Privacy policy

The essentials

Zenkai is a mobile app for personal standards, daily reflection and progress. Rabea Labs LLC operates Zenkai and is responsible for the information described here. Contact hello@rabealabs.com with privacy requests.

What we process depends on the features you use. Hosted Kai processes the conversations and media you choose to share. Connecting an agent you run yourself is a separate option: that agent sends the facts and scores you authorize it to submit.

Information we collect and why

Account: email, display name, profile image and authentication records. Email/password sign-in is handled by Supabase; passwords are hashed. Where a third-party sign-in option is available, we receive the identity information authorized through that provider, not your provider password.
Your progress: pillars, targets, budgets, personal standards and their revision history; daily facts, scores, explanations, corrections, reflections, goals, tasks, badges and preferences. These run your dashboard and explain your progress.
Hosted Kai: messages, replies, summaries, learned notes, extracted evidence, scoring jobs and usage records. Media you send is processed to interpret what you share. The hosted runtime discards raw media after processing; derived text and evidence can remain.
Character creation: if you choose a photo-based character, your photo is sent to fal.ai to produce a written description of your features, then a character image. Zenkai stores the description, