Privacy Policy (As of 09/26/2026)

When you create or use a Sphereify account, we collect information used to establish and manage your account, including your email address, account identifier, and information you provide through the sign-in process.

When you grant Sphereify permission to access your device’s contacts and use the contact-import or synchronization feature, Sphereify uploads the imported contact information from your device to our cloud-hosted systems. We store and process this information in connection with your Sphereify account.

The contact fields uploaded are names (first and last name), phone numbers, email addresses, company/organization name, and device contact identifiers (for sync deduplication). Contact photos are cached strictly locally on the user's device and are never uploaded. Birthdays and physical addresses are not collected or uploaded.

Sphereify uploads all contacts available under the permission granted by the user (or the user-selected subset if iOS 18 Limited Access is chosen). Users also have the option to individually select contacts to import via the native iOS contact picker. Subsequent synchronization happens automatically whenever the app is launched or returns to the foreground, and can also be initiated manually by the user via the in-app refresh button.

Contact information may relate to people who do not themselves have a Sphereify account. Please upload only information you are authorized to provide and avoid including unnecessary sensitive information.

We collect and store information you enter or save in the app, such as contact notes, relationship types, Sphere memberships, follow-up preferences, reminders, and recorded interaction dates.

These records help Sphereify organize your relationships and provide the features described below.

When you contact us, we receive the information you provide, such as your email address, message, and any attachments, so we can respond to your request.

We use account information to provide access to Sphereify and manage your account. We use uploaded contacts and the relationship information associated with them to support the app’s features, including:

• Contact and relationship management: Displaying, searching, and organizing contacts; grouping contacts into Spheres; and maintaining notes and relationship details.
• Reminders and follow-ups: Using recorded interaction dates and your follow-up preferences to generate reminders and nudges.
• Focus and Stats: Helping you identify relationships that need attention and showing summaries based on the information recorded in Sphereify.
• Communication and assistance: Helping you initiate calls, texts, or emails to your contacts and providing AI-assisted features as described in Section 3.

Cloud storage allows Sphereify to maintain your saved contact and relationship records and retrieve them when you use your account.

We also use information you provide in support requests to respond to questions and resolve issues.

We use Supabse to support account authentication, database hosting, and cloud storage. These providers process the information needed to perform those services for Sphereify.

All third-party service providers that process data on behalf of Sphereify—specifically Supabase (cloud database and backend hosting) and Anthropic (commercial API powering AI assistant features)—are bound by verified Data Processing Addenda (DPAs) and Commercial Service Terms. Under these agreements, each provider acts strictly as a data processor / service provider and is legally and contractually prohibited from selling, retaining, sharing, or using user or contact data for their own independent purposes, including advertising, third-party profiling, or commercial exploitation. Furthermore, under Anthropic’s commercial API terms, customer inputs and contact data are strictly prohibited from being used to train or fine-tune artificial intelligence models. All data is encrypted in transit using TLS and at rest using AES-256.

When you use Ask Orbit or another AI-assisted feature, Sphereify processes your request and the information supplied to that feature to provide assistance, such as answering questions about your relationship records, summarizing notes, or drafting suggested messages.

Information sent to our third-party AI provider includes user-submitted prompts, contact details (such as contact names, company/organization names, and relationship categories), user-written contact notes, and interaction logs (such as interaction dates and communication channels). The provider is Anthropic, PBC (Claude API), and the information is used to power our in-app AI assistant ("Orbit") to answer your questions about your relationships, perform user-directed contact updates, and generate contact summaries.

Users are notified of AI data processing in this Privacy Policy and within the app interface. Information is transmitted to our AI provider only when a user voluntarily initiates an AI interaction—specifically by typing or dictating a prompt in the dedicated "Orbit AI" tab or by requesting an AI contact summary. Users may withdraw permission at any time simply by discontinuing use of the AI assistant features, clearing their conversation history using the in-app chat controls, or deleting their contact data and account through the app's Settings. Under Anthropic’s commercial terms, API data is retained temporarily for up to 30 days solely to identify abuse and ensure trust and safety, after which it is deleted. Anthropic contractually does not use customer inputs or outputs transmitted through its commercial API to train or fine-tune its foundational AI models.

When you choose to connect an external service, such as Gmail or Outlook, the information Sphereify accesses depends on the permissions you authorize and the integration’s functionality.

