Privacy policy
Last updated
This policy explains what the Prismay app and this website do with your data, why, who else receives it, how long it is kept and what you can do about it. The app has a short version under Settings › Privacy › Your data. If anything here is unclear, write to contact@prismay.app.
The short version
- You don't need an account. We never ask for your name, email or phone number in the app.
- Your mood check-ins, notes and outing ratings stay on your phone, encrypted. They reach our server only if you turn on Backup, and then they are end-to-end encrypted with a key we never have.
- To find things to do, the app sends your location (mostly rounded), your searches and the mood you picked to the services that answer them. It never sends your mood history.
- Crash reports go to our crash-reporting service unless you turn them off. They never include your moods, location or searches.
- We don't sell or share your data for advertising, we show no ads, and we don't track you.
Who we are
Prismay is made by Wolk en Draad, the controller of the personal data described here.
- Legal name: [to be added: legal name of the business]
- Address: [to be added: registered address]
- Registration: [to be added: business registration number]
- Contact for privacy questions and requests: contact@prismay.app
- We have not appointed a data protection officer, because the law does not require one for an app like this. Write to the address above instead.
- UK representative (UK GDPR Art. 27): [to be added: UK representative, if required]
What we process, why, and on what legal basis
The legal bases below are those of the EU and UK GDPR. Other laws use their own terms; the sections further down cover them.
| Data | Where it is | Why | Legal basis |
|---|---|---|---|
| Mood check-ins, notes, outing ratings, search history | On your phone, encrypted. In your backup only if you turn Backup on (end-to-end encrypted). | Your mood history, insights and better suggestions. | Kept on your phone at your request. Backup: your explicit consent (GDPR Art. 6(1)(a) and 9(2)(a)). |
| The mood you pick for suggestions | Sent as one word with requests for suggestions; never with your history. | Choosing suggestions and writing the "why this fits your mood" line. | Providing the app you asked for (Art. 6(1)(b)). Where it counts as health data: your explicit consent, given when you pick a mood and ask for suggestions (Art. 9(2)(a)). |
| Location (GPS, a place you search for, or coordinates you type) | On your phone; sent to the services listed below, mostly rounded. | Finding places, events, tours and weather near you. | Providing the app you asked for (Art. 6(1)(b)). Your phone asks for permission first; you can type a place instead. |
| Age range | On your phone only. | Hiding places and drinks that are not right for your age. | Providing the app (Art. 6(1)(b)); protecting younger users (Art. 6(1)(f)). |
| Random backup ID and secret token | On your phone and our server, only with Backup on. | Linking your encrypted backup to your phone. | Your consent to Backup (Art. 6(1)(a)). |
| Crash reports | Sent to Sentry unless you turn them off. | Finding and fixing crashes. | Our legitimate interest in a working app (Art. 6(1)(f)). You can object at any time with the switch in Settings. |
| Random installation ID, IP address, app version | Sent to Expo when the app checks for updates. | Delivering bug and security fixes. | Our legitimate interest in keeping the app working and secure (Art. 6(1)(f)). |
| IP address | Seen by our server and by services the app contacts directly. Our server does not log it. | Sending you the answers. A keyed hash (never the address) counts recovery and waitlist attempts. | Providing the app (Art. 6(1)(b)); preventing abuse (Art. 6(1)(f)). |
| Waitlist email address | Cloudflare Workers KV. | One email when the app is live. | Your consent (Art. 6(1)(a)). |
| Emails you send us | Our mailbox. | Answering you. | Providing the app (Art. 6(1)(b)) and our legitimate interest in support (Art. 6(1)(f)). |
You give us all of this yourself, through the app, except the IP address your phone sends with every connection. Location and an age range are needed for suggestions; without them the app cannot suggest anything nearby or suitable for you. Everything else is optional.
Your mood data
How you feel can be health information, which the law protects more strongly. Prismay keeps your check-in history, notes and ratings on your phone, encrypted with a key held in your phone's secure keychain. We never receive them unless you turn on Backup, and even then only as end-to-end encrypted data we cannot read.
When you ask for suggestions, the mood you picked travels with the request as a single word, and is used to choose suggestions and to write a short line on why each one fits. Our server passes it on without your IP address or any ID. The stay-home services that get search words chosen for your mood (see below) are contacted directly from your phone, so they see your IP address and could guess the mood from the words.
