Onzy ("we," "us," or "our") is operated by DryDev Professional Services LLC. This Privacy Policy explains how we collect, use, disclose, and protect your information when you use our service at onzy.app, in the web app at app.onzy.app, and in our mobile applications for iPhone, iPad and Android. This is the one Privacy Policy for all of them.
Account information: When you sign up, we collect your email address, password (hashed — never stored in plain text), and date of birth (to confirm you are 18 or older).
Profile information: Your display name, avatar, AI coach preference, and any profile details you choose to provide.
Subscription and purchase data: Your plan tier and billing status. For a website purchase this includes your Stripe customer ID; we do not store your full card number. If you buy in the iPhone or Android app, the App Store or Google Play takes the payment and we do not receive your Apple or Google payment details. Our purchase service, RevenueCat, tells us which plan you bought, from which store, and when it renews or ends. RevenueCat receives your Onzy user ID and the purchase record, along with basic technical details such as your IP address.
Usage data: Task titles, categories, priorities, due dates, notes and completion status, day counts, coach check-in and vibe check entries (mood ratings and optional notes), broadcast history, and Spotter connections you create within the app. We also keep server logs and error reports.
Coach memory & behavioral profile: To make the AI Coach feel personal, Onzy builds and stores a small, evolving profile of you from how you use the app — things the Coach has "noticed" about you (your patterns and struggles), the strategies and nudges that have worked for you, your preferred tone, and your typical productive times of day. It is distilled over time from your tasks, coach check-ins, conversations, and which nudges you act on. This profile is private to you, is never sold or shared, and is never used to train any AI model. You can view, edit, delete, or pause it at any time — see Your Coach Memory Rights below.
Photos, voice notes, and screenshots: If you add a profile photo, we store it. If you send a voice note to a Spotter, we store the audio. If you send a bug report with a screenshot, we store the screenshot. How long each is kept is in Section 7.
Voice data: When you use voice capture or talk to the coach, your spoken audio is sent to Deepgram to be turned into text, and Onzy does not keep that recording. Spoken coach replies are made by Amazon (AWS Polly) from the text of the reply.
Device and technical data: Browser type, operating system, IP address, and app version, collected automatically for security and performance monitoring.
Approximate location: We work out your approximate location from the IP address your requests come from. We save only your country, on your account. The city and region are used for the "Last signed in from" line in Settings → Security, which only you see, and we do not save them. We never use GPS or ask your device for its precise location.
QR code scans: When you scan an Onzy QR code (for example, on a T-shirt), we record which code it was, the time, the approximate country, region, and city the scan came from, and your browser's identification text (the browser and device type). We work out the location from your network address and we do not save that address. The record is not linked to an account, a name, or an email address, and we use it to count scans and see where they come from.
Visits to our website: When you visit our public website (onzy.app), PostHog counts page views and clicks on the home page and Sentry reports page errors. This is not linked to an account, a name, or an email address.
Communications: If you contact us for support, we retain that correspondence.
We do not sell your personal information to third parties. We do not use your data to train AI models.
Onzy is a social accountability app. When you connect with a Spotter, by default that person can see:
You can lower what each Spotter sees, one Spotter at a time. "Momentum" shows only your day count, your time zone, and your wins. "Minimal" shows only your name and photo. Your Spotters cannot see your other tasks, your coach check-in notes, your email address, or your billing information.
Coach and AI Day Plan features send prompts to third-party AI providers: Google Gemini processes your coach chats, and Anthropic's Claude writes some coaching text. In the Onzy apps for iPhone and iPad, the app asks for your OK before your first AI chat and does not send anything to these providers until you say yes. These prompts include your first name, so the coach can use it, but not your email address. To give useful coaching, they can also include what you've told Onzy and what it has learned about how you work — your tasks and notes, your check-in and vibe entries, and a short learned profile of your patterns and preferences. Spoken (voice) coach replies are generated by Google and AWS — Claude is used for text only. Neither provider trains its models on your data per their API terms. AI provider data handling is subject to their own privacy policies.
To personalize coaching, Onzy also builds a small, private behavioral profile of you — the patterns it has noticed, strategies that have worked, your preferred tone, and your productive times (see Your Coach Memory Rights). This profiling happens only to power your own coaching experience — it is never used for advertising, never sold, and never used to train an AI model. You can view, edit, delete, or pause it at any time from the Coach memory panel in the app.
Because the AI Coach builds a private behavioral profile of you (described in Section 1), you have direct, self-service control over it inside the app — no email or waiting required:
You can also download your full Coach memory as part of the "Download my data" export, or delete it entirely by deleting your account. For help, email privacy@onzy.app.
Your data is stored in Supabase (PostgreSQL) hosted in the United States (us-east-1, on Amazon Web Services). We use row-level security to ensure users can only access their own data. All data is encrypted in transit (TLS, HTTPS) and at rest, and passwords are stored only as hashes. We support multi-factor authentication (TOTP) for additional account security. No method of transmission over the internet is 100% secure, but we take reasonable steps to protect your information.
You may delete your account at any time from within the app (Settings → Privacy & data → Delete my account) or on the web at onzy.app/delete-account. Deleting closes your account straight away and cancels a plan you bought on our website. It does not cancel an App Store or Google Play subscription: those stores keep charging you until you cancel there, so cancel in the store first (App Store: Settings → your name → Subscriptions; Google Play: Payments & subscriptions → Subscriptions), then delete. Deleting does not by itself give a refund. Your coach memory and Spotter connections are removed right then. The rest of your data is kept for 30 days in case you change your mind (email support@onzy.app if you want the account back), then permanently deleted from Onzy's database. You may also request data export or deletion by emailing privacy@onzy.app.
