Privacy Policy

1. Who we are (data controller)

Boroto Ltd is the controller of your personal data. We are registered in England and Wales. You can reach us about anything in this policy at hello@symponia.io. Our company number is 15171190 and our registered office is 10 Church Square, Leighton Buzzard, LU7 1AE, England.

2. The short version

• Your cloud is an AI. To answer you, what you say or write is sent to Anthropic, the company that makes the AI. This only happens after you have given permission in the app, and you can take that permission back at any time.
• If you choose to hear replies out loud, the text of each reply is sent to ElevenLabs, which turns it into speech.
• When you speak, your iPhone turns your voice into text using Apple’s speech recognition. We never receive and never keep a recording of your voice.
• Your conversations are not stored on our servers unless you turn on “Remember our conversations”. The notes your cloud keeps about you stay on your phone, and you can read and erase them.
• We do not show adverts, we do not sell your data, and we do not use what you say to train AI models.
• When we advertise Symponia elsewhere, a measurement service called AppsFlyer may tell us that an advert led to an install or a subscription. It is never given anything you say or write, your name or your email address. Your iPhone may ask whether you allow Symponia to track you; the app works the same whatever you answer (section 13).
• You can delete your account and everything we hold from the You tab in the app.

3. The personal data we collect

What you give us as you use the app:

• a first name, if you choose to give one, and the name you give your cloud;
• your language, and the manner you ask your cloud to speak in (short and direct, warm and plain, or deep and philosophical);
• your seven animals, the date you chose them, and earlier sets if you choose again;
• your daily check-ins (the “weather” you pick before and after a conversation), used to show you your own pattern over time;
• whether you have asked for a daily reminder and at what hour. Reminders are scheduled on your phone; we do not send them from our servers;
• the replies you choose to report to us with the report button. Only the text of that one reply is sent, so that we can see what went wrong;
• if you used an earlier version of Symponia: a gender and the answers to a set of opening questions, where you gave them. They stay in your account until you delete it.

What you say and write in conversations. This is sent to our AI provider so that your cloud can answer (section 5). It is kept on your phone. It is stored on our servers only if you turn on “Remember our conversations”, which is off unless you say yes; in that case we keep the most recent part of your conversation (up to 40 messages) in your account so that it survives a new phone or a reinstall.

What stays on your phone and never reaches our servers:

• the notes your cloud keeps about you (what matters to you and how you like to be spoken to), written only if you have chosen to be remembered. You can read every word and erase them under You, “What your cloud knows about you”;
• anything you write there yourself about how you want to be spoken to;
• your login, which is held in the iPhone Keychain and is not included in backups;
• the Face ID lock, if you switch it on. Face ID is handled entirely by your iPhone; we never receive any biometric data.

These notes and your own words are sent along with your messages to the AI provider, as part of the conversation, so that the answer fits you. They are not stored by us.

Account and technical information:

• an account identifier. You can use Symponia with a temporary account that has no email address at all. If you choose to keep your account, we hold your email address, or the identifier that Sign in with Apple or Sign in with Google provides. We never see or store the password for your Apple or Google account;
• your subscription status and how many free messages you have left;
• a record of the permissions you have given (which wording you accepted, when, in which language and app version), which the law requires us to be able to show;
• counts of use, without content: how many messages you have sent, how much voice has been played, and the size of each request to the AI. We use these to apply fair-use limits and to understand our costs;
• limited technical information such as app version and language, used to keep the Service working and secure.

Purchase information: when you subscribe, Apple processes your payment. We receive confirmation of your subscription and of any voice credits you buy, from Apple and through RevenueCat, a service that keeps purchase records in order for us. Neither we nor RevenueCat ever receive or store your payment card details.

Advert measurement, only while we are running adverts for the app: that the app was installed and opened, with your IP address, basic details of your device (model, iOS version, language), an identifier for the install made by our measurement provider and the identifier Apple gives to our apps on your phone; and that a free trial or a subscription started, renewed or was refunded. If, and only if, you choose Allow when your iPhone asks about tracking: your phone’s advertising identifier. Section 13 explains this in full.

Please take particular care with special category information (such as details about your health, beliefs or sexuality). Where such information appears in what you say or write, we process it only to provide the Service to you, on the basis of your explicit consent, which you can withdraw at any time (section 11).

4. How and why we use your data, and our lawful bases

Under UK and EU data protection law we must have a lawful basis for using your personal data. We rely on the following:

• To perform our contract with you: to create and run your account, to let your cloud answer you in your language and in the manner you chose, to show you your own animals and check-ins, and to confirm your subscription with Apple.
• Your consent: to send what you say to our AI provider, to play replies out loud, to listen through the microphone, to remember you between conversations, to send reminders, to share your phone’s advertising identifier for advert measurement (asked by your iPhone, section 13), and to process any special category information contained in what you say. Each of these is asked for separately, and you can withdraw any of them at any time.
• Our legitimate interests: to keep the Service secure and working, to prevent misuse and fraud, to apply fair-use limits, to review replies that people report, and to learn whether our adverts lead people to install the app and subscribe, using only the limited information described in section 13, in a way that does not override your rights.
• Legal obligation: to comply with laws that apply to us, for example around tax, records of consent, and responding to lawful requests.

