Privacy policy.

1. Who’s responsible

Suzy is run by Michal Maciejewski, digital-mm, Bahnhofstraße 120c, 61267 Neu-Anspach, Germany, who is the controller of your data. For anything about your data: heysuzyapp@gmail.com. More details are in the imprint.

2. What we collect in the app

Your account

You sign in with Apple or with a sign-in link sent to your email. We store your Apple ID identifier or your email address. If you choose “Hide My Email”, that’s a private relay address. We also store the name you give Suzy, your birthday if you add it, and your language and time zone.

What you share with Suzy

• Chat messages and your answers in your first chat.
• What you say out loud: speech recognition runs on your iPhone. We only get the text, never a recording.
• Photos: outfits for a Fit-Check stay in your Fits gallery until you delete them. Chat screenshots for a Tea Check are deleted once she’s read them; the verdict stays in your chat.
• What you save: plans, journal entries, dreams on your Vision Board, Daily Vibes, your three things for the month and Suzy’s look.

When you tell Suzy about other people or send a screenshot, we process that too, only to answer you. Please only share what you’re allowed to share.

What Suzy remembers

Facts from your chats, like “Mia: best friend from work”, and patterns in how you use the app. So Suzy can find the right memory, we store a numeric vector (an embedding) for each one. You can see everything in Settings → What I know about you.

Only with your permission

• Microphone and speech recognition: when you talk to Suzy.
• Camera: for Fit-Checks.
• Photos: to save cards and, if you allow it, to spot new screenshots so Suzy can offer to read a chat. Picking a photo yourself needs no permission.
• Calendar: to add the plans you save.
• Notifications: for check-ins and reminders.

Purchases

Apple handles payment. Through RevenueCat we only get your subscription status, like trial, active or canceled, and which plan you have. Never your payment details.

Devices and usage

For each device we store a device ID, the app version, a notification token and your sign-in session. Our servers log requests with IP addresses to catch errors and abuse. We also count simple events, like “first chat finished” or “trial started”, with a pseudonymous ID and without your name, email or anything you wrote (PostHog, servers in the EU).

3. How we use it

• To make Suzy work: her replies, what you save and your monthly recap.
• To personalize: what Suzy remembers and the patterns she notices. You can turn both off.
• For notifications: check-ins and reminders, within your settings.
• For your subscription, daily usage limits and invite rewards.
• For safety and reliability: preventing fraud and abuse, fixing bugs.
• To improve Suzy, using the usage events in section 2. We don’t train AI models on your chats.

4. How Suzy’s AI works

For Suzy to reply, we send your message, the relevant part of the conversation, related memories and any photos you attach to Anthropic (Claude). Anthropic processes them on our behalf and doesn’t use them to train its models. To search Suzy’s memory, we send the text of a memory or message to Voyage AI, which turns it into an embedding. Voyage AI also works on our behalf, and we’ve opted out of any use for training.

Suzy’s replies are suggestions. We don’t make decisions about you based solely on automated processing that have legal or similarly significant effects.

5. Who we share it with

We only share your data with service providers that run Suzy for us under data processing agreements:

• Hetzner Online GmbH, Germany: servers, database and files, all in Germany.
• Anthropic PBC, USA: Suzy’s replies (section 4).
• Voyage AI, USA: embeddings for Suzy’s memory (section 4).
• Resend, sending from the EU: emails like sign-in links and your data export.
• RevenueCat, Inc., USA: subscription status.
• PostHog, servers in the EU: usage events.
• Cloudflare, Inc., USA: delivering this website (section 8).

Apple receives data as its own controller when you sign in with Apple, subscribe or get notifications. We share data with authorities only when the law requires it.

6. Where your data is processed

Our servers are in Germany. Anthropic, Voyage AI, RevenueCat and Cloudflare are in the US. For transfers from the EU and UK we rely on the EU-U.S. Data Privacy Framework (and its UK extension) where the provider is certified, and otherwise on the EU Standard Contractual Clauses.

7. How long we keep it

• Your account, chats, saved content and memories: for as long as you have an account.
• Tea Check screenshots: until she’s read them, one hour at most.
• Anything you delete in the app or ask Suzy to forget: gone from the app right away, from backups within 30 days.
• If you delete your account: you’re signed out everywhere at once and we delete your data right after, from backups within 30 days.
• Your data export: available to download for 7 days, then deleted.
• Sign-in links: valid for 15 minutes. Server logs with IP addresses: 14 days at most.

8. This website

heysuzy.app is delivered through Cloudflare, which processes your IP address and technical request data, like your browser and the page you open, to serve the site quickly and securely. From the IP address we only work out your country, to pick the site’s language and decide whether to ask about cookies.

In your browser we only store what the site needs: your language choice, your cookie choice and, for the visit, your country.

PostHog: we measure how you use the site: which pages you open, what you click, including the App Store link, how fast pages load and which technical errors your browser reports. Your IP address is anonymized. In the EU, UK and Switzerland only if you agree in the cookie notice. Elsewhere it’s on by default and you can turn it off with “Your Privacy Choices” at the bottom of every page; if your browser sends a Global Privacy Control signal, it stays off. App Store links carry a campaign code so Apple can count downloads per page without identifying you.

Invite pages (heysuzy.app/i/…) show the first name of the person who invited you.

9. Your controls in the app

• Settings → What I know about you: see, fix or forget any memory, or all of them at once.
• Switches for “Learn from our chats” and “Notice patterns”.
• Delete any chat, journal entry, plan, fit or dream.
• Export all your data and delete your account, both in Settings.
• Change any permission in your iPhone settings.

10. Your rights

Wherever you live, you can ask us for a copy of your data, to correct it, to delete it or to stop using it, and you can take it with you using the export in Settings. Email heysuzyapp@gmail.com; we answer within a month.

If you’re in the EU or UK, you also have the rights under the GDPR, including to restrict processing, to object to processing based on our legitimate interests and to withdraw consent at any time. You can complain to a data protection authority, for example where you live, or to ours: the Hessian Commissioner for Data Protection and Freedom of Information (HBDI) in Wiesbaden, Germany.

11. US privacy rights

If you live in a US state with a consumer privacy law, such as California, you have the right to know what personal information we collect, use and disclose, and to access, correct and delete it. The categories we collect are listed in section 2, the purposes in section 3 and the recipients in section 5.

• We don’t sell your personal information and we don’t share it for cross-context behavioral advertising.
• We only use sensitive information you choose to tell Suzy to answer you, never to infer things about you for other purposes.
• We honor Global Privacy Control signals.
• We won’t treat you differently for using your rights.

To make a request, email heysuzyapp@gmail.com from the address on your account. An authorized agent can ask for you with your written permission. If we decline a request, you can appeal by replying to our answer.

12. Legal bases (EU, UK)

• Contract: to provide Suzy and your subscription.
• Consent: for iPhone permissions and PostHog on this website. If you choose to tell Suzy something sensitive, like something about your health, we process it based on your explicit consent, which you give by sharing it and can withdraw by deleting it.
• Legitimate interests: security, preventing abuse, fixing bugs, usage events in the app and delivering this website.
• Legal obligation: for example, answering authorities.

13. Age, security and changes

Suzy is for adults 18 and over. We don’t knowingly collect data from anyone under 18. If you think someone under 18 is using Suzy, let us know and we’ll delete the account.

We protect your data with encryption in transit, strict access controls and hashed sign-in tokens. Photos sit in private storage and can only be reached through short-lived signed links. No system is perfectly secure, so keep your iPhone protected too.

If we change this policy in a meaningful way, we’ll tell you in the app first. Questions: heysuzyapp@gmail.com.