Legal
Privacy
Policy
Draft — pending legal review. This text describes accurately what the Psyke app processes today, but it has not yet been reviewed by a lawyer and the controller details below still need to be completed before submission to the App Store.
Who we are
Psyke is an iOS app that gives you a cinematic archetype from a short quiz and curates films and series around it. In this policy, “Psyke”, “we” and “us” mean the developer of that app, acting as the data controller for the personal data described here.
Contact for anything in this policy, including requests to access or delete your data: psyke@psyke.site.
What Psyke collects
A device identifier
The first time you open Psyke, the app generates a random identifier and stores it in the iOS secure keychain. It lets you use the app — take the quiz, keep your archetype, react to titles — without creating an account. It is not your Apple ID, your advertising identifier, or anything that identifies your device to anyone else.
Your Apple account, if you sign in
Signing in is optional and uses Sign in with Apple. Apple sends us a user identifier and the email address you chose to share — which may be Apple's private relay address if you asked Apple to hide your real one. We never receive your Apple password. Signing in links the data already tied to your device identifier to your new account.
Your quiz answers and archetype
The answers you give in the quiz, the archetype they produce, and when you completed it. Answers are stored on your device as you go, so you can leave and come back, and are saved against your device identifier or account when the quiz finishes.
What you react to
Marking a title as seen, loved, liked or disliked, and adding titles to your watch list. These reactions are stored on your device. When you sign in, reactions associated with your device identifier are linked to your account so that features such as Friend Match can compare taste between two people.
Friend Match
Each account gets a short match code in the form PSY-XXXX. When someone opens your code, we record that the two accounts were matched, the resulting compatibility percentage, and which titles you have in common or disagree on. Your match partner sees your archetype and shared titles — never your email address.
Subscription status
If you subscribe to Psyke Premium, the purchase is made through Apple and processed by our payments provider. We receive whether your subscription is active and when it expires. We never see or store your card details — those stay with Apple.
Notifications
If you allow notifications, we store the push token iOS issues for your device, plus your per-type notification preferences and a log of what we sent you, so we don't send the same thing twice.
Product analytics
We record a small set of product events — quiz started, quiz completed, paywall shown or dismissed, share card generated, a reaction given, a friend match viewed — tied to your device identifier or account identifier. We do not use advertising SDKs, we do not track you across other apps or websites, and Psyke does not ask for the App Tracking Transparency permission.
Abuse prevention
To stop people from guessing match codes or mass-creating accounts, we keep short-lived records of how often an account or a network address performed sensitive actions. These records are used only to enforce rate limits.
Why we process it
Under the GDPR, our legal bases are:
- Performance of a contract — everything needed to actually run the app: your device identifier, quiz answers, archetype, reactions, matches and subscription status.
- Consent — push notifications, which iOS asks you for separately and which you can withdraw at any time in iOS Settings.
- Legitimate interests — product analytics to understand which parts of Psyke work, and rate limiting to keep the service secure. You can object to either by writing to us.
We do not sell personal data, we do not share it with advertisers, and we do not use it to build profiles for anyone other than you.
Who else is involved
We use a small number of providers, each only for the purpose listed:
- Apple — sign-in, App Store purchases and push delivery.
- Supabase — database, authentication and server functions. This is where your account, quiz results, reactions and matches live.
- RevenueCat — keeps track of whether your subscription is active.
- PostHog — product analytics, hosted in the United States.
- Expo — delivers push notifications to your device.
- TMDB — supplies film and series information such as posters, cast and synopses. Requests for this content do not carry your personal data.
Some of these providers process data outside the European Economic Area, including in the United States. Where that happens, transfers rely on the European Commission's Standard Contractual Clauses or an equivalent safeguard.
How long we keep it
- Account data, quiz results, reactions and matches — until you ask us to delete your account.
- Push tokens — until you turn notifications off or the token stops being valid.
- Notification logs — kept only as long as needed to avoid repeat sends.
- Rate-limiting records — a rolling window measured in hours, then discarded.
- Analytics events — retained by our analytics provider under its own retention schedule.
Your rights
If you are in the EU or the UK you can ask us to give you a copy of your data, correct it, delete it, restrict how we use it, or object to processing based on legitimate interests. You can also ask for your data in a portable format.
Write to psyke@psyke.site and we will respond within one month. Deleting your account removes your quiz results, reactions, matches and subscription record from our database.
If you think we have handled your data badly, you can complain to your national data protection authority. In Portugal that is the Comissão Nacional de Proteção de Dados (CNPD).
Children
Psyke is not directed at children and is not intended for anyone under 16. We do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.
Security
Data in transit is encrypted with TLS. Access to your rows in our database is enforced at the database level, so one account cannot read another's data. The device identifier is held in the iOS keychain rather than ordinary app storage.
No system is perfect. If a breach ever affects your data and creates a real risk to you, we will tell you and the relevant authority as the GDPR requires.
Changes
If this policy changes we will update the date at the top of this page. Material changes will also be announced inside the app before they take effect.
Contact
Questions, requests or complaints: psyke@psyke.site.