Skip to content

Legal

Privacy Policy

Last updated: September 27, 2026

This policy explains what personal data we process when you use the Rizzky app for iOS and Android and when you visit this website. It says why we do it, how long we keep it, who else receives it, and what rights you have.

The short version

  • This website sets no cookies and doesn't track you across sites. We only count visits with cookieless, anonymous statistics.
  • We use the screenshots you upload only to create your reading and reply suggestions.
  • Screenshot images are never saved (they are only held in working memory while the text is extracted). The extracted text and your results stay in your History until you delete them.
  • We do not use your data, or data about the people in your screenshots, to train AI models.
  • You can delete single analyses, chats or your whole account in the app at any time.
  • Rizzky is only for adults aged 18 and over.

The rest of this page gives the full details.

Who is responsible

The controller responsible for processing your personal data (Art. 4(7) GDPR) is:

Tobias Scharl, trading as Rizzky (sole proprietorship)Germany
Email: rizzkyapp@gmail.com

For privacy questions and requests, email rizzkyapp@gmail.com. Our full company details are in the Imprint.

Supervisory authority

The data protection authority responsible for us is: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de

You can also complain to the authority in the EU country where you live or work. See Your rights.

When you visit this website

Server logs

This website is a static site hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When you open a page, your browser sends technical data that the server needs to deliver it. Vercel records this data in server logs:

  • your IP address
  • the date and time of the request
  • the page (URL) requested
  • your user agent (browser and operating system)
  • the referrer (the page you came from, if your browser sends it)

We need these logs to deliver the site, keep it secure and fix errors. The legal basis is our legitimate interest in running a secure, working website (Art. 6(1)(f) GDPR). Logs are deleted after 30 days. Vercel acts as our processor under a data processing agreement.

Visitor statistics (Vercel Web Analytics)

To see which pages are read and where visitors come from, we use Vercel Web Analytics (Vercel Inc., USA). It works without cookies. When you open a page, a small script loaded from our own domain sends Vercel the page address, the referrer, your browser, operating system and device type, and the country derived from your IP address.

According to Vercel, your IP address is not stored. To count a visit only once, Vercel creates a hash from the request that can't be traced back to you, and discards it after 24 hours. We only see aggregated numbers, never individual visitors, and we can't recognize you on a later visit or on other websites.

The legal basis is our legitimate interest in understanding how our website is used so we can improve it (Art. 6(1)(f) GDPR). You can object at any time (Art. 21 GDPR), for example by emailing us or by blocking the script with a content blocker. Vercel acts as our processor.

No cookies, no cross-site tracking

This website sets no cookies. It does not use localStorage or sessionStorage, and it stores nothing else on your device. There is no advertising, no tracking pixel, no fingerprinting across websites and no embedded third-party content such as videos, maps or social media widgets.

Because we do not store information on your device or read information from it, there is nothing to consent to under § 25 TDDDG. That is why this site has no cookie banner.

Fonts

Our fonts are served from our own domain. Your browser does not contact Google or any other font service when you load our pages.

Free tools

The free tools on our tools page (quizzes, and the line, bio and date idea generators) run entirely in your browser. What you type or select is never sent to us or to anyone else, and it is not saved. The copy buttons use your browser's clipboard on your device. We do not see what you copy.

Emailing us

If you email us, we process your email address, your name if you give it, and the content of your message so we can reply. The legal basis is Art. 6(1)(b) GDPR if your message is about a contract with us or steps before one. Otherwise it is our legitimate interest in answering questions (Art. 6(1)(f) GDPR). We keep these emails for 3 years after the conversation ends (the regular limitation period for claims). We use Gmail (Google Ireland Limited, Ireland) as our email and support tool.

Links to the app stores

Links to the App Store or Google Play take you to Apple's or Google's websites. Their privacy policies apply there.

When you use the app

This section covers the Rizzky app for iOS and Android. The table gives an overview of each purpose. More detail follows below it. "Until account deletion" means until you delete your account in the app, or until we delete an inactive anonymous account.

