Privacy Policy

Effective Date: April 7, 2026 · Last Updated: April 7, 2026

Iris ("we," "our," or "us") operates the Iris mobile application (the "App"). This Privacy Policy explains how we collect, use, store, and share your information when you use the App.

By using Iris, you consent to the practices described in this Privacy Policy. If you do not agree, please do not use the App.

1. Information We Collect

1.1 Account Information

When you sign in with Google, we receive and store:

• Your name, email address, and profile photo (provided by Google OAuth)
• A unique user identifier

1.2 Google Gmail Data

With your explicit consent, we request read-only access to your Gmail account (gmail.readonly scope) to:

• Discover newsletter subscriptions by scanning email headers (sender name, sender email, List-Unsubscribe headers) from the past 30 days
• Fetch recent newsletter content (up to 3 emails per sender, truncated to 3,000 characters each) to generate your daily podcast episode
• Search for senders when you manually add a newsletter

What we do NOT do with your Gmail data:

• We do not read, store, or access personal correspondence
• We do not send, delete, or modify any emails
• We do not store raw email content — email bodies are processed transiently in server memory and are never written to our database
• We do not use Gmail data for advertising, market research, or any purpose unrelated to the App's core functionality

1.3 Saved Articles

When you share a web article URL into Iris, we extract and store the article's text content, title, author, and metadata. For Pro users, this content is used to generate audio read-alouds.

1.4 App Usage Data

We store data necessary for the App to function:

• Alarm settings (times, days, selected newsletters, voice preference)
• Audio episode metadata (status, timestamps, duration)
• Subscription tier (free or Pro)
• Device push notification token (for delivering notifications)

1.5 Device Permissions

The App requests the following device permissions:

• Notifications — to deliver alarm and episode-ready notifications
• Background audio — to continue playback when the App is in the background
• Alarm scheduling (iOS 26+) — to deliver alarms that bypass Silent Mode and Do Not Disturb

We do not access your camera, microphone, contacts, location, or any other device data.

2. How We Use Your Information

We use your information solely to provide and improve the App's core features:

We do not use your data for advertising, profiling, or sale to third parties.

3. How We Store and Protect Your Data

3.1 Infrastructure

All user data is stored in Supabase (PostgreSQL database and file storage), hosted on secure cloud infrastructure.

3.2 Google OAuth Token Encryption

Your Google access and refresh tokens are encrypted at rest using AES-256-GCM encryption before being stored in our database. The encryption key is stored as a server-side environment variable and is never exposed to the client application.

3.3 Access Controls

• Database row-level security (RLS) policies ensure each user can only access their own data
• Audio episode files are stored in a private storage bucket with per-user access restrictions
• Google tokens can only be written by our server-side service role — users cannot directly modify their stored credentials

3.4 Data Retention

4. Third-Party Services

We share limited data with the following third-party services to provide the App's core functionality:

4.1 Google (Authentication and Gmail API)

• Purpose: User authentication and Gmail inbox access
• Data shared: OAuth credentials; Gmail messages are read server-side
• Policy: Google Privacy Policy

4.2 OpenAI

• Purpose: Newsletter summarization (text generation) and text-to-speech audio generation
• Data shared: Newsletter email body text (truncated, processed transiently) and saved article text content
• Note: Email and article content is sent to OpenAI's API for processing. We do not control OpenAI's data handling beyond our API agreement with them.
• Policy: OpenAI Privacy Policy

4.3 Replicate

• Purpose: Alternative text-to-speech audio generation (Kokoro voice models)
• Data shared: AI-generated script text (not raw email content)
• Policy: Replicate Privacy Policy

4.4 Jina AI

• Purpose: Fallback article content extraction when primary extraction fails
• Data shared: The article URL only
• Policy: Jina AI Privacy Policy

4.5 Superwall

• Purpose: In-app subscription and paywall management
• Data shared: Your anonymous user identifier and subscription status
• Policy: Superwall Privacy Policy

4.6 Expo

• Purpose: Push notification delivery
• Data shared: Device push notification token
• Policy: Expo Privacy Policy

We do not integrate any advertising networks, analytics platforms, or data brokers.

5. Google API Services — Limited Use Disclosure

Iris's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

1. We only use Gmail data to provide and improve the App's user-facing features (newsletter discovery and podcast episode generation).
2. We do not transfer Gmail data to third parties except as necessary to provide the App's core functionality (newsletter content is sent to OpenAI for summarization), with user consent, or as required by law.
3. We do not use Gmail data for serving advertisements.
4. We do not allow humans to read Gmail data unless we have your affirmative consent, it is necessary for security purposes, to comply with applicable law, or our use is limited to internal operations with aggregated and anonymized data.

6. Your Rights and Choices

6.1 Revoke Gmail Access

You can revoke Iris's access to your Gmail at any time through your Google Account permissions. This will prevent the App from generating new podcast episodes but will not delete your existing account or data.

6.2 Delete Your Account

You may request account deletion by contacting us at info@joiniris.dev. Upon deletion, we will remove:

• Your profile and account data
• Your stored Google OAuth tokens
• Your alarm configurations
• Your audio episodes and saved articles

Newsletter sender metadata shared across users (sender name and email) will not be deleted, as it is not personally identifiable.

6.3 Data Export

You may request a copy of your personal data by contacting us at info@joiniris.dev.

6.4 Opt Out of AI Processing

The App's core functionality depends on AI processing of newsletter content. If you do not wish for your newsletter content to be processed by AI, you may stop using the App and delete your account.

7. Children's Privacy

Iris is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected data from a child under 13, we will promptly delete it.

8. International Data Transfers

Your data may be processed and stored in locations outside your country of residence, including the United States, where our infrastructure providers operate. By using the App, you consent to the transfer of your data to these locations.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy within the App or by other reasonable means. Your continued use of the App after changes are posted constitutes your acceptance of the updated policy.

10. Contact Us

If you have questions about this Privacy Policy or your data, contact us at:

Email: info@joiniris.dev
Website: https://joiniris.dev