Privacy Policy

Last Updated: November 1, 2025

Welcome to BYANA, your personal ADHD coaching companion. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application.

            Your Privacy Matters: We are committed to protecting your personal information and your right to privacy. This policy is designed to help you understand what information we collect, how we use it, and what rights you have.
        

1. Information We Collect

1.1 Personal Information You Provide

Account Information: When you sign in with Google, we collect your email address, name, and profile picture.
Health Screening Data: Responses to ADHD screening questionnaires (WHO ADHD Self-Report Scale).
Chat Conversations: Messages you exchange with our AI coaching assistant.
Subscription Information: Payment and subscription details managed through RevenueCat and app store providers.

1.2 Information Collected Automatically

Device Information: Device type, operating system, unique device identifiers.
Usage Data: App features you use, session duration, crash reports.
Push Notification Tokens: Device tokens for sending notifications.

1.3 Camera and Photo Access

We request camera permission for the following optional features:

Profile Photo: Upload a profile picture to personalize your account.
Progress Tracking: Take photos to track your ADHD management progress (workspace organization, habit completion, etc.).
Document Scanning: Scan documents related to your health management.

Important: Camera access is entirely optional. We only access your camera when you explicitly choose to use these features. Photos are stored locally on your device and only uploaded to our servers if you choose to share them.

2. How We Use Your Information

We use your information to:

Provide Services: Deliver personalized ADHD coaching and support.
Authentication: Manage your account and secure your sessions.
AI Coaching: Generate personalized coaching responses using Azure OpenAI.
Notifications: Send you reminders, tips, and updates via push notifications.
Analytics: Understand app usage and improve our services (using anonymized data only).
Subscription Management: Process and manage your subscription payments.
Support: Respond to your inquiries and provide customer support.
Legal Compliance: Comply with legal obligations and enforce our terms.

3. Data Storage and Security

3.1 Where We Store Your Data

Primary Database: PostgreSQL hosted on Hetzner servers in Germany (EU region) - GDPR compliant.
AI Processing: Chat messages are processed by Azure OpenAI (Microsoft Azure, EU region).
Backups: Encrypted backups stored in EU data centers.

3.2 Security Measures

End-to-end HTTPS encryption for all data transmission.
Encrypted database storage.
Session-based authentication with secure, signed cookies.
Regular security audits and updates.
Access controls limiting employee access to user data.

4. Third-Party Services

We use the following third-party services:

4.1 Google Sign-In

Authentication provided by Google. Review Google's Privacy Policy.

4.2 Azure OpenAI (Microsoft)

AI coaching powered by Azure OpenAI. Your chat data is processed but not used to train AI models. Review Microsoft's Privacy Policy.

4.3 RevenueCat

Subscription management and payment processing. Review RevenueCat's Privacy Policy.

4.4 Expo Push Notifications

Push notification delivery service. Review Expo's Privacy Policy.

5. Your Privacy Rights

5.1 GDPR Rights (EU Users)

If you are located in the European Economic Area (EEA), you have the following rights:

Right to Access: Request a copy of your personal data.
Right to Rectification: Request correction of inaccurate data.
Right to Erasure: Request deletion of your personal data ("right to be forgotten").
Right to Data Portability: Receive your data in a machine-readable format.
Right to Restrict Processing: Request limitation on how we use your data.
Right to Object: Object to processing of your personal data.
Right to Withdraw Consent: Withdraw your consent at any time.

5.2 California Privacy Rights (CCPA)

If you are a California resident, you have the right to:

Know what personal information we collect and how it's used.
Request deletion of your personal information.
Opt-out of the sale of your personal information (note: we do not sell your data).
Non-discrimination for exercising your privacy rights.

5.3 How to Exercise Your Rights

To exercise any of these rights, please contact us at the email address below. We will respond within 30 days.

6. Data Retention

Account Data: Retained while your account is active.
Chat History: Retained to provide personalized coaching. You can delete conversations at any time.
Anonymized Analytics: Retained indefinitely for service improvement (cannot be linked back to you).
Deleted Accounts: All personal data deleted within 30 days of account deletion request.

7. Children's Privacy

BYANA is intended for users aged 13 and older. We do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, please contact us immediately.

8. International Data Transfers

Your information is primarily stored in the European Union (Germany). If you are accessing our services from outside the EU, your data may be transferred to and processed in the EU. We ensure appropriate safeguards are in place for such transfers in compliance with GDPR.

9. Cookies and Tracking

We use session cookies for authentication purposes. These cookies are essential for the app to function and cannot be disabled. We do not use tracking cookies for advertising purposes.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by:

Posting the new Privacy Policy in the app.
Updating the "Last Updated" date at the top of this policy.
Sending a push notification for significant changes.

11. Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us:

Email: privacy@byana.app

Website: api.byana.de

Response Time: We aim to respond to all privacy inquiries within 48 hours.

12. Legal Basis for Processing (GDPR)

We process your personal data based on the following legal grounds:

Consent: You have given explicit consent for specific processing activities.
Contract Performance: Processing is necessary to provide our services to you.
Legitimate Interests: We have legitimate interests in improving our services and preventing fraud.
Legal Obligations: We must comply with legal requirements.

13. Do Not Sell My Personal Information

We do not sell your personal information to third parties. We do not rent, sell, or share your personal information with third parties for their direct marketing purposes.

By using BYANA, you acknowledge that you have read and understood this Privacy Policy and agree to the collection, use, and disclosure of your information as described herein.