We do not use anything you say or write in the app for advertising or ad-targeting, and we do not sell your personal data. The only things from the app ever used to measure our adverts are that it was installed and opened, and that a free trial or a subscription began (section 13). Advertising cookies on our website are separate and optional (section 13).

5. How Symponia uses AI

Your cloud is an AI companion. Its replies are generated by Claude, an AI model made by Anthropic. Nothing is sent to Anthropic until you have given permission on the screen in the app that asks for it, and you can switch that permission off again under You, Privacy. Without it, your cloud cannot answer.

To generate a reply we send Anthropic: what you have just said or written and the recent part of the same conversation; your first name if you gave one; your seven animals; your language and the manner you chose; and, if they exist, the notes your cloud keeps about you and your own words about how you want to be spoken to. If you used an earlier version of the app, the gender and opening answers you gave then may also be included.

If you have chosen to be remembered, or have a daily reminder switched on, then after a conversation has ended it is sent to Anthropic once more so that the AI can write your cloud’s short notes and one sentence for the next morning’s reminder. That sentence is written to give nothing away to anyone who might see your lock screen.

How long Anthropic keeps it. Anthropic states that it deletes what is sent through its API within 30 days, unless it is flagged for breaking its usage policy, in which case it may be kept longer for safety review, or the law requires otherwise. Under its commercial terms Anthropic does not use this content to train its models. We do not have a “zero data retention” agreement with Anthropic. See anthropic.com/legal/privacy.

When something sounds like an emergency. The app checks what you write, on your phone, for words that suggest you may be in danger, so that it can show you helplines straight away. This check happens on your device and is not sent to us.

Symponia generates content automatically, but it does not make solely automated decisions that produce legal or similarly significant effects about you. Symponia is a tool for reflection. It is not therapy, not medical advice, and not a decision-maker.

6. Voice

Voice is optional. You can use Symponia entirely in writing.

• When you speak. With your permission, the app uses the microphone and Apple’s speech recognition to turn what you say into text. On iPhones that support it this happens on the phone itself; on others, Apple processes the audio on its servers under Apple’s own privacy policy. We never receive the audio and we do not keep a recording. Only the resulting text is used, in the same way as text you type.
• When your cloud speaks. If you choose to hear replies, the text of each reply is sent to ElevenLabs, which returns it as speech. ElevenLabs receives that text and nothing that identifies you by name or email. It processes the text under its own terms and privacy policy and may keep it for a limited time. See elevenlabs.io/privacy-policy.

You can turn the voice off at any time in the conversation or under You. The first lines your cloud says when you start the app are recordings made in advance and involve no processing of your data.

7. Who we share data with

We share data only with the service providers who help us run Symponia, each acting under agreements that require them to protect it:

• Anthropic: provides the AI that generates replies (section 5).
• ElevenLabs: turns replies into speech, only if you choose voice (section 6).
• Supabase: secure database, sign-in and backend hosting for your account.
• Apple: App Store distribution, Sign in with Apple, speech recognition, and in-app purchases. Payment details are handled entirely by Apple.
• RevenueCat: keeps track of subscriptions and purchases made through Apple. It receives your account identifier (a random number, not your name or email) and what you have bought. It never receives anything you write or say in the app.
• Google: Sign in with Google, if you choose it, and Google Analytics on our website if you accept analytics cookies (section 13).
• Netlify: hosting for our website.
• Resend: delivers the emails you ask for from our website (section 12). It receives your email address and the email itself, nothing from the app.
• AppsFlyer: measures whether our adverts lead to installs and subscriptions, only while we are running adverts for the app (section 13). It never receives your account, your name, your email address or anything you say or write.
• TikTok, and Meta if we advertise on Facebook or Instagram: show our adverts. On our website, TikTok measures them only if you accept advertising cookies there. From the app they learn, through AppsFlyer and Apple, only that an advert led to an install, a free trial or a subscription, and they can connect that to you only if you chose Allow when your iPhone asked about tracking (section 13).

We may also disclose data if required by law, to protect the safety, rights or property of our users or others, or in connection with a business transfer, in which case we will tell you and continue to protect your data.

8. International transfers

Some of our providers (including Anthropic, ElevenLabs, Apple, Google, RevenueCat, Resend, AppsFlyer and the advertising platforms named in section 7) process data outside the UK and EEA, including in the United States. Where data is transferred internationally, we rely on appropriate safeguards recognised under UK and EU law, such as the UK International Data Transfer Agreement or Addendum and the European Commission’s Standard Contractual Clauses, together with additional protections where needed. You can ask us for more information about these safeguards.

9. How long we keep your data

We keep the data in your account for as long as the account exists. When you delete your account (You tab, “Delete account”) or ask us to erase your data, we delete it from our live systems, and it is removed from routine backups within a short period. Data kept only on your phone is removed when you sign out, delete your account, or delete the app.

A temporary account has no email address, so it cannot be recovered if you sign out, lose your phone or delete the app. The app tells you this and offers to keep the account for you.

