & behavioral profile — to make the AI Coach feel personal, Onzy builds and stores a small, evolving profile of you from how you use the app. This includes things the Coach has "noticed" about you (your patterns and struggles), the strategies and nudges that have worked for you, your preferred tone, and your typical productive times of day. It is distilled over time from your tasks, vibe checks, coach conversations, and which nudges you act on. This profile is private to you, is never sold or shared, and is never used to train any AI model. You can view, edit, delete, or pause it at any time — see Your Coach Memory Rights below.

2. How We Use Your Information

• To provide, operate, and improve the Onzy Service.
• To authenticate your account and keep it secure.
• To build and maintain your private Coach memory profile (see Section 1) so the AI Coach can personalize its suggestions, tone, and timing to you. This profiling happens only to power your own coaching experience — it is never used for advertising, never sold, and never used to train an AI model. You can view, edit, delete, or pause it at any time (see Your Coach Memory Rights).
• Coach and AI Day Plan features send prompts to third-party AI providers (Google Gemini, and Anthropic's Claude for some coaching text). These prompts include your first name, so the coach can use it, but not your email address. To give useful coaching, they can also include what you've told Onzy and what it has learned about how you work — your tasks and notes, your check-in and vibe entries, and a short learned profile of your patterns and preferences. Spoken (voice) coach replies are generated by Google and AWS — Claude is used for text only. Neither provider trains its models on your data per their API terms. AI provider data handling is subject to their own privacy policies.
• To process subscription payments through Stripe. Stripe's Privacy Policy governs payment data.
• To send push notifications you have opted into (Nudge Time reminders, bud activity).
• To communicate with you about your account, updates, and support, including one gentle email if you have been away for a while (you may unsubscribe at any time).

3. Third-Party Services

Onzy relies on the following third-party services, each with their own privacy practices:

• Supabase — database, authentication, and real-time infrastructure. Data is stored in us-east-1 (AWS). Supabase Privacy Policy.
• Vercel — application hosting and edge functions. Vercel Privacy Policy.
• Stripe — payment processing. Onzy does not store your full card details. Stripe Privacy Policy.
• Google Gemini API — AI coaching responses. Your vibe check text and task context are sent to Google for processing. Google AI Terms.
• Anthropic (Claude) API — AI coaching text generation. For some coach replies, the prompt text (your vibe check input and task context) is sent to Anthropic to generate the response. Anthropic does not use your data to train its models per its API terms. Claude generates text only — it is not used for voice. Anthropic Commercial Terms.
• Firebase Cloud Messaging (FCM) — push notification delivery. Firebase Privacy.
• Deepgram — speech-to-text transcription for voice input. When you use voice capture, your audio is sent to Deepgram for transcription. Deepgram Privacy Policy.
• AWS Polly (Amazon Web Services) — text-to-speech for spoken coach replies. The text of a coach response is sent to AWS to generate audio. AWS Privacy Notice.
• OpenAI — safety check (Moderation API). Receives the text transcript of voice input, to check it for harmful content. OpenAI Privacy Policy.
• Cloudflare Turnstile — an "are you human" check when you sign in, sign up, or confirm a sensitive account change. Receives your IP address and signals about your browser and device. Cloudflare Privacy Policy.
• Google Fonts — loads the fonts the app uses. Google receives your device's IP address. Google Privacy Policy.
• Have I Been Pwned — checks a new password against known data breaches. Your device sends only the first 5 characters of a scrambled (SHA-1) version of the password; the password itself never leaves your device. Have I Been Pwned Privacy Policy.
• Google Sign-In — only if you choose "Continue with Google". Google confirms who you are and shares your email address with us. Google Privacy Policy.
• PostHog — product analytics and opt-in session replay. Receives the account details and events listed under "Analytics and session recording" below, to help us improve the app. PostHog Privacy Policy.
• Microsoft Clarity — heatmaps and session replay, only if you allow session recording, to help us see how the app is used and improve it. Aggregate analytics, and session replays where available, may be reviewed by authorized Onzy administrators through a restricted, access-logged internal tool to diagnose problems and improve the product. Microsoft Privacy Statement.
• Resend — transactional email delivery (account, billing, trial, and notification emails). Resend Privacy Policy.
• Sentry — error monitoring and crash reporting. Receives your user ID and technical details about the error, which may include context about your session. Sentry Privacy Policy.
• Telnyx — text message (SMS) delivery for Pro+ text reminders and phone verification. Receives your phone number and the text of the message, and only if you add a number and turn on text reminders. Telnyx Privacy Policy.

Analytics and session recording. Product analytics is on by default and is not anonymous. Onzy uses PostHog to see which features are used. While you are signed in, PostHog receives your user ID, email address, plan, trial end date, account age, day counts (current and longest), coach style, and language, along with events such as "task created." You can turn this off at any time with the Usage analytics switch in Settings → Privacy & data. The switch is saved on the device you use it on, and it stops both PostHog and Microsoft Clarity. It does not stop error reports (Sentry) or the simple feature counts Onzy keeps in its own database.

Session recording is opt-in. Session replays are off by default. We use two session-replay tools, PostHog and Microsoft Clarity, to spot bugs and improve the app. They are disabled until you turn them on. We ask once whether to allow them; nothing records unless you choose "Allow." What you type is masked and never captured, and the text you've written (task names, notes, coach replies, brain-dumps) is masked in the replay. PostHog replays are tied to your account ID. Onzy does not give Clarity your name, email, or account ID. You can change your choice anytime in Settings → Privacy & data → Session recording, and it follows your account to a new device. Turning it off immediately stops both tools.

4. Text Messages (SMS)

If you add a phone number and turn on text reminders (a Pro+ feature), Onzy will text you only for two things: a reminder for a task you've told Onzy not to let you forget, sent right around when it's due, and a verification code when you add or confirm your number. We never send marketing texts.

Consent. Texting is opt-in — nothing is sent until you add your number and agree to this exact text: "I agree to receive text reminders from Onzy. Msg & data rates may apply. Reply STOP to opt out, HELP for help." You can turn text reminders off any time in Settings, and this consent is never assumed from using any other part of Onzy.

Frequency, quiet hours & help. Message frequency varies with how many tasks you've asked Onzy not to let you forget, up to a maximum of 5 texts per day; Onzy never texts between 9pm and 8am your local time. Reply STOP to opt out at any time, or HELP for assistance.

Rates, coverage & carriers. Message and data rates may apply. Text reminders are currently available to phone numbers in the United States and Canada only. We are not responsible for delayed or undelivered messages caused by your wireless carrier.

Your mobile information. Mobile information will not be shared with third parties or affiliates for marketing or promotional purposes. Your phone number is stored separately from your profile, used solely to deliver the reminders and codes above, and can be removed at any time — see Settings → Reminders or contact privacy@onzy.app.

5. Data Sharing

We do not sell your personal information. We share data only:

• With the third-party services listed above, as required to operate the Service.
• With other Onzy users you have explicitly connected with as Spotters.
• If required by law, court order, or to protect the rights and safety of Onzy, our users, or the public.

What a Spotter can see. When you connect with a Spotter, by default that person can see:

• Your display name, Spotter ID, and profile photo
• When you were last active (you can turn this off in Settings → Privacy & data → "Show my activity to Spotters")
• Your day count (how many days you have shown up) and your time zone
• Your birthday (month and day only), if you have added one
• Messages and voice notes you send to them, and any task you choose to share

You can lower what each Spotter sees, one Spotter at a time. "Momentum" shows only your day count, your time zone, and your wins. "Minimal" shows only your name and photo. Your Spotters cannot see your other tasks, your coach check-in notes, your email address, or your billing information.

6. Data Retention and Deletion

We retain your account data for as long as your account is active. You may delete your account at any time from within the app (Settings → Privacy & data → Delete my account) or on the web at onzy.app/delete-account. Deleting closes your account straight away and cancels any paid plan. Your coach memory and Spotter connections are removed right then. The rest of your data is kept for 30 days in case you change your mind (email support@onzy.app if you want the account back), then permanently deleted from Onzy's database. You may also request data export or deletion by emailing privacy@onzy.app.

How long we keep things:

• Spotter messages (text and voice notes): deleted automatically after 30 days, unless one has been kept or is held because it was reported.
• Profile photo: until you replace or remove it.
• Bug-report screenshots: up to 180 days, together with the report.
• Data exports: the download link we email you works for 1 hour, and the file is removed shortly after.
• Voice dictation: the audio is sent off to be turned into text, and Onzy does not keep the recording.

What deletion does not reach yet. Deleting your account does not yet remove your profile photo, voice notes you sent, or bug-report screenshots from our file storage. Email privacy@onzy.app and we will remove them. Your phone number, if you added one, is deleted with the rest of your data after the 30 days.