PurposeDataLegal basisRetention
Anonymous accountAnonymous account ID created on first launch, your app settings, and technical data needed to connect (IP address, device type, operating system and app version)Art. 6(1)(b) GDPRUntil account deletion. Inactive anonymous accounts are deleted after 12 months of inactivity.
Sign in with Apple or Google (optional)Name, email address and provider user ID, as shared by Apple or GoogleArt. 6(1)(b) GDPRUntil account deletion
Onboarding and messaging styleYour gender, what you want to use Rizzky for, your answers on the three style sliders (humor, slang, directness), and the messaging style scores calculated from them. Stored on your device. The slider values are sent along with each analysis request but not stored on our servers.Art. 6(1)(b) GDPROn your device until you delete the app or reset it
Screenshot analysisThe screenshot image; the text extracted from it (messages, names or nicknames, profile text); the interest score, coaching read and suggested replies or openersArt. 6(1)(b) GDPR. Art. 9(2)(a) GDPR for sensitive data about you. Art. 6(1)(f) GDPR for people in the screenshot.Image: never saved (they are only held in working memory while the text is extracted). Text and results: until you delete them in the History tab or delete your account.
AI chats (optional)Setup answers (the other person's pronouns, relationship to you, name or nickname, your goals, preferred style, their interests), the messages you write in the chat, and the last reading for that personArt. 6(1)(b) GDPR. Art. 9(2)(a) GDPR for sensitive data about you. Art. 6(1)(f) GDPR for the other person.until you delete the chat or your account
HistoryYour past analyses and their resultsArt. 6(1)(b) GDPRuntil you delete them in the History tab or delete your account
Subscriptions and free trialsPurchase status, product, subscription period, transaction and receipt data from Apple or Google, and your account ID. We do not receive card or bank details.Art. 6(1)(b) GDPR. Art. 6(1)(c) GDPR for accounting records.Until account deletion. Accounting records: up to 10 years where German commercial and tax law require it (§ 257 HGB, § 147 AO).
Reminders (local notifications)Whether you allowed notifications and the time of your trial end. Reminders are scheduled on your device; no push token is created and nothing is sent to a push service.Your consent, given through your device's notification permission (Art. 6(1)(a) GDPR)On your device until the reminder fires or you turn notifications off
Promotional offersYour choice to receive offers, stored on your device, and a reminder scheduled on your deviceYour consent through the separate offers opt-in (Art. 6(1)(a) GDPR)Until you switch offers off or delete the app
Usage limitsA daily counter of how much AI processing your account usedArt. 6(1)(b) GDPR and our legitimate interest in fair use and cost control (Art. 6(1)(f) GDPR)35 days
App updatesYour IP address, platform, app version and update channel when the app checks for updatesOur legitimate interest in delivering bug fixes and security updates (Art. 6(1)(f) GDPR)Only as long as needed to deliver the update
Usage analyticsHow you use the app (for example screens viewed and features used), device and app version information, and a pseudonymous IDYour consent through the "Share usage data" switch in your profile (§ 25(1) TDDDG and Art. 6(1)(a) GDPR)14 months, or until you switch off usage-data sharing
SupportYour email address, your message, and your account ID if you give it to usArt. 6(1)(b) GDPR, otherwise Art. 6(1)(f) GDPR3 years after the conversation ends (the regular limitation period for claims)
Security and abuse preventionIP address, account ID, time and type of request, and error logs. For rate limiting we only store a keyed hash of your IP address or account ID, which is deleted automatically within a few minutes.Our legitimate interest in a secure service and in preventing misuse (Art. 6(1)(f) GDPR)14 days
Legal obligationsAccounting and tax records, records of consents, and data we must disclose to authoritiesArt. 6(1)(c) GDPRup to 10 years where German commercial and tax law require it (§ 257 HGB, § 147 AO)

Anonymous account

When you first open the app, we create an anonymous account ID. You do not need a name, email address or password to use Rizzky. The ID is stored on your device so the app can connect to your account. This is strictly necessary to provide the service you asked for (§ 25(2) no. 2 TDDDG).

Sign in with Apple or Google

Signing in is optional. If you choose Sign in with Apple or Sign in with Google, we receive the details the provider shares: your name, your email address and a user ID from that provider. If you use Apple's option to hide your email address, we only receive a relay address from Apple. We never receive or store a password.

