Privacy Policy

1. Introduction

shiroy.ai ("we", "us", or "our") operates the shiroy.ai application at shiroy.ai ("the Service"). This Privacy Policy explains how we collect, use, and protect your information when you use the Service.

2. Information We Collect

Information you provide

• Account information from your Google sign-in (name, email address, profile picture)
• Content you submit to the Service (activity descriptions, vision board entries, custom settings)

Information collected automatically

• Usage analytics (page views, feature interactions, session data)
• Device and browser information

Information stored locally

The majority of your game data (stats, XP, habits, activities, inventory, vision board, and other progress) is stored in your browser's local storage and is not transmitted to our servers unless you use features that require server processing (such as AI evaluations).

3. Health and Activity Information Disclaimer

The Service allows you to describe real-world activities in free-text form for gamification purposes. These descriptions may incidentally include information about physical activities, exercise habits, dietary choices, mental health practices, or other health-adjacent topics. We are not a healthcare provider, covered entity under HIPAA, or health data processor. Activity descriptions you submit are treated as general user content, not as protected health information (PHI), medical records, or clinical data.

Healthy habit tracking and daily damage tracking features record simple boolean data (completed/not completed per day) for gamification purposes. This data does not constitute health monitoring, medical tracking, or clinical assessment. You should not use the Service as a substitute for medical record-keeping or health monitoring tools recommended by a healthcare professional.

4. How We Use Your Information

We use collected information to:

• Provide, maintain, and improve the Service
• Authenticate your identity and manage your account
• Process AI-powered features (the Judge and Oracle use your submitted text to generate responses)
• Analyze usage patterns to improve the user experience
• Communicate with you about the Service
• Comply with legal obligations

We do not use your activity descriptions, habit data, or other personal content for advertising, profiling, or sale to third parties.

5. AI Processing and Third-Party Services

The Service uses third-party AI providers to power its evaluation and creative features. When you use these features, your submitted content is sent to external APIs for processing:

• Anthropic (Claude)— Powers the AI Judge feature. Your activity descriptions and conversation messages are sent to Anthropic's API for evaluation. Anthropic may retain this data in accordance with their privacy policy and data retention practices.
• OpenAI— Powers AI image generation for the Vision Board and serves as a fallback for the Judge feature. Activity descriptions, vision board text, and image prompts may be sent to OpenAI's API. OpenAI may retain this data in accordance with their privacy policy.
• Google OAuth— Handles authentication. Governed by Google's Privacy Policy.
• Supabase— Stores account profile data (name, email, authentication identifiers).
• Vercel— Hosts the Service and its infrastructure.

Important: When you submit text to AI-powered features, that text is transmitted to third-party servers outside our direct control. We cannot guarantee how these third parties store, process, or retain your data beyond their published policies. Do not submit sensitive personal information, protected health information, financial account details, or other confidential data to AI-powered features. These third parties have their own privacy policies, and we encourage you to review them.

6. Data Retention

Account data is retained for as long as your account is active or as needed to provide the Service. Locally stored game data persists until you clear your browser data or manually delete it. Analytics data may be retained in aggregate form indefinitely for product improvement purposes. Data sent to third-party AI providers is subject to their respective retention policies. You may request deletion of your account data by contacting us.

7. Data Security

We implement reasonable technical and organizational measures to protect your information. However, no method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security. You use the Service at your own risk. We are not responsible for unauthorized access to locally stored data on your device.

8. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Object to or restrict certain processing of your data
• Data portability (export your data)

The Service provides a built-in data export feature that allows you to download your game data at any time. To exercise other rights, contact us at the email below. Please note that we cannot delete data that has already been transmitted to third-party AI providers — you must contact those providers directly regarding data held in their systems.

9. Children's Privacy

The Service is intended for users who are at least 18 years of age, or between 13 and 17 with parental consent. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us and we will delete it promptly.

10. Cookies and Tracking

The Service uses essential cookies for authentication and session management. We use analytics tools to understand how the Service is used. We do not use advertising cookies or sell data to advertisers. You can control cookie settings through your browser preferences, though disabling essential cookies may prevent you from using the Service.

11. International Data Transfers

Your information may be transferred to and processed in countries other than your own, including the United States. By using the Service, you consent to the transfer of your information to the United States and other jurisdictions where our service providers operate. These jurisdictions may have data protection laws that differ from those in your country.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be effective upon posting to the Service. Your continued use of the Service after changes are posted constitutes your acceptance of the updated policy. We encourage you to review this policy periodically. If you do not agree to any changes, your sole remedy is to discontinue use of the Service.

13. California Privacy Rights

If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect, the right to delete your personal information, and the right to opt out of the sale of personal information. We do not sell your personal information. To exercise your California privacy rights, contact us at the email below.

Contact

If you have any questions about this Privacy Policy or wish to exercise your data rights, please contact us at hello@shiroy.ai.