Privacy Policy for Rhythm

Effective Date: August 6, 2025

Last Updated: August 13, 2026

Rhythm is a wellness-focused chat application designed to offer real-time support and reflection made by Rhythm Labs Inc. We are committed to protecting your privacy and being transparent about how we handle your data.

This Privacy Policy applies to users in Canada, the United States, and other countries where Rhythm is used. It is designed to meet early-stage privacy expectations and product reviewer requirements, while reflecting strong data protection practices.

1. Information We Collect

a. Account Information

  • Email address, name, gender, and age (required during signup)
  • Names are required but not verified for authenticity

b. Chat Data

  • Rhythm stores your chat history, encrypted using AES-GCM, until you delete it, to support continuity of your experience and to enable the AI to reference prior conversations
  • Your chat content is encrypted so it cannot be casually accessed by developers or administrators
  • Your chat data is not used to train third-party AI models

c. Analytics and Usage Metadata

Rhythm automatically analyzes chat messages using fully automated software to classify content (e.g., topics like “work,” “relationships,” or “self-improvement”). This process is completely anonymized and de-identified — no humans see your messages. Only aggregated insights are used to improve Rhythm and its features.

In addition, we collect metadata such as:

  • Number of messages sent
  • Features used
  • General app performance and error reports

We do not:

  • Share your chat content with third parties
  • Use your messages to train external AI models

Authenticated users are tracked in Google Analytics with user-level identifiers and session activity, used solely to improve product functionality and user experience.

If you turn on personalized follow-up notifications, deciding whether to send one is an entirely automated process: software reviews your recent conversations solely to judge whether a supportive follow-up is appropriate. No person at Rhythm can or does read your chats as part of this — your messages stay encrypted, and the automated check runs without any human involvement. The notification itself never quotes your conversation or names its topic, and you can switch personalized follow-ups off at any time in Settings.

d. Rhythm AI Personality Tuner (and connected AI assistants)

If you use Rhythm through the ChatGPT app, before you create an account we collect only:

  • The preference slider values you set in the tuner (your communication preferences)
  • Anonymized identifiers provided by ChatGPT (an anonymized user ID and conversation ID), used to remember your rhythm between conversations and for rate limiting — these do not identify you to Rhythm

We do not receive or store your ChatGPT conversations. What we return to ChatGPT is limited to your slider values and communication-style guidance derived from them; if you've saved your rhythm to a Rhythm account, this reflects your account's current active rhythm.

Unsaved rhythms are deleted automatically after they expire (currently 7 days). If you save your rhythm by creating an account, your preferences transfer to that account and the sections above apply. Funnel analytics for this feature are aggregate counts only.

Your use of ChatGPT itself, including anything you type there, is governed by OpenAI's privacy policy — Rhythm only receives the tuner data described here.

e. How You Found Us (Marketing Attribution)

When you arrive at our website from a link that carries campaign information (for example, a link in our Instagram bio or a newsletter), we record where that visit came from — the campaign tags on the link, the referring site, and the page you landed on — in a first-party cookie that lasts up to 90 days. If you create an account, that "how you found us" information is saved with your account. On Android, when you install the app after tapping a campaign link, Google Play passes the same campaign information to the app; opening the app from a campaign-tagged link is recorded the same way.

We use this only to understand which of our own channels bring people to Rhythm. It is never shared with ad networks or any other third party, contains no information about your activity on other websites, and holds no personal details beyond the campaign labels we placed on our own links.

2. Use of Third-Party Services

We use the following trusted services:

OpenAI and Anthropic (LLM APIs): Used to generate AI responses via secure HTTPS connections. Per their policies, data sent through the API is not used to train models.

Google Analytics 4 (GA4): Tracks usage patterns and feature engagement. This may include device information, user ID (if signed in), and IP address. Used solely to improve product functionality and user experience.

We do not sell or share your personal data with advertisers or data brokers.

3. Data Storage & Security

  • All data is stored on secure infrastructure hosted by Heroku (U.S.-based)
  • All traffic is encrypted in transit via HTTPS
  • Chat messages are encrypted at rest using AES-GCM
  • Other personal data such as email, age, gender, or name is not encrypted at rest but is stored securely
  • Passwords are hashed and salted using modern cryptographic standards

Rhythm stores and processes data on trusted platforms, including some based in the United States. This means your data might leave your home country — by using the app, you consent to this transfer. Even if your data moves, we apply strong privacy protections no matter where it's stored. Rhythm follows the privacy laws that apply to us based on where you live and where we operate.

4. Your Controls & Rights

You can:

  • Delete your account and all your conversations yourself, from a button in Settings in the app. You can also request deletion by emailing [email protected]
  • Request corrections or ask questions about your data
  • Opt out of marketing communications

Deletion is automatic and no confirmation email is sent. Self-service data export is not available yet.

5. Safety & Boundaries in AI Responses

Rhythm may be used during emotionally vulnerable moments. We have strict safety guardrails in place (as part of our system prompt) to ensure respectful and non-directive support:

  • Rhythm does not offer medical, psychiatric, or therapeutic advice
  • Crisis language triggers supportive but limited responses, with encouragement to seek professional help
  • No content moderation or scanning is currently performed automatically, but safety logic is built into the AI guidance system

6. Children's Privacy

Rhythm is not intended for individuals under the age of 18 in the U.S. or in Canada.

We do not knowingly collect personal information from children.

7. Future Use of Data

We may use anonymized metadata (e.g., usage patterns, timing, model preferences) to train our own systems in the future.

  • We may use anonymized and aggregated metadata — including automated, anonymized tags generated from chat content (e.g., topics like “work,” “relationships,” or “self-improvement”) — to improve Rhythm, develop new features, and train our own internal systems. This process is fully automated, de-identified, and no humans access your raw messages.
  • Currently, we do not use chat content to train external AI models. If this changes in the future, we will update this policy to reflect the change and maintain transparency.

We do not share any user data, whether raw or anonymized, with employers, insurers, or third parties for research, commercial partnerships, or advertising purposes.

8. Data Retention

We keep your conversations until you delete them. Deleting your account from Settings removes your account and all your conversations automatically.

Downgrading from a paid plan doesn't delete anything. It narrows what Rhythm can remember to your most recent 20 messages.

You can also request deletion by emailing [email protected].

9. Legal Disclosures

We aim to comply with:

  • PIPEDA (Canada)
  • CCPA (California)
  • Future requirements under Quebec's Law 25
  • Other applicable privacy laws as the product grows

10. Contact Us

Have a question about privacy?

Contact us at:

Email: [email protected]

Rhythm is currently operated and owned by Rhythm Labs Inc.