Last updated: 10 October 2026

Niyora Privacy Policy

If anything here is unclear, contact us at [email protected].

The short version

• Niyora has no accounts. There is no sign-up, no login, and we never ask for your name or email.
• The things you write, the feelings you name, and your history of moments are stored only on your device, encrypted. They are never uploaded to any server we run. We cannot see them.
• To write a reflection back to you, and to check whether a moment needs crisis resources, the app sends the text you wrote, and any photo you attach to that moment, to Google to be processed by an AI model. Those are the only things you create that leave your phone.
• When the app opens, it also checks two Google and Expo services for its own settings and small app updates. Those requests carry a random installation ID and nothing you have written.
• If you connect Apple Health, Niyora reads your period dates to place your cycle. That data stays on your phone and is never sent anywhere.
• We do not sell your data. We do not use it for advertising. Your text is not used to train Google's AI models and is not read by a human as a matter of routine.
• Niyora is not a medical, therapy, or crisis service.

What data exists, and where it lives

Everything you create in Niyora stays on your device:

• The text you write in a moment.
• The feeling you name (for example "hurt" or "anxious") and its grouping.
• Any response or message you draft.
• Your history of past moments, which the app uses to show you your own patterns over time.

A photo or screenshot you attach to a moment is not saved. The app holds it in memory only while that moment is open, and lets go of it when you leave.

This history is kept in the app's private, iOS-sandboxed storage, and the sensitive parts (the text you wrote and any response you drafted) are additionally encrypted with AES-256. The encryption key is generated on your device and held in the iOS Keychain, set so it does not sync to iCloud or to device backups. That key never leaves your phone, and neither does the encrypted content. There is no copy on a server we control, because there is no such server and no account to tie it to.

The stored history is capped at the most recent 300 moments; older ones fall off automatically.

What leaves your device, to whom, and why

Only what you choose to give Moon leaves your device: the text you write, and a photo or screenshot if you attach one to a moment, sent for AI processing.

To turn what you wrote into a reflection, the app sends that text to Google. It travels through Firebase AI Logic to Google Cloud's Vertex AI service and is processed by Google's Gemini models: gemini-3.1-pro-preview writes the reflections and drafts and runs the safety check, and gemini-3.8-flash handles quick choices such as suggesting feelings. If Google retires a preview model, the app falls back to gemini-2.5-pro. The Gemini 3 models run on Google's global endpoint, so your text may be processed in a Google data center outside your country. If you attach a photo or screenshot, it is sent along with your text, on the same path and under the same terms, so the reflection can take it into account. It is not scrubbed the way text is, so do not attach an image that shows something you would not want to leave your device. The generated reply comes back to your phone. This is what makes the reflections possible: an AI cannot respond to your words without receiving your words.

The same path is used for crisis detection. When you write a moment, the text is also sent to the AI to judge whether the moment calls for real-world crisis resources rather than the app's normal flow. This is a safety check; it can only add crisis resources, never remove them.

Because this is a direct call from your phone to Google, Google also receives your device's network (IP) address as part of the request, as with any internet connection.

We use Google Cloud's Vertex AI under its enterprise service terms. Under those terms, the text you send is not used to train or improve Google's AI models, and it is not reviewed by a human by default. Google processes it to generate the response and according to its own Google Cloud data handling commitments. We do not receive a copy, and we do not store it on our side.

To make sure only the genuine Niyora app can use this AI connection, the app uses Firebase App Check with Apple's App Attest. This attests that the request comes from the real, unmodified app on a real device. It is an anti-abuse measure; it does not identify you.

Two more requests leave your phone, and neither carries anything you have written or anything about how you use the app. To let us adjust which AI model Moon uses, and how long it waits, without shipping an app update, the app asks Firebase Remote Config, a Google service, for its current settings when it starts. And to deliver small fixes to the app's text and behaviour between App Store releases, it checks Expo's update service (EAS Update) for a newer version of the app's code. Each request carries a random installation ID created on your phone and, like any internet request, your device's IP address. Neither is used to identify you, track you, or advertise to you.