Our providers keep what they receive for their own limited periods, described in sections 5 and 6. We may keep limited information for longer only where the law requires it (for example basic transaction records and records of consent).

If you ask us to delete data associated with your account, we will action your request within 30 days.

10. How we protect your data

We use technical and organisational measures to protect your data, including encryption in transit, database rules that let an account read and change only its own records, storage of your login in the iPhone Keychain, an optional Face ID lock that also hides the app in the app switcher, and reputable infrastructure providers. No method of transmission or storage is completely secure, but we work to protect your information and to respond quickly if something goes wrong, including notifying you and the relevant authority where the law requires it.

11. Your rights and your controls

In the app, without asking us, you can: read and erase the notes your cloud keeps about you; switch remembering on or off; withdraw permission for AI, voice or the microphone; turn reminders off; ask for a copy of your data; sign out on every device; and delete your account.

If you are in the UK or the EEA, you also have the following rights over your personal data under the UK GDPR and the EU GDPR:

• Access: get a copy of the personal data we hold about you;
• Rectification: have inaccurate data corrected;
• Erasure: have your data deleted (“right to be forgotten”);
• Restriction: ask us to limit how we use your data;
• Portability: receive your data in a portable, machine-readable format;
• Objection: object to processing based on our legitimate interests;
• Withdraw consent: at any time, where we rely on your consent, without affecting earlier processing.

To exercise any of these rights, email hello@symponia.io. We will not charge you or treat you differently for exercising your rights. If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner’s Office (ico.org.uk) or your local supervisory authority in the EEA.

12. Marketing

We only send marketing emails if you have asked for them. On our website, after the free test, you can leave your email address to have your full reading sent to you, to be told when a new version of the app is out and to receive occasional news; if you do, we keep that address, the page language, the time you signed up and the seven animals you chose, in our database at Supabase, until you ask us to remove it. The emails are delivered by Resend, which receives your address and the text of the email for that purpose only. To stop the box being misused we also keep, for one day, a scrambled fingerprint of the network address each attempt came from; it cannot be turned back into the address and is not linked to your email. The first email we send to an address carries the link to the reading; opening it confirms that the address is yours, and we send news only to addresses that have been confirmed. Every marketing email includes a way to unsubscribe, and you can opt out at any time by using it or by emailing hello@symponia.io. Opting out of marketing does not affect service messages that are necessary to run your account.

13. Cookies, the website and measuring our adverts

Our website uses the cookies and local storage needed to make the site work and to remember basic preferences, including your cookie choice. Where the law requires your consent, we ask for it first; with it, we use Google Analytics 4, a service provided by Google, to understand how visitors find and use the site. Google Analytics sets cookies (such as _ga) and processes usage data such as the pages you view, your approximate location derived from your IP address, your device and browser type, and the page that referred you. If, and only if, you press Accept in the cookie banner, we also load a small script from TikTok (the TikTok Pixel), so that we can tell whether our adverts on TikTok bring people to this site. It sets cookies (such as _ttp) and tells TikTok that a page was opened, that the App Store button was tapped, that the free test was finished, or that someone joined our email list, together with your IP address and browser details. It is never told which animals you chose, your email address or anything else you type, and it is not loaded at all unless you accept. We do not sell this data. You can accept or decline these cookies in the banner shown on your first visit, and change your choice at any time using the “Cookie settings” link at the bottom of every page. We also count page views and clicks on the App Store button with our own first-party measure, which uses no cookies and records no IP address; it stores a random visitor identifier on your device only if you have accepted analytics or where consent is not required.

In the app. The app itself shows no advertising. When we are running adverts for Symponia on other services, the app may use a measurement service, AppsFlyer, so that we can tell whether an advert led someone to install the app and to subscribe. AppsFlyer is told that the app was installed and opened, with your IP address, basic details of your device (model, iOS version, language), an identifier it makes for the install and the identifier Apple gives to our apps on your phone; and, through RevenueCat, that a free trial or a subscription started, renewed or was refunded. It is never given your account, your name, your email address, your animals or anything you say or write. Apple also sends us and AppsFlyer its own anonymous counts of installs that came from adverts; these name a campaign and never a person or a phone. When we are not running adverts, none of this is switched on.

Tracking, and your choice. Your iPhone may ask whether you allow Symponia to track you. Only if you choose Allow is your phone’s advertising identifier shared with AppsFlyer and with the service that showed you the advert (such as TikTok or Meta), so that the install can be matched to the advert. Apple calls this tracking. If you choose “Ask App Not to Track”, your advertising identifier is not shared, and the app works exactly the same. You can change your answer at any time in your iPhone’s Settings, under Privacy & Security, Tracking.

14. Children

Symponia is for adults. It is not directed at anyone under 18, the app asks you to confirm that you are 18 or over, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us at hello@symponia.io and we will delete it.

15. Changes to this policy

We may update this Privacy Policy from time to time. We will change the “Last updated” date above and, where a change affects what you agreed to in the app, the app will ask for your agreement again before it carries on.

16. Contact

For any privacy question or request, contact our privacy team at hello@symponia.io.