Analytics, error tools, and other providers. When you delete your account we ask PostHog to erase your profile and events. Sentry and Microsoft Clarity cannot erase the data of one person, so what they hold about you expires on each provider's own retention schedule. Other service providers (for example, for email, AI, and speech) keep what they received under their own policies.

What we keep after deletion. A one-way hash of your email address (a scrambled code that cannot be turned back into your address) is kept so a deleted account cannot be used to claim another free trial within 90 days. We may also keep information the law requires us to keep (for example, billing records may be kept for up to 7 years).

7. Your Coach Memory Rights (View, Edit, Delete, Pause)

Because the AI Coach builds a private behavioral profile of you (described in Section 1), you have direct, self-service control over it inside the app — no email or waiting required:

• View — Open the Coach memory panel to see exactly what Onzy has noticed about you, which strategies have worked, the tone it uses, and your typical productive times. Nothing is hidden.
• Edit — Correct or reword anything in your profile that is wrong or that you would rather the Coach not act on.
• Delete — Clear individual items or wipe your entire Coach memory. Deleted memory is removed and the Coach starts fresh.
• Pause — Stop the Coach from learning new things about you at any time. While paused, Onzy keeps coaching you but stops adding to or updating your behavioral profile. You can resume whenever you like.

You can also download your full Coach memory as part of the "Download my data" export, or delete it entirely by deleting your account. For help, email privacy@onzy.app.

8. Your Rights (GDPR — EEA & UK Users)

If you are in the European Economic Area (EEA) or the United Kingdom, you have the following rights under the General Data Protection Regulation (GDPR) or UK GDPR:

• Right of access (Article 15) — Request a copy of the personal data we hold about you.
• Right to rectification (Article 16) — Request correction of inaccurate or incomplete personal data.
• Right to erasure (Article 17) — Request deletion of your personal data ("right to be forgotten"). You can also delete your account directly in the app: Settings → Privacy & data → Delete my account.
• Right to restriction (Article 18) — Request that we limit how we use your data in certain circumstances.
• Right to data portability (Article 20) — Receive your personal data in a structured, commonly used, machine-readable format (JSON). Use the "Download my data" button in Settings → Privacy & data to get an export, or contact us for a full export.
• Right to object (Article 21) — Object to processing of your personal data for direct marketing.
• Right to withdraw consent — Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, use the self-service tools in Settings → Privacy & data, or email privacy@onzy.app. We will respond within 30 days. You also have the right to lodge a complaint with your local supervisory authority.

9. California Privacy Rights (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) grant you the following rights:

• Right to Know — You have the right to request disclosure of the categories and specific pieces of personal information we have collected about you, the categories of sources, our business purpose for collecting it, and the categories of third parties with whom we share it.
• Right to Delete — You have the right to request deletion of personal information we have collected from you, subject to certain exceptions. Use Settings → Privacy & data → Delete my account for self-service deletion.
• Right to Correct — You have the right to request correction of inaccurate personal information.
• Right to Data Portability — You have the right to obtain a copy of your personal information in a portable format. Use the "Download my data" button in Settings → Privacy & data.
• Right to Opt-Out of Sale / Sharing — We do not sell your personal information to third parties, and we do not share it for cross-context behavioral advertising. There is nothing to opt out of; however, if you believe this has changed, contact us at privacy@onzy.app.
• Right to Non-Discrimination — We will not discriminate against you for exercising your CCPA rights.

To submit a verifiable consumer request, email privacy@onzy.app with subject line "CCPA Request." We respond within 45 days.

Do Not Sell or Share My Personal Information: As stated above, Onzy does not sell or share personal information for cross-context behavioral advertising. If our practices change, this page will be updated and you will be notified.

10. Security

We use industry-standard practices including encrypted connections (HTTPS), row-level security on our database, and hashed passwords. No method of transmission over the internet is 100% secure, but we take reasonable steps to protect your information.

11. Children

Onzy is for adults. You must be 18 or older to use it, and it is not directed to anyone under 18. We ask for your date of birth at signup. If we become aware that someone under 18 has an account or has given us personal information, we will close the account and delete that information promptly. Contact privacy@onzy.app if you believe this has occurred.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the "Effective date" at the top of this page. Continued use of the Service after changes constitutes acceptance.

13. Contact Us

For privacy-related requests (data export, deletion, GDPR/CCPA rights): privacy@onzy.app.

For general questions about this Privacy Policy: support@onzy.app.