Apple Health

If you choose to connect Apple Health, Niyora asks iOS for permission to read one thing: your menstrual flow records, which tell the app when your periods were. It uses them to show your cycle on the calendar, to estimate your next period and your PMS window, and to time reminders. Niyora only reads. It never writes anything to Apple Health.

Health data stays on your phone. It is never sent to Google or to the AI, never sent to us, never used for advertising or marketing, and never shared with anyone. You can turn off access at any time in the Health app or in your iPhone's Settings.

The partial redaction, honestly

Before your text is sent to Google, the app runs an automatic scrub that replaces certain personal details with neutral stand-ins, and swaps your real words back into the reply when it returns. The scrub removes:

• Email addresses.
• Phone numbers.
• Names when a relationship or title makes it clear a person is meant (for example "my sister Sarah" or "Dr Patel"), and your own name when you introduce it ("my name is ...", "I'm ...").

Be aware of what this does not do. The scrub is deliberately careful, not exhaustive. A bare name with no cue around it (for example "Sarah slapped me") is not caught and will be sent. Short numbers and other identifying details may pass through. Most importantly, the emotional content of what you write, the situation, the feelings, the story, is sent as written, because that is exactly what the AI needs in order to respond. If you would not want a specific detail to leave your device, do not write it.

Paying for Premium

Niyora Premium is bought through Apple's App Store, with Apple's own in-app purchase system. Apple takes the payment and holds the billing relationship with you. We never see your card, your billing address, or your Apple Account details. None of it reaches us.

There is no payment provider and no purchase-tracking tool in the app, and no server of ours for a receipt to be sent to. When the app needs to know whether your subscription is still active, it asks the App Store directly from your device. Apart from the AI processing and the settings and update checks described above, that check with Apple is the only other exchange the app has with the outside world, and it carries none of the text you have written. (Reading Apple Health happens on your phone, between the app and iOS, and involves no network.)

The only thing kept from a purchase is a single flag on your phone, stored under the key niyora:premium, recording whether Premium is currently active, through a subscription or a lifetime purchase. It is what lets the app open the paid flow instantly and while you are offline. It lives in the app's own storage on your device, holds nothing else about the purchase, and goes when you delete the app.

What we do not do

• We do not sell or rent your data to anyone.
• We do not use your data for advertising, and there is no advertising in the app.
• There are no third-party analytics or tracking SDKs in the app. We do not track your behaviour across apps or websites.
• We do not build a profile of you, and there is no account to attach one to.
• Your text is not used to train our or Google's AI models.

Retention and deletion

Because your moments live on your device, you control them. You can delete your history from within the app, and deleting the app removes the stored data and the encryption key from your device. We hold nothing to delete on our end, because we never received it.

The text and any photo sent for AI processing are handled by Google to generate the response under the Vertex AI enterprise terms described above; we do not retain it.

Children

Niyora is intended for adults. It is not designed for or directed at children, and it is not a substitute for the care a young person in distress needs. You must be at least 16 years old to use Niyora. We do not knowingly collect data from children, and because the app has no accounts, we do not collect identifying information from anyone.

Niyora is not a medical or therapy service

Niyora is a self-reflection tool. It is not a medical device, not therapy, not counselling, and not a crisis service. It does not diagnose, treat, or provide professional mental-health advice, and the AI reflections are not the words of a clinician. If you are struggling, please reach out to a qualified professional. If you are in crisis or think you may be in danger, contact your local emergency services or a crisis line right away. The app may surface crisis resources, but it cannot replace real help and should never be relied on as your only source of support in an emergency.

Your controls

• Use of the AI reflections requires an internet connection; without one, the app falls back to its own written responses and nothing leaves your device.
• You can delete your moment history in the app at any time.
• You can remove all data by deleting the app.
• You decide what you write. The most reliable privacy control is choosing what to put into a moment.

Changes to this policy

If we change how the app handles data, we will update this policy and change the date at the top. Because there are no accounts, we cannot notify you directly; please check back here.

Contact

Questions about privacy: [email protected].