Privacy notice

Effective date: 20 September 2026 · Last updated: 20 September 2026 · Applies to the ELIRI mobile app (private alpha) and this website.

This page describes what ELIRI actually does with data. It is written from the app's source code and its backend schema, and it is updated when they change.

1. What ELIRI is

ELIRI is a mobile app that offers you a small, real-world thing to do when you have a spare moment, and then steps aside. It is made by the developer of ELIRI ("we"), reachable at privacy@eliriapp.com. ELIRI is not a medical, health or wellness treatment product and does not claim to be one.

2. No account — a pseudonymous identity instead

ELIRI does not ask for your name, email address, or phone number for the current anonymous experience. There is no sign-up and no password.

Instead, the first time an installation goes online it signs in anonymously to our backend and receives a random identifier (an "anonymous uid"). That identifier is stored in your device's secure storage and is sent with every request the app makes to our backend, so the backend can tell which rows belong to which installation. It is not linked to your name, email, phone number or advertising identifier because we never have those. It is, however, a persistent pseudonymous identifier for your installation until you delete it (section 8), so we do not describe ELIRI as "anonymous" in the sense of "cannot be told apart from anyone else".

3. What stays on your device

ELIRI is local-first: the product works from what is on the phone, and it works offline. On the device ELIRI keeps:

• whether you have finished onboarding, the mission you have accepted, and your history of completed missions (mission identifiers and timestamps);
• your rhythm setting and the one pending surprise notification, with its backoff;
• what you have told ELIRI on the ELIRI & YOU screen (interests, lean, things you'd rather avoid) and what it has learned from how missions went;
• the local "moment evidence" log — a record of what ELIRI offered, what you did with it, and the outcome — with a mark saying which rows have already reached the backend;
• the anonymous session (access and refresh tokens, uid) in the operating system's secure storage, excluded from device backups.

4. What reaches ELIRI's backend (Supabase)

Our backend runs on Supabase (Supabase, Inc.), in the United States (us-east-1). It receives two kinds of rows, both tied to your anonymous uid.

4.1 One install row per installation

• the anonymous uid (owner) and an install identifier;
• platform (iOS or Android) and app version;
• your rhythm setting and whether notifications are allowed, undetermined or denied;
• created and last-seen timestamps.

4.2 Evidence events — how missions went

Each event is a small structured row: the event category and kind (for example an offer, a "go", a "done", a feedback answer), the mission identifier (never the mission text), how the offer was delivered (opened by you, a surprise notification, first run), the day and hour and a coarse time-of-day bucket (never a finer timestamp), a sequence number, and a payload limited to codes, counts and identifiers: for example the mission family and size, why it was selected, seconds from a scheduled notification to the app being opened, seconds spent on a mission, and your feedback answer if you gave one. The backend also records the time it received the row.

The app builds each row from an allow-list; anything outside it never has a path to leave the device. The database independently refuses payloads that contain text fields, identifiers it does not expect, or more than 4 KB. Each row can only be read, written or deleted by the installation that owns it (row-level security).

4.3 Why

To learn whether ELIRI creates moments worth having happened — which missions get done, which surprises land, which are ignored — and to make the product better during the alpha. Not to advertise to you and not to build a profile of who you are.

5. Notifications

Surprise notifications are scheduled locally on your device; ELIRI does not run a push server. Whether you allowed notifications, and how long it took you to open the app after a scheduled notification, are part of the install row and evidence events described above.

6. Screen Time

The private alpha ships with Screen Time off. ELIRI's code contains a Screen Time capability (iOS) that a future build may enable. Its boundary is fixed by the backend contract: ELIRI does not send raw app names, FamilyActivitySelection tokens, or raw Screen Time usage history to its backend. If the capability is enabled in a future build, the only thing that could leave the device is a generic "this offer was triggered by a Screen Time threshold" code inside the evidence described in section 4 — and this notice will be updated before that happens.

7. Crash and error diagnostics (Sentry)

When the app crashes or hits an unexpected error, a diagnostic report is sent to Sentry (Functional Software, Inc.), processed in the United States. A report may contain the error and its stack trace, the app release and build, environment, platform, operating system name and version, device model, family, architecture and memory, and up to fifty short coded "breadcrumbs" describing what the app was doing (for example "mission revealed", "app foregrounded", a network request's method, path and status). Your anonymous uid may be attached so that repeated crashes from one installation can be recognised.

Before a report leaves the device, ELIRI's own scrubber removes mission text, sign-in tokens and keys, request headers, cookies and bodies, email or username fields, IP address fields, and device name, identifiers, boot time, battery and timezone. Mission text, raw Screen Time data and anything you typed are not intentionally sent. Session replay, performance tracing, profiling and screenshots are off. We cannot promise the scrubber removes every conceivable field an operating system may add; we can say what it is built to remove, and that it is tested.

Sentry retains these reports for up to 30 days on our current plan, after which they expire. Sentry, like any online service, processes network metadata — including your IP address — in the course of receiving a report, even though ELIRI asks it not to store the IP on the report.

8. What ELIRI deliberately does not collect

ELIRI does not collect, send or store: your name, email address, phone number, contacts, photos, microphone audio, precise or approximate location, advertising identifier, hardware identifiers or fingerprints, raw Screen Time app or category data, the text of missions, or anything you type. The app has no text field that reaches the backend, and the backend refuses rows that carry text.

This website sets no cookies and runs no analytics, ads or tracking scripts.

9. Retention

• On your device: until you delete it. The local evidence log is capped (about 1,000 rows or 180 days once a row has reached the backend; longer for rows still waiting to be sent).
• Supabase (alpha): rows stay until you delete them or the alpha project is retired. Our current Supabase plan does not keep automated backups; if we move to a plan that does, provider backups would follow Supabase's published backup retention and this notice will say so.
• Sentry: up to 30 days, then the report expires.
• This website: our hosting provider (Vercel) keeps short-lived operational request logs as any web host does; we do not add logging of our own.

10. Deletion

In the app: ELIRI → ELIRI & YOU → Delete everything. This removes everything on the device, forgets the anonymous session, and — through an authenticated request that can only delete the caller's own identity — removes your anonymous user and every row it owns from Supabase. The app reports success only after each of those steps has actually completed; if it is offline it tells you and finishes when it is back online, uploading nothing in the meantime.

What deletion does and does not reach:

• Active ELIRI-controlled data — the device, the anonymous user, the install row, the evidence rows — is deleted.
• Crash reports already sent to Sentry are not deleted on request; they expire within the 30-day retention period. From the moment you delete, the app stops attaching the old uid to any report.
• Provider backups, if any exist, follow the provider's own schedule (see section 9).
• If you use ELIRI again afterwards, it creates a new anonymous identity that owns nothing from before.

The full walkthrough, and what to do if you can no longer open the app, is on the delete your data page.

11. Third parties

We do not sell data, share it with advertisers, or use analytics SDKs. Wherever you are, the backend and crash data above are processed in the United States.

12. Security, in brief

The app holds only a public "publishable" key; the credential that identifies your installation lives in the operating system's secure storage. Every backend row is protected by row-level security so that one installation cannot read or delete another's, including in the deletion path, which we test against cross-user attempts. No administrative credential exists in the app. Transport is HTTPS throughout.

13. Children

ELIRI is not directed at children under 13 and the private alpha is by invitation only.

14. Changes to this notice

This notice is kept in ELIRI's source repository and changes with the app. The dates at the top are the effective date and the last update. Material changes will be reflected here before they take effect.

15. Contact

Privacy questions or requests: privacy@eliriapp.com. Everything else: support@eliriapp.com or the support page.