Privacy Policy

Last updated: 11 September 2026

1. Who We Are

Rithim is a cycle and ADHD symptom tracking application created by Dr Deirdre Ryan and operated by The Rithim Collective Ltd., a company registered in Ireland. The Rithim Collective Ltd. is the data controller for the purposes of GDPR and applicable data protection legislation. This privacy policy explains how we collect, use, and protect your personal data when you use the Rithim mobile application and website.

2. What Data We Collect

When you create an account and use Rithim, we collect and store:

• Account information: Username and password (your password is cryptographically hashed using scrypt — we cannot read it)
• Profile information: Name, date of birth, cycle start date, life stage, and cycle length
• Daily symptom logs: Focus, energy, mood, anxiety, and impulsivity ratings, along with notes and sleep data
• Medication data: Medication names, dosages, frequencies, daily medication logs, and your own daily 1–5 ratings of how helpful each medication felt
• Daily invitations: Phase-aware micro-invitations offered to you and which ones you marked done
• Suggestion feedback: Whether personalised suggestions were helpful

3. Health Data

Rithim processes sensitive health-related data including menstrual cycle information and ADHD symptom tracking. This data is processed on the basis of your explicit consent when you create an account and begin logging. You can stop logging at any time and request deletion of your data.

4. How We Use Your Data

Your data is used exclusively to:

• Provide cycle-aware ADHD symptom tracking and insights within the app
• Generate personalised daily invitations and suggestions based on your cycle phase
• Show your own daily medication ratings and other historical patterns over time
• Sync your data securely across devices
• Send transactional emails (welcome email, password reset) if you provide an email address

5. Data Storage and Security

Your data is stored in a secure PostgreSQL database hosted in the European Union (Frankfurt, Germany) — the same type used by banks and healthcare providers. Your health data remains within EU jurisdiction at all times, in full compliance with GDPR data residency requirements. All data transmitted between your device and our servers is encrypted using HTTPS/TLS. Your login session is protected by a secure server-side key. Data is encrypted at rest using industry-standard AES-256 encryption.

Optional Apple Health connection: If you choose to connect Apple Health on iOS, Rithim reads daily summaries for sleep, steps, resting heart rate, heart-rate variability, and recorded menstrual flow. These imported Apple Health summaries are processed and stored only on your device. They are not uploaded to Rithim’s servers and are not sent to analytics, crash reporting, advertising, or subscription services. Rithim never writes data to Apple Health. You can disconnect in the app to remove Rithim’s local copy, and manage or revoke access in Apple Health settings. Your other Rithim account data continues to follow the cloud-storage practices described above.

When using the app without an account or in Developer Preview (demo mode), your data is stored locally on your device only and is not transmitted to our servers.

6. Third-Party Services

Rithim uses the following third-party services:

• Resend: For sending transactional emails (including welcome emails and password resets) and approved campaign emails. Resend processes your email address and email delivery data. Resend Privacy Policy
• RevenueCat: For managing subscriptions (Rithim Plus). RevenueCat processes your app user ID and purchase information. RevenueCat Privacy Policy
• PostHog: For product analytics and app reliability measurement. Rithim sends a pseudonymous account identifier and basic account events, but does not send health logs, cycle data, medication data, or notes. PostHog Privacy Policy

We do not send your health records to analytics, advertising, or measurement services. Rithim does not use the Meta SDK or send app events to Meta.

Optional Google Analytics for Firebase on iOS

Status by app version: Existing shipped app versions do not activate Firebase Analytics and do not expose this optional Firebase choice. The current private iOS TestFlight build (version 1.0.13, build 64) includes the optional choice and withdrawal control in Settings > Privacy & Data Security. That build is not a public App Store release, and its native collection behavior is still undergoing final release verification before Apple submission.

In the current TestFlight build, Firebase Analytics remains off unless you actively choose to allow it. The following rules apply to that build and to any future public release only after the required verification and disclosure gates are complete:

• Off by default: Firebase Analytics will remain off unless you actively choose to allow it. Creating an account, buying a subscription, or accepting other terms will not count as analytics consent.
• Your choice: The optional choice is in Settings > Privacy & Data Security, not an extra onboarding step. Before any Firebase Analytics collection starts, we explain what Google receives and why. Ignoring or declining this choice will not affect your access to Rithim. You can withdraw consent in the same Settings section, without deleting your account; withdrawal is intended to stop future Firebase Analytics collection. It will not automatically erase data already collected, and you can contact us about deletion requests.
• No health records or account identity: We will not send Firebase your health records, symptom or cycle logs, medication records, notes, name, email address, or Rithim account ID.
• No personalised advertising or optional sharing: We will keep personalised advertising and optional Analytics account data-sharing settings off. We will not enable remarketing audiences, Google signals, or advertising-identifier collection for this integration.

Not an anonymous install counter: Standard Firebase Analytics can automatically collect an app-installation identifier, app usage and session information, technical device information, general location derived from IP addresses, and in-app purchase or subscription events. These identifiers are distinct from your Rithim account ID, but they are not anonymous; using a health-related app can itself reveal sensitive context. The consent information will describe the actual data collected by the final implementation before you choose.

The intended purpose is iOS install measurement and understanding whether our Google Ads lead to first app opens. Only the iOS first-open event is intended for import as a Google Ads conversion. This does not limit Firebase itself to collecting that one event. Disabling optional sharing does not prevent Google from processing data to provide and maintain Analytics, or prevent measurement data flows through a Google Ads link under the applicable terms. IDFA is not collected for this integration, but that fact alone does not decide whether Apple's Tracking disclosure or another permission is required; the Ads link and its actual data use must be assessed separately. See Google's app data disclosures and Analytics data-sharing settings.

7. Your Rights (GDPR)

Rithim is designed with European privacy law (GDPR) in mind. You have the right to:

• Access: See all data we store about you
• Rectification: Correct any inaccurate data
• Erasure: Request deletion of your data
• Data portability: Receive your data in a structured format
• Withdraw consent: You can withdraw consent to consent-based processing. For optional Firebase Analytics on iOS, withdrawal will not require deleting your account or stopping use of Rithim, as explained above.
• Restriction of processing: Request that we limit how we use your data

You can exercise your right to data access and portability directly in the app: go to Settings > Privacy & Data Security > "Export My Data" to download a complete copy of all your data in JSON format. To permanently delete your account and all associated data, use Settings > Privacy & Data Security > "Delete My Account." You can also contact us at the email address listed below for any privacy-related requests.

8. Data Retention

Your data is retained for as long as your account is active. If you delete your account using the in-app deletion feature, your data is permanently removed from our servers immediately. If you contact us to request deletion, your data will be removed within 30 days.

9. Children's Privacy

Rithim is not intended for use by individuals under the age of 16. We do not knowingly collect personal data from children.

10. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of any material changes through the app or by email. The "Last updated" date at the top of this page indicates when this policy was last revised.

11. Legal Basis for Processing

We process your data on the following legal bases under GDPR:

• Consent (Article 6(1)(a) and Article 9(2)(a)): You provide explicit consent when you create an account and begin logging health-related data. You can withdraw consent to health-data processing by deleting your account. The optional Firebase Analytics choice is separate from health-data consent and is withdrawable without account deletion.
• Contract (Article 6(1)(b)): Processing necessary to provide you with the Rithim service, including managing your account and subscription.
• Legitimate interest (Article 6(1)(f)): Processing necessary to maintain the security of the service and prevent fraud.

12. Contact

If you have any questions about this privacy policy or your data, please contact us at:

Dr Deirdre Ryan
The Rithim Collective Ltd.
Email: info@rithimapp.com