How long we keep things:
Files you added. Your profile photo, the voice notes you sent, and the screenshots on your bug reports are kept for the 30 days after you delete your account, so you can still restore it. After those 30 days they are permanently deleted from our file storage together with the rest of your account. If you want them removed sooner, email privacy@onzy.app. Your phone number, if you added one, is removed as soon as you delete your account.
Analytics, error tools, and other providers. When you delete your account we ask PostHog to erase your profile and events. Sentry and Microsoft Clarity cannot erase the data of one person, so what they hold about you expires on each provider's own retention schedule. Other service providers (for example, for email, AI, and speech) keep what they received under their own policies.
Sign in with Apple. If you signed in with Apple, then when you delete your account we ask Apple to end Onzy's access to your Apple sign-in (we revoke the token Apple gave us). To be able to do that, we keep that token securely until then. It is deleted as soon as Apple has ended access, or with your account if Apple cannot be reached. Your account is deleted either way.
What we keep after deletion. A one-way hash of your email address (a scrambled code that cannot be turned back into your address) is kept so a deleted account cannot be used to claim another free trial within 90 days. We may also keep information the law requires us to keep (for example, billing records may be kept for up to 7 years).
Onzy is for adults. You must be 18 or older to use it, and it is not directed to anyone under 18. We ask for your date of birth at signup. If we become aware that someone under 18 has an account or has given us personal information, we will close the account and delete that information promptly. Contact privacy@onzy.app if you believe this has occurred.
We use session cookies for authentication. We do not use advertising cookies or cross-site tracking.
Product analytics is not anonymous. On the web it is on by default. In the Onzy apps for iPhone, iPad and Android it is off until you say yes. In the apps, usage analytics stay off until you agree: the app asks once, nothing is sent to PostHog until you tap "Allow", and tapping "Not now" leaves it off. Tapping "Allow" turns on usage analytics and session recording (see below). You can also turn on usage analytics alone with the Usage analytics switch in Settings → Privacy & data. Microsoft Clarity does not run in the apps. Onzy uses PostHog to see which features are used. Once analytics are on, and while you are signed in, PostHog receives your user ID, email address, plan, trial end date, account age, day counts (current and longest), coach style, and language, along with events such as "task created." You can turn this off at any time with the Usage analytics switch in Settings → Privacy & data. The switch is saved on the device you use it on, and it stops both PostHog and Microsoft Clarity. It does not stop error reports (Sentry) or the simple feature counts Onzy keeps in its own database.
Session recording is opt-in. Session replays are off by default. Onzy uses two session-replay tools, PostHog and Microsoft Clarity, to spot bugs and improve the app. They are disabled until you choose to turn them on. We ask once whether to allow them; nothing records unless you choose "Allow." Everything you type is masked and never captured. PostHog replays are tied to your account ID. Onzy does not give Clarity your name, email, or account ID. You can change your choice at any time in Settings → Privacy & data → Session recording, and it follows your account to a new device. Turning it off stops both tools.
If you choose to add a phone number and turn on text reminders (a Pro+ feature), Onzy will text you only for two things: a reminder for a task you've told Onzy not to let you forget, sent right around the time it's due, and a verification code when you add or confirm your number. We do not send marketing texts.
Consent. Texting is opt-in — nothing is sent until you add your number and agree to this exact text: "I agree to receive text reminders from Onzy. Msg & data rates may apply. Reply STOP to opt out, HELP for help." You can turn text reminders off at any time from Settings, and your consent is never assumed from using any other part of Onzy.
Frequency. Message frequency varies with how many tasks you've asked Onzy not to let you forget, up to a maximum of 5 texts per day. Onzy never sends a text between 9pm and 8am in your local time.
Opting out and help. Reply STOP to any text to opt out immediately — Onzy will stop texting you and send one confirmation message. Reply HELP for assistance, or contact support@onzy.app.
Rates and carriers. Message and data rates may apply, per your mobile carrier's plan. Text reminders are currently available to phone numbers in the United States and Canada only. Carriers are not liable for delayed or undelivered messages.
Your mobile information. Mobile information will not be shared with third parties or affiliates for marketing or promotional purposes. Your phone number is used solely to deliver the reminders and verification codes described above, and is stored separately from your profile with access restricted to you and to sending the text itself. See Your Rights to request its deletion at any time.
We share with each of these providers only the data it needs to do its job for Onzy, and they may use it only to provide their service to us. Any third party we share your data with is required to give it the same or equal protection as described in this policy.
Depending on your location, you may have the right to: access your data, correct inaccurate data, request deletion, restrict processing, or data portability. To exercise these rights, use the self-service tools in Settings → Privacy & data, or email privacy@onzy.app. We will respond within 30 days.
EEA and UK users (GDPR / UK GDPR). You have the following rights:
You also have the right to lodge a complaint with your local supervisory authority.
California residents (CCPA / CPRA) — Do Not Sell or Share My Personal Information. We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We have not done so in the preceding 12 months. You also have the rights listed above (know, access, correct, delete, and portability) and the right not to receive discriminatory treatment for exercising them. To make any of these requests — including opting out — email privacy@onzy.app with subject line "CCPA Request" and we will respond within 45 days, as required by the CCPA/CPRA. If our practices change, this page will be updated and you will be notified.
We may update this policy from time to time. We will notify you of material changes via email or in-app notice at least 14 days before the change takes effect. Continued use of Onzy after the effective date constitutes acceptance.
Privacy requests and questions about this policy (data export, deletion, GDPR/CCPA rights): privacy@onzy.app
Billing, subscriptions, and general support: support@onzy.app
DryDev Professional Services LLC
United States