Back
Privacy icon Your Privacy Matters

Privacy Policy

Your privacy and safety are at the heart of how we design every part of nRich.

Last updated: 6 October 2026

Welcome to nRich

Your data and conversations remain private, secure, and under your control. We know therapy is deeply personal, and we treat your conversations with the same respect and confidentiality that a professional therapist would.

Questions? Our privacy team is available at

Our Core Principles

Local-First Storage

Your conversations stay on your device by default

Explicit Consent

Nothing is shared without your clear, active choice

Minimal Data Collection

We only collect what's necessary to provide our service

No Training Data

Your conversations are never used to train our AI

Professional Standards

We adhere to therapeutic industry privacy standards

What Information We Collect

Essential Information

  • Email address (for authentication)
  • Display name
  • Font size preference
  • Subscription status
  • Country or region — the country you tell us you grew up in when starting the Assessment, so we can play music from your part of the world. We also read your device's time zone to show prices in your currency; that is not stored

Optional Information

  • conversations (stored locally by default)
  • Connection preferences (for sharing and comparing your Assessment results with your friends)
  • Data sharing preferences

What We Don't Collect

  • Personal health records
  • Financial information beyond subscription status
  • Browser history
  • Device information beyond basic authentication needs

How Your Data is Stored

Local Storage

  • All conversations are stored locally on your device by default
  • You maintain full control over your data
  • You can delete conversations at any time
  • Local storage uses industry-standard encryption

Cloud Storage (Optional)

Only if you explicitly opt in:

  • Account preferences
  • Connection relationships

Data Sharing and Control

Patient Data Sharing

  • Conversations remain private by default
  • Sharing with friends requires explicit opt-in
  • You can revoke sharing permissions at any time
  • You choose what to share

Security Measures

Technical Security

  • Industry-standard SSL/TLS protocols
  • Automated threat detection

Access Controls

  • Session management and timeout controls
  • Role-based access control

Therapeutic Standards

Professional Ethics
  • Adherence to psychotherapy ethical guidelines
  • Compliance with mental health privacy standards
  • Regular privacy impact assessments
  • Continuous policy review and updates
Clinical Boundaries
  • Clear separation of AI and human therapy
  • Transparent referral processes
  • Crisis protocol adherence
  • Professional supervision framework

Your Rights

You have the right to:

  • Access your data
  • Delete your data
  • Be forgotten completely
  • You can export your conversations at any time from Settings. For a copy of everything else we hold about you (your account details and Assessment results), contact us at and we'll provide it within 30 days.
  • Modify sharing preferences
  • Revoke sharing permissions
  • Request account deletion

Data Retention

  • Local data: Retained until you delete it
  • Shared data: Retained until sharing is revoked
  • Account data: Retained until account deletion

Deleted accounts

When you delete your account with Forget Me, we permanently delete your conversations, personality profile and scores, music ratings, roaming backups, settings, and account record. Deletion is immediate and cannot be undone.

For completeness, here is what does not disappear at that moment:

  • Repeat-signup check. We keep a one-way code derived from your email address for 12 months, so the free allowance cannot be claimed repeatedly. It cannot be reversed into your address and is deleted automatically after 12 months.
  • Payment records. If you subscribed, PayPal retains its own transaction records under its own privacy policy. We cancel the subscription; we cannot erase PayPal's books. If we cannot confirm the cancellation, we keep the subscription reference so that we can cancel it for you.
  • Backups. Deleted data may persist in our backups for a limited retention window before expiring.
  • Sent email. Emails we have already sent exist in your inbox and in our email provider's delivery records.
  • Your other devices. Browsers you used on other devices may hold locally saved data until you clear them.
  • Messages sent to other platforms. If you connected external messaging platforms, messages already delivered to those platforms remain there, governed by those platforms' policies.
  • Spotify. If you connected Spotify, we delete our access to it, but the connection stays listed in your Spotify account until you remove it there.
  • AI providers. Your conversations were processed by the AI providers that power the service. Any copies they hold are kept and deleted under their own API terms; we cannot delete them for you.
  • Service logs. Our operational logs can include your account identifier and email address. They are kept for security and troubleshooting and are not deleted with your account.
  • Analytics. Our analytics provider retains usage events for its standard retention period; we do not use them to identify you after deletion.
  • Messages we cannot match to you. A help chat held while you were not signed in, or a contact-form message sent from an address your account never confirmed, carries nothing that links it to your account, so we cannot find it to delete it.

We think a deletion promise should say exactly what it covers. This is the whole list.

Changes to Privacy Policy

  • Advance notice of changes
  • Email notification of material updates
  • Version history maintained
  • Grace period for major changes

Contact Information

For privacy-related inquiries:

  • Data request handling: Within 30 days

Regulatory Compliance

GDPR

EU users compliance

CCPA

California users compliance

AI-Specific Privacy

AI Training

  • No use of user data for AI training
  • Pre-trained on approved academic sources
  • Transparent AI limitations

AI Interactions

  • No persistent memory between sessions
  • Your personality profile is built from your own reactions to the Assessment's music, and only used to run this service — never for advertising, and never sold
  • Clear AI identification
  • No behavioural tracking

Data Protection

Encryption Standards

  • TLS 1.3 for data in transit
  • Secure key management

Backup Protocol

  • Automated database backups, for disaster recovery only
  • Backups expire after a limited retention window
  • Encrypted backup storage
  • Regular restore testing

Incident Response

Breach Protocol
  • 72-hour notification commitment
  • Detailed incident reporting
  • Impact assessment process
  • Remediation tracking
Recovery Process
  • Clear recovery procedures
  • User notification protocols
  • Service restoration priorities
  • Post-incident review

Third-Party Services

We use limited third-party services for:

  • Authentication (Google SSO)
  • Email communications
  • Payment processing
  • Infrastructure hosting

Your conversations are processed by the AI providers that power the service, under their commercial API terms. Anthropic, Google, OpenAI and xAI do not use them to train their models. We never sell your conversations and never use them for advertising.

With warm regards, nRich

www.nrichs.me

nRich is proudly part of the nRich suite of evidence-based and research-led AI psychology products.

Manage cookies