Onboarding and messaging style

During onboarding we ask for your gender, what you want to use Rizzky for, and where you sit on three sliders for humor, slang and directness. The app calculates your messaging style scores from these answers on your device. Your answers stay on your device. The slider values are sent along with each analysis so the suggestions match how you write, but our servers don't store them. If you agreed to share usage data, your answers are also stored in our analytics, as described below.

Screenshot analysis

You can upload a screenshot of a chat or of a dating profile. This is what happens:

  1. A vision model reads the screenshot and extracts the text into a structured form, for example who wrote which message.
  2. The image itself is never saved (they are only held in working memory while the text is extracted). Only the extracted text is kept.
  3. A second model uses the extracted text to write your results. For a conversation you get an interest score, a short coaching read and several suggested replies in different tones. For a dating profile you get suggested openers.

We only use the text. We do not analyze faces, bodies or other features in photos. Rizzky never sends messages for you. You decide whether to copy a suggestion and send it yourself.

Please only upload screenshots you are allowed to share, and crop or blur anything that is not needed for the reading. See What you upload.

AI chats

You can set up an optional AI assistant for a specific person. The setup asks for their pronouns, their relationship to you, their name or nickname, your goals, your preferred style and their interests. The assistant remembers the last reading for that person and uses it in later analyses. You can also use the "Universal chat", which needs no setup. In both cases we store the messages you write in the chat so the conversation can continue.

History

Every analysis is stored on our servers and shown in the History tab. You can delete single analyses there at any time.

Subscriptions

Subscriptions, including free trials, are sold through in-app purchase in the Apple App Store and Google Play. Apple and Google handle payment as independent controllers under their own privacy policies (Apple, Google). We use RevenueCat, Inc., USA as our processor to check and manage your subscription status. We receive purchase status and receipt data. We never receive your card or bank details.

Reminders and promotional offers

Rizzky does not use push notifications from a server. If you allow notifications, the app schedules reminders on your device itself, for example a reminder shortly before a free trial ends. You can turn notifications off at any time in your device settings.

We only remind you of promotional offers, such as a discount on a subscription, if you opted in to offers separately. You can switch this off at any time.

Usage analytics

If you agree to share usage data, we record events about how you use the app, for example which onboarding steps you complete, whether an analysis worked, when the paywall is shown and whether you subscribe, together with your app version and a pseudonymous ID. We also store your onboarding answers (gender, what you use Rizzky for, and your slider values) with that ID, so we can see which features work for which groups. We never send the content of your screenshots, chats or replies. There is no session recording. We use PostHog (PostHog Inc., USA), EU Cloud hosted in Frankfurt, Germany for this.

If you don't agree, we don't collect this data. You can switch "Share usage data" off at any time in your profile. Withdrawing consent does not affect processing that happened before (Art. 7(3) GDPR).

Do you have to provide data?

You are not legally required to give us any data. Without an anonymous account and the screenshots you want analyzed, the app cannot work. Signing in, notifications, promotional offers, usage-data sharing and AI chat setup are all optional.

Sensitive information in screenshots

Chats and dating profiles can reveal sensitive information, for example your sexual orientation, your health, or your religious or political beliefs. The GDPR calls these special categories of personal data (Art. 9 GDPR). This can happen even when nobody says it directly, for example through who you are talking to on a dating app.

For your own sensitive data, we rely on your explicit consent (Art. 9(2)(a) GDPR). The app tells you during onboarding, next to the button for your first upload, and you give consent by uploading a screenshot. Because almost any chat can contain this kind of information, we need this consent to offer screenshot analysis. You can withdraw it at any time by emailing rizzkyapp@gmail.com. Withdrawal does not affect processing that happened before (Art. 7(3) GDPR).

We also limit how we handle this information:

  • We do not infer or store sensitive traits as separate data points. They only exist inside the text you uploaded.
  • We do not analyze faces or other biometric features in photos. We only read the text.
  • We do not use this information to train AI models.

Sensitive information about other people in your screenshots is covered in the next section.

Information for people who appear in screenshots

If someone uploaded a screenshot to Rizzky that shows your messages or your dating profile, this section is for you. We give you this information here because we usually cannot contact you. We do not know who you are, and finding out would mean collecting more data about you (Art. 14(5)(b) GDPR).