Who receives data
Most requests go through our server (a Cloudflare Worker), so the service sees our server and not your phone's IP address. Our server does not store these requests: Cloudflare's per-request logs are switched off, and our server never logs your location, searches, mood, device ID or keys. It keeps cached answers for a short time (see "How long we keep data"). Services marked "when switched on" are used only when we have enabled them on our server.
| Service | Who runs it | What it receives |
|---|---|---|
| Cloudflare | Cloudflare, Inc. (US; global network) | Runs our server (Workers), stores backups (D1), runs Workers AI and hosts this website. Sees your IP address with each request. Processor. |
| Sentry | Functional Software, Inc. (US) | Crash reports: the error, phone model, operating-system version, app version and a random installation ID. Never moods, location, searches or backup content. Off when you turn off "Share usage data and crash reports". Processor. |
| Expo | 650 Industries, Inc. (US) | Update checks when the app starts: a random installation ID, your IP address, phone platform and app version. Processor. |
| Cloudflare Workers AI, OpenRouter and Anthropic | Cloudflare, Inc.; OpenRouter, Inc. (passes the request to the model host it selects, such as Google for Gemma models); Anthropic PBC (all US) | The mood you picked and a suggestion’s public listing details, through our server, with no IP address or ID. See "AI-written lines". |
| OpenStreetMap | Overpass API and Nominatim (OpenStreetMap Foundation, UK) | Through our server: your location rounded to about 100 m and search text; for your country, your location rounded to about 1 km; to name your street when your phone cannot, your location to about 10 m. |
| Google Places | Google LLC (US) | When switched on: your location and search text, through our server. |
| Yelp | Yelp Inc. (US) | When switched on: your location and the kinds of place being looked for, through our server. |
| Ticketmaster | Ticketmaster (Live Nation, US) | Your location rounded to about 1 km, through our server. |
| Viator | Viator (Tripadvisor, US) | Only a nearby destination (a city or area) chosen on your phone, through our server. |
| Skiddle | Skiddle Ltd (UK) | When switched on: your location rounded to about 1 km and dates, through our server. |
| Geoapify | Geoapify GmbH (Germany) | When switched on: what you type in place search with your location rounded to about 1 km; for a street name, your location to about 10 m. Through our server. |
| Apple Weather | Apple Inc. (WeatherKit, US) | When switched on: your location rounded to about 1 km, through our server. |
| Open-Meteo | Open-Meteo (Switzerland) | When Apple Weather is not available: your location rounded to about 1 km, straight from your phone (so it sees your IP address). |
| TMDB | The Movie Database (US) | Genres picked for your mood and your country, through our server. Posters load straight from TMDB. |
| YouTube | Google LLC (US) | The ID of each suggested video, straight from your phone, to show its title and picture. |
| TheMealDB and TheCocktailDB | TheMealDB and TheCocktailDB (UK) | Recipe and drink categories picked for your mood, through our server. Pictures load straight from their sites. |
| Radio Browser, Open Library, The Met and the Art Institute of Chicago | Community and museum services (EU and US) | Search words picked for your mood (for example "calming nature sounds"), straight from your phone. |
| Your phone’s map service | Apple (iPhone) or Google (Android) | Your location, through your phone’s operating system, to name the place you are at. |
Cloudflare, Sentry and Expo process data for us under data processing agreements. The other services answer requests under their own terms and privacy policies. When you open a booking or ticket link, you leave Prismay; the provider handles your booking under its own privacy policy. Links may carry a partner code so the provider can credit us, which does not tell us who you are.
We never send your check-in history, notes, who-with or where tags, outing ratings or recovery phrase to any of these services.
AI-written lines
To write the "Why this fits your mood" line, the mood you picked and a suggestion's name, type and listing details (category, rating, price level, tags) go through our server to an AI provider: Cloudflare Workers AI first (Meta Llama 3.1 8B Instruct; Built with Llama), then OpenRouter (which passes the request to the model host it selects, such as Google for Gemma models), then Anthropic (Claude Haiku) only when it is configured. Our server does not pass on your location, IP address or a device identifier. Answers are cached by mood and suggestion, not by person, for up to 30 days. The text is machine-generated, can be wrong and is not advice; use "Report this text" under any line to flag it.
