1. Introduction
This Privacy Policy explains how Ryze (“Ryze”, “we”, “us”) handles personal information when you use ryzeapp.org and Ryze’s student platform, including study helper, wellbeing support, and university planning features (“Service”).
Ryze is designed to support student life. We understand mood check-ins and journal entries can be personal. This Policy explains what information is involved, what the current prototype does, and what must be confirmed before production launch. Contact details are in section 11.
2. What data we collect
The information depends on which features are available and how you use them. It may include:
- Account details: name, email address, authentication identifier, age or age band, and any guardian consent or verification information required for an account.
- Study and planning information: subjects, study goals, course or university interests, and information you choose to submit to related tools.
- Wellbeing entries: mood selections, optional tags such as exams or sleep, journal text, reset-tool choices, and related usage. This information may reveal intimate details about how you feel.
- Technical and usage information: device and browser details, approximate network information, log and error data, and interactions needed to operate, secure, and improve the Service. [Confirm analytics and logging actually used.]
Only provide information about another person if you have a lawful basis and permission to do so.
3. How we use information
We may use information to create and manage accounts; provide the feature you asked for; show your own check-ins, journal entries, or planning information back to you; secure the Service; respond to questions; understand reliability and feature use; meet legal obligations; and protect users and the Service from misuse.
Before launch, Ryze must document the specific purpose and lawful basis for each data category and feature, set any analytics or product-improvement boundaries, and explain whether any automated personalisation takes place. We do not intend to use private journal entries for advertising. [Confirm this commitment, any model use, and all actual processing before publication.]
4. Data storage and security
Current demo: the sign-up form does not create a server account. It redirects in the same browser and keeps a first name, mood check-ins, and journal entries in browser session storage. These demo entries are intended to last only for the current browser tab session; they are not sent to a Ryze application backend by the form or dashboard.
The pages load styling and fonts from third-party CDNs (Tailwind CDN and Google Fonts). Those providers may receive connection information such as an IP address and browser request metadata when assets load. See section 6.
Production service: hosting provider, storage locations, cross-border transfers, encryption, access controls, backups, incident response, and security certifications are [to be confirmed and described accurately before launch]. Ryze should apply technical and organisational measures appropriate to the data and risks, and provide a contact route for privacy or security concerns.
5. Children and young people
Ryze is intended initially for users aged 13 and older. The prototype does not currently implement age verification or guardian-consent workflows, and does not create a server-side account. Do not launch account creation for children until age assurance, age-appropriate privacy defaults, required guardian consent, and safety processes have been reviewed and implemented for each market served.
The UAE’s Federal Decree-Law No. 26 of 2025 Regarding Child Digital Safety contains obligations for digital platforms, including rules concerning personal data of children under 13, age verification, and child-protection controls. The law describes limited conditions and a possible educational or health-purpose exception subject to a Cabinet resolution; do not assume that exception applies to Ryze. Confirm commencement, implementing decisions, service classification, and all applicable requirements with UAE counsel.
Primary source: Federal Decree by Law No. 26 of 2025 Regarding Child Digital Safety.
6. Third-party services
The current prototype uses Tailwind CSS and Google Fonts CDNs to deliver page assets. Their processing is governed by their own policies and infrastructure. No Google OAuth, email delivery provider, analytics platform, or production hosting/storage service is connected in this prototype.
When production integrations are selected, Ryze will identify relevant providers and explain the purpose for sharing data with them. Providers may include account authentication, hosting and database services, customer support, email delivery, or measurement tools. Their names, roles, processing locations, transfer safeguards, and links to their privacy information are [to be added after vendor selection and review]. Ryze should not send journal text or mood information to a provider unless the feature needs it and users are properly informed.
7. Your choices and rights
You can choose whether to use optional mood tags or journaling. Do not enter anything you would rather keep private. In the current demo, clear the browser tab session to remove session-only dashboard entries.
Depending on the laws that apply, you may have rights to request access to, correction of, deletion of, or restriction of processing of your personal information, withdraw consent where processing relies on consent, and raise a concern with the appropriate authority. Requests can be sent to support@ryzeapp.org. Ryze may need to confirm your identity and may have to retain some information to meet legal obligations or handle a claim.
The UAE Personal Data Protection Law includes rights concerning correction or erasure and restriction of processing. See Federal Decree by Law No. 45 of 2021 Concerning the Protection of Personal Data. Rights, scope, and exemptions must be applied to the facts of the Service.
8. Data retention
In the current demo, mood and journal entries are held in browser session storage and are not sent to a Ryze application backend. Production retention periods have not been set. Before launch, specify how long each category is kept, when backups expire, how deletion requests are handled, and which records must be retained by law. Keep personal information only for as long as there is a documented need or legal requirement.
9. UAE Personal Data Protection Law
Ryze intends to comply with privacy and data-protection laws that apply to its activities, including Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data where applicable. The Law’s scope and exceptions depend on the controller, processing, data, and establishment involved. This draft is not a statement that Ryze has completed a compliance assessment or that the Law applies to every processing activity.
Before launch, the responsible entity should assess its controller and processor roles, lawful bases, notices and consent, processor agreements, security measures, data-subject request handling, transfer rules, and any special-category or child-data obligations.
10. Changes to this Policy
We may update this Policy as the Service or applicable law changes. We will update the date above and provide notice of material changes through the Service or by email where appropriate. The updated Policy applies from its stated effective date.
11. Contact
Privacy contact: Support@ryzeapp.org
Operating entity: Ryzeapp
Do not include journal entries or sensitive details in an initial support request unless they are needed to resolve it.