What data we process about you

  • messages you sent to our user that are visible in the screenshot
  • your name or nickname as shown in the screenshot
  • profile text visible in a screenshot of your dating profile
  • other details visible in the screenshot, such as message times
  • if our user sets up an AI chat about you: your pronouns, your relationship to them, your name or nickname, your interests as they describe them, and the last reading

We do not analyze your photos, your face or any other biometric features. We only read the text.

Why we process it and on what legal basis

We process this data to help our user understand their conversation and write a reply. The legal basis is legitimate interest (Art. 6(1)(f) GDPR): our user's interest in getting help with their own conversations, and our interest in providing that service. We weighed these interests against yours and use these safeguards:

  • We only use the text needed for the reading. We do not analyze photos or faces.
  • Screenshot images are never saved (they are only held in working memory while the text is extracted).
  • We do not use your data to train AI models, and our AI provider may not use it for training either.
  • Your data stays in the account of the user who uploaded it. We do not build a profile of you across users, and we do not match or link uploads from different users, even if several of them talk to you.
  • We do not seek out sensitive information about you or store it as separate data.
  • We never contact you, and Rizzky never sends messages to you.
  • We ask our users to upload only what they are allowed to share and to crop or blur what is not needed.

Where the data comes from

We receive it from the Rizzky user who uploaded the screenshot or set up the AI chat.

Who receives it and how long we keep it

Our service providers process it for us, as listed in Who receives your data, including our AI provider. The image is never saved (they are only held in working memory while the text is extracted). The extracted text and results are kept until the user who uploaded them deletes them or their account. The same applies to AI chat data.

Your rights

You have the same rights as our users, described in Your rights. Email rizzkyapp@gmail.com.

We store uploads under our user's account, not under your name. To find data about you, we may need details from you, for example the name or nickname shown in the chat, the app or platform, and the approximate date (Art. 11(2) GDPR). If we still cannot identify data about you, we will tell you.

You can object to this processing at any time for reasons arising from your particular situation (Art. 21 GDPR). We will then stop, unless we can show compelling legitimate grounds that override your interests.

For our users: what you upload

You are responsible for what you upload. Only upload screenshots you are allowed to share. Crop or blur anything the reading does not need, such as photos, phone numbers, addresses or other people's full names. Avoid uploading sensitive details about other people, such as their health, unless they matter for the reply.

AI processing and training

Which AI we use

We use AI models from Google (Gemini API). Our contracting party is Google Cloud EMEA Limited, Ireland (Gemini API, paid tier). Models in use: Gemini 3.5 Flash-Lite (reading screenshots) and Gemini 3.7 Flash (coaching, replies and AI chats). Google processes screenshots and text as our processor, only to return results to us. Google may keep inputs and outputs for a limited time to detect abuse: up to 55 days, only to detect and prevent violations of Google's Prohibited Use Policy (Gemini API usage policies, as of 9 June 2026).

No training on your data

We do not use your uploads, your results, your chats, or information about people in your screenshots to train or improve AI models. Our contract with Google does not allow Google to use this content to train its models.

How the interest score works

The interest score is a probabilistic reading of cues in the text, such as how long the replies are, the pattern of who replies and when, and whether questions are asked. It is an estimate, not a fact about how the other person feels, and it can be wrong. The same applies to the coaching read and the suggested replies. They are advice only. You decide what to do with them.

We do not make decisions about you that have legal effects or similarly significant effects based solely on automated processing (Art. 22 GDPR).

More about how our AI works and its limits: AI transparency.

Who receives your data

We only share data with the service providers we need to run Rizzky. Processors act on our instructions under a data processing agreement (Art. 28 GDPR). Independent controllers decide themselves how they use the data, under their own privacy policies.

RecipientWhat forRole
Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USAHosting this website, server logs, cookieless visitor statisticsProcessor
Vercel Inc., USA, with our server functions running in Frankfurt, Germany (region fra1)Running the app backendProcessor
MongoDB Atlas (MongoDB, Inc., USA), hosted on Amazon Web Services in Frankfurt, Germany (eu-central-1)Storing accounts, analyses and chatsProcessor
Google (Gemini API), Google Cloud EMEA Limited, Ireland (Gemini API, paid tier)Extracting text from screenshots and generating resultsProcessor
RevenueCat, Inc., USAManaging subscription status and receiptsProcessor
Apple (App Store, Sign in with Apple)Selling subscriptions, handling payment, sign-inIndependent controller
Google (Google Play, Sign in with Google)Selling subscriptions, handling payment, sign-inIndependent controller
Expo (650 Industries, Inc., USA)Delivering app updatesProcessor
PostHog (PostHog Inc., USA), EU Cloud hosted in Frankfurt, GermanyUsage analytics, only with your consentProcessor
Gmail (Google Ireland Limited, Ireland)Handling emails and support requestsProcessor

We also disclose data to authorities where the law requires it (Art. 6(1)(c) GDPR). We do not share your data with anyone else.