Crash reports
If the app crashes or hits an error, Prismay sends a diagnostic report to our crash-reporting processor, Sentry: the error's stack trace, your device model, operating-system version, the app version and build, and a random installation ID that is not linked to you. Reports never include your moods or mood history, your location, places or searches, or anything in your backup. Sentry receives your IP address with the connection; we have set it not to store it. Turning off "Share usage data and crash reports" in Settings › Privacy stops crash reports straight away. Usage counts stay on your phone and are never sent.
App updates
Each time the app starts, it asks Expo's update service (EAS Update) whether a newer version of the app's code is available, so we can ship fixes quickly. That request carries a random ID created for this installation, your IP address, your phone platform and the app version.
Optional backup
- Off by default. Backup stays off until you turn it on in Settings › Backup. Turning it on is your consent; turning it off withdraws it.
- What is backed up: saved items, preferences, filters, mood history (with notes), outing ratings and search history. A very long mood history backs up only its most recent entries.
- End-to-end encrypted: everything is encrypted on your phone before upload, with a key that never leaves your device. We store only the encrypted copy and cannot read it. Parts of a backup made by an older app version may stay unencrypted until the app uploads them again, which it does automatically while Backup is on.
- Your 24-word recovery phrase is your backup key written as words. It never leaves your phone and we never see it. So a new phone can find your backup, the app sends our server a one-way fingerprint of a value derived from the key; the server stores only a hash of it, which cannot be turned back into the key or the phrase. Recovery attempts are limited per hour; to count them, our server keeps a keyed one-way hash of your IP address (never the address itself) for at most a day.
- Identity: a random device ID and a secret token created by the app. No name, email or phone number.
- Where: in a Cloudflare D1 database on Cloudflare's network.
International transfers
Several of the services above are in the United States or run worldwide networks, so your data can be processed outside the UK, the EU and your own country. Services in the UK, the EU and Switzerland are covered by adequacy decisions. For transfers to the United States we rely on the EU-US Data Privacy Framework (and its UK extension) where the recipient is certified, and otherwise on the European Commission's Standard Contractual Clauses (with the UK addendum) in our agreements with Cloudflare, Sentry and Expo. The AI providers receive no IP address or ID from us. Write to contact@prismay.app for a copy of the safeguards.
How long we keep data
| Data | Kept for |
|---|---|
| Data on your phone | Until you delete it or uninstall the app. Searches older than 90 days are removed automatically. |
| Your backup | Until you delete it. A backup not updated for 90 days is deleted automatically, with its recovery fingerprint. The backup ID and token are removed within 48 hours after that. Cloudflare’s database recovery can keep deleted rows, still encrypted, for up to 30 days. |
| Recovery attempt counters | At most one day. |
| AI-written lines | Cached by mood and suggestion (not by person) for up to 30 days. |
| Cached answers from other services | Up to 2 days, not linked to a person. |
| Our server’s error lines | A few days. They hold status codes, never locations, searches, moods, IDs or keys. |
| Crash reports at Sentry | Up to 90 days. |
| Update checks at Expo | As long as Expo needs them to run the update service, under our agreement with Expo. |
| Waitlist email address | Until we send the launch email, and never more than 12 months after you signed up. |
| Waitlist abuse counter | One hour. |
| Emails you send us | Up to 12 months after the conversation ends. |
Deleting and exporting your data
- Everything: Settings › Danger zone › Delete my data deletes your backup from our server, then everything on your phone, including your locations, the backup key and the backup identity.
- Only the backup: Settings › Backup › Delete my backup, or turn Backup off and choose to delete the server copy too. It is removed from our database straight away.
- Only your phone: Settings › Danger zone › Reset everything clears your phone and keeps the backup, so you can still restore or delete it.
- Uninstalling removes the data on your phone but not your backup, because our server cannot tell that the app was removed. Delete the backup first, or it is deleted automatically 90 days after its last update.
- A copy of your data: Settings › Privacy › Export my data (everything as JSON, or your mood history as CSV).
- Crash reports: turn off "Share usage data and crash reports" in Settings › Privacy.
We don't know who you are, so we cannot find your backup from an email request: only your app holds the link to it. That is why deletion happens in the app. If you have lost your phone, your backup is deleted automatically 90 days after its last update.
Your rights
Wherever you live, you can ask us about your data at contact@prismay.app. Depending on where you are, you have these rights:
UK and EU (GDPR)
- Access, correction, erasure, restriction, portability, and objection to processing based on our legitimate interests (including crash reports).
- Withdraw consent at any time (turn Backup off; leave the waitlist), without affecting earlier processing.
- Complain to a supervisory authority: in the UK the Information Commissioner's Office (ico.org.uk); in the EU your local authority, or our lead authority, the Autoriteit Persoonsgegevens (the Dutch Data Protection Authority).
Canada, Australia and New Zealand
You can ask for access to and correction of your personal information. If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada, the Office of the Australian Information Commissioner, or New Zealand's Office of the Privacy Commissioner.
Brazil (LGPD) and India (DPDP Act)
You have rights to confirmation, access, correction, deletion, portability and information about sharing, and to withdraw consent. contact@prismay.app is our contact for data subject requests and grievances (in Brazil, the channel of our person in charge of data processing). In India you can complain to the Data Protection Board once you have used our grievance contact.
We answer within one month (45 days under US state laws). Because we hold no name or email for app users, we may not be able to link a request to data, and most of your data is only on your phone, where the controls above act on it directly.
Notice for US residents
This section covers the California Consumer Privacy Act (as amended by the CPRA) and similar state laws.
- Categories we collect: identifiers (a random installation ID, a random backup ID, IP address); geolocation, including precise geolocation; consumer health-related information (the mood you pick, and mood history only if you back it up, end-to-end encrypted); internet activity (searches in the app); and, if you join the waitlist, your email address.
- Sensitive personal information: precise geolocation and health-related mood information. We use them only to provide the features you ask for, so we do not offer a "limit" choice.
- Sources, purposes, recipients and retention: as described in the sections above.
- No sale or sharing: we have not sold personal information or shared it for cross-context behavioral advertising in the past 12 months, and we don't. We don't knowingly sell or share data of anyone under 16.
- Your rights: to know and access, to delete, to correct, and not to be treated differently for using them. Use the in-app controls or write to contact@prismay.app. You can use an authorised agent. If we decline a request, you can appeal by replying with "Appeal"; if you are not satisfied, you can contact your state attorney general.
Consumer health data (Washington, Nevada and similar laws)
Washington's My Health My Data Act, Nevada's consumer health data law and similar laws protect information about your physical or mental health. For Prismay, that is:
- What: your mood check-ins (mood, intensity, who-with and where tags, notes), how outings made you feel, and the mood you pick for suggestions.
- From where: you, in the app.
- Why: to show your mood history and insights, choose suggestions, and write the "why this fits" line.
- Shared with: the AI providers (the mood word only, with no ID or IP address) and, as search words, the stay-home services listed above. Your history is never shared; your encrypted backup is stored by Cloudflare only if you turn Backup on.
- Consent: we collect and share this information only as needed to provide the features you request, and store it on our server only with your consent (Backup). We never sell it.
- Your rights: to confirm and access what we hold, to see the list of recipients (above), to withdraw consent and to delete it, using the in-app controls or contact@prismay.app. You can appeal a refusal as described in the previous section.
Children and minimum age
Prismay is for people aged 13 and over. If someone chooses "Under 13" during setup, the app stops and stores nothing. People aged 13 to 17 can use it; the app then hides bars, clubs and alcoholic drinks. If you are under the age at which you can give consent yourself where you live (between 13 and 16 in EU countries), ask a parent or guardian before turning on Backup. If you believe a child under 13 is using Prismay, use Delete my data on their phone, or write to contact@prismay.app.
This website and the waitlist
This site sets no cookies and has no analytics, trackers or ads. Cloudflare delivers its pages and sees your IP address to do so; our site's request logs are switched off. If you join the waitlist, we store your email address, the time you signed up and which link brought you (for example a newsletter tag) in Cloudflare Workers KV, to send you one email when the app is live. We accept sign-ups only from this site. To stop abuse, we keep a counter keyed by a keyed hash of your IP address (made with a secret, never the address itself) for one hour. We delete your address within 12 months of sign-up, or sooner when you ask at contact@prismay.app.
Automated decisions
The app ranks suggestions automatically, from your filters, location, the time and weather and your own feedback. This does not produce legal or similarly significant effects on you.
Security
Every connection uses HTTPS. API keys for the services above stay on our server. Sensitive data is encrypted on your phone, backups are end-to-end encrypted, and you can lock the app with Face ID, Touch ID or your phone's passcode (Settings, off by default).
Changes
We update this page and the in-app Your data page together and change the date at the top. For significant changes we will also tell you in the app.
Contact
Wolk en Draad, [to be added: registered address]. Email: contact@prismay.app. See also our terms of use and support page.