Sphereify offers optional third-party integrations with Google (Gmail, Google Calendar, and Google Contacts) and Microsoft (Outlook Mail and Outlook Calendar). When you connect these services, our backend accesses and stores encrypted OAuth authorization tokens (access and refresh tokens) solely to maintain the authorized connection. For email integrations (Gmail and Outlook), we access and store only minimal email interaction metadata—specifically sender and recipient email addresses, email subject lines, and message timestamps—in order to log interactions with your contacts. We do not store or retain email message bodies, and we never access or store email attachments. For calendar integrations, we access and store event titles, meeting timestamps, and meeting durations. For Google Contacts, we access and store only the names, email addresses, and phone numbers of contacts you specifically choose to import. This access is used strictly to automatically log relationship interactions, calculate "last contacted" timelines, and trigger scheduled reminders. Users may disconnect any integration at any time through the app’s Connected Accounts settings or directly via their Google Account permissions (myaccount.google.com/permissions) or Microsoft Account dashboard (account.live.com/consent/Manage). Upon disconnection or account deletion, stored authorization tokens are revoked and deleted, and users may request permanent deletion of any previously synced interaction records by contacting support at support@sphereify.app.

Using Sphereify to open another application to place a call, send a text, or compose an email is separate from authorizing an integration to access information from that service.

We may disclose information when required by applicable law or a valid legal process.

We share information with third-party service providers only as strictly necessary to operate our app services:

• Notification Services: We share device push notification tokens with OneSignal exclusively to schedule and deliver contact reminder notifications ("nudges") to your device. OneSignal does not receive your address book contacts, notes, or communications.
• Subscription-Management Providers: We use RevenueCat to process and validate in-app subscription purchases and entitlements through Apple’s App Store. RevenueCat receives an anonymous application user identifier and purchase transaction data; it does not receive contact records or address book information.
• Internal Team-Member Access: All user contacts, notes, and messages are protected by Row-Level Security (RLS) and restricted to your authenticated account. Our team members do not access or view your contacts, notes, or interaction history, except in rare instances upon your explicit request for technical or customer support.

We do not use third-party analytics providers to track your personal activity, we do not display third-party advertisements or share data with advertising networks, and we never sell, rent, or monetize your personal information or contact data.

We store uploaded contacts and associated relationship information to provide Sphereify’s account-based features.

We retain your personal information only for as long as necessary to provide the services or until you delete your data or account:

• Account Information (name, email address, authentication credentials): Retained for the active lifetime of your account.
• Contacts, Notes, and Interaction Records: Retained in your account for as long as your account remains active, or until you individually delete specific contacts, notes, or interactions within the app. Contact photos cached locally on your device are deleted when the contact is removed or the app is uninstalled.
• AI-Related Data: In-app conversation history with Orbit AI is retained in your account until you clear it using the in-app chat deletion control (trash icon) or delete your account. Transmissions to our AI provider (Anthropic) are retained transiently for a maximum of 30 days solely for trust and abuse monitoring purposes per their commercial API terms, after which they are permanently deleted.
• Connected Account Tokens: Stored encrypted only while the integration remains active; permanently deleted immediately upon disconnecting the service.
• Support Communications: Retained for up to 12 months following resolution of your request to assist with follow-up questions.

Following an account deletion request, all account credentials, contacts, notes, interaction records, connected account tokens, and conversation records are permanently and immediately removed from our active production databases. Residual copies in automated disaster-recovery backups are permanently purged within 30 days as backups rotate. We do not retain your personal data after account deletion except in rare instances where retention is strictly required to comply with applicable legal, regulatory, tax, or fraud-prevention obligations (such as preserving anonymized in-app purchase receipts for financial audits).

You can manage Sphereify’s permission to access your device’s contacts through your device settings. Withdrawing this permission prevents further access to your device’s contacts through that permission and may limit features that depend on contact import or synchronization.

Withdrawing contact permission or uninstalling the app should not be treated as a request to delete information already uploaded to Sphereify. To request removal of previously uploaded information, follow the deletion process below.

You can contact james@sphereify.com to request access to, correction of, or deletion of personal information associated with you. This includes requests from Sphereify users and people whose contact information may have been uploaded by a user.

We may need additional information to verify your identity and locate the relevant records before responding.

To request deletion of your Sphereify account and associated data, navigate to Settings > Account > Delete Account and confirm the deletion prompt in the app, or submit a request by emailing 

support@sphereify.app from the email address associated with your account with the subject line "Account Deletion Request". Upon confirmation, your account and all associated data will be permanently queued for immediate deletion from our active systems.