Transfers outside the EU

Our app servers and our database are located in Frankfurt, Germany. Your account, your history and your AI chats are stored there.

Some of our providers are based in the USA or process data there. Where a provider is certified under the EU-US Data Privacy Framework, the transfer is based on the European Commission's adequacy decision (Art. 45 GDPR). Where it is not, we use the EU Standard Contractual Clauses (Commission Decision (EU) 2021/914, Art. 46(2)(c) GDPR), with additional safeguards where needed.

You can ask for a copy of these safeguards at rizzkyapp@gmail.com.

How long we keep data

DataHow long
Screenshot imagesnever saved (they are only held in working memory while the text is extracted)
Analyses and History (extracted text and results)until you delete them in the History tab or delete your account
AI chatsuntil you delete the chat or your account
Inactive anonymous accountsDeleted after 12 months of inactivity
App server and security logs14 days
Website server logs (Vercel)30 days
Usage analytics14 months, or until you switch off usage-data sharing
Support emails3 years after the conversation ends (the regular limitation period for claims)
Accounting and tax recordsup to 10 years where German commercial and tax law require it (§ 257 HGB, § 147 AO)
Backups30 days in rolling encrypted backups, then overwritten

Deleting your data and your account

You can delete single analyses in the History tab, delete AI chats, or delete your whole account in the app. If you use Rizzky without signing in and can't find the option, email rizzkyapp@gmail.com from the app's support link and we'll delete your data.

When you delete your account, we delete your account data, analyses, AI chats and usage counters, and we ask our analytics and subscription providers to delete the data linked to your account ID. We only keep records we are legally required to keep, such as accounting records.

Deleting the app from your phone does not delete your account. An anonymous account can then no longer be reached from your device, and we delete it after 12 months of inactivity. Deleting your account does not cancel a subscription. Cancel it in your App Store or Google Play settings.

Your rights

You have these rights over your personal data:

  • Access to the data we hold about you and a copy of it (Art. 15 GDPR)
  • Rectification of incorrect data (Art. 16 GDPR)
  • Erasure of your data (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability: receiving data you gave us in a common, machine-readable format (Art. 20 GDPR)
  • Withdrawal of consent at any time, with effect for the future (Art. 7(3) GDPR)
  • Complaint to a data protection authority, especially in the EU country where you live or work, or where you think the violation happened (Art. 77 GDPR). The authority responsible for us is Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

Your right to object (Art. 21 GDPR)

Where we process your data based on legitimate interest (Art. 6(1)(f) GDPR), you can object at any time for reasons arising from your particular situation. We will then stop processing your data, unless we can show compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed to establish, exercise or defend legal claims.

If we ever process your data for direct marketing, you can object at any time without giving reasons, and we will stop.

To object, email rizzkyapp@gmail.com.

To use any of these rights, email rizzkyapp@gmail.com. We answer within one month (Art. 12(3) GDPR). We may ask for information to confirm that a request really comes from you.

Age requirement

Rizzky is only for people aged 18 and over. By using the app you confirm that you are at least 18. We rely on this self-declaration and do not check ID. If we learn that an account belongs to someone under 18, we delete the account and its data. If you think a minor is using Rizzky, email rizzkyapp@gmail.com.

Security

We protect your data with technical and organizational measures (Art. 32 GDPR). Data sent between the app, this website and our servers is encrypted in transit. Access to personal data is limited to people and providers who need it to run the service. Screenshot images are never saved, as described above. No system is completely secure, but we review and improve these measures over time.

Changes to this policy

We update this policy when our app, our providers or the law change. The date at the top shows the latest version. If a change significantly affects how we use your data, we will tell you in the app before it takes effect. Where a change needs your consent, we will ask for it.