When you interact with Sphereify and our online services, technical data and device information are handled as follows:

• Cookies: The Sphereify mobile app does not use cookies. When authenticating third-party accounts (such as Google or Microsoft OAuth via web views), essential session cookies may be processed transiently by those respective providers strictly to authenticate your account; no advertising, tracking, or marketing cookies are used.
• Local Storage: The app uses on-device local storage (UserDefaults, SwiftData, and the app's local sandbox documents directory) to store your preferences (e.g., appearance theme, notification delivery hour), home screen widget cache (via an App Group container), conversation history, and contact avatar images. This data remains strictly local to your device, is never uploaded to our servers, and is deleted when cleared in-app or when the app is uninstalled.
• Server Logs: Our backend infrastructure (Supabase) automatically collects standard HTTP request logs when your app communicates with our APIs. These logs include IP addresses, request timestamps, API endpoints accessed, and client user-agent strings. This data is collected solely for infrastructure security, performance monitoring, and abuse/DDoS prevention, and is automatically purged on a rolling 30-day retention schedule.
• Device & App Identifiers: We generate an internal, anonymous user UUID upon registration to manage your account. In addition, our subscription partner (RevenueCat) receives an anonymous app user identifier and transaction receipt solely to verify in-app subscription entitlements. For contacts imported from your device, the system stores the device's internal contact identifier (CNContact.identifier) solely to sync changes and prevent duplicate records. These identifiers are retained for the active lifetime of your account.
• Notification Tokens: If you grant notification permissions, Apple Push Notification service (APNs) device tokens are transmitted to our push provider, OneSignal, solely to schedule and deliver your relationship reminders ("nudges"). These tokens are retained as long as notifications remain active on your device. You can disable notifications at any time in your iOS Settings under Sphereify > Notifications.
• Usage Analytics: We do not integrate third-party user behavioral tracking or product analytics SDKs (such as Google Analytics, Mixpanel, or Amplitude). Operational events related to subscription status and push message delivery are handled strictly by RevenueCat and OneSignal to perform those core functions.
• Crash Reports: We do not integrate third-party crash reporting tools (such as Firebase Crashlytics, Sentry, or Bugsnag). Crash reports are collected solely through Apple's native, system-level opt-in crash diagnostic service, which you can control via iOS Settings > Privacy & Security > Analytics & Improvements.

Because Sphereify stores information in cloud-hosted systems, protecting your information involves more than the security settings on your device.

We implement industry-standard technical and organizational security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction:

• Encryption in Transit: All communications between the Sphereify iOS application, our cloud backend (Supabase), and integrated third-party service providers (such as Anthropic, Google, Microsoft, OneSignal, and RevenueCat) are encrypted in transit using Transport Layer Security (TLS 1.2/1.3) over HTTPS.
• Encryption at Rest: Data stored in our cloud databases and storage systems is encrypted at rest using industry-standard AES-256 encryption. Stored third-party OAuth authorization tokens are encrypted within our database. On your device, locally stored contact photos and cached data are protected within the app’s sandboxed container under Apple iOS’s hardware-backed file protection.
• Strict Database Access Controls (Row-Level Security): All database tables storing contacts, notes, interactions, spheres, and user preferences enforce PostgreSQL Row-Level Security (RLS) policies. These policies bind data queries strictly to the authenticated user’s unique account identifier (auth.uid()), ensuring that your records are completely isolated and inaccessible to any other user.
• Authentication & Credential Protection: User sessions are managed via secure JSON Web Tokens (JWTs) with automatic session verification and refresh token handling. Passwords are never stored in plaintext and are salted and hashed using secure cryptographic algorithms.
• API Key Isolation: Sensitive service credentials—including AI provider API keys, OAuth client secrets, and notification credentials—are maintained strictly within secure server-side environment variables and are never bundled within or exposed to the client application.

Please note that while we employ rigorous security practices, no method of electronic transmission over the internet or method of electronic storage is 100% secure. Sphereify does not use end-to-end encryption, as data must be decrypted on our secure servers to enable core features such as automated reminders, synchronization, and AI assistant processing.

No method of internet transmission or electronic storage is completely secure. You can help protect your account by using a strong password, securing your device with a passcode or biometric lock, keeping your software up to date, and avoiding sharing your account credentials.

Sphereify is not directed at children under the age of 13. We do not knowingly collect personal information directly from children under 13.

If you believe a child under 13 has provided personal information to Sphereify, please contact james@sphereify.com so we can investigate and take appropriate steps to remove the information.

We may update this Privacy Policy to reflect changes to Sphereify’s features, data practices, or applicable requirements.

We will post the revised policy on our website and update the “Last updated” date. When required, we will provide additional notice or obtain consent before making changes that affect how personal information is used or disclosed.

For questions about this Privacy Policy, our handling of uploaded contacts, or a privacy-related request, contact:

Sphereify LLC
Email: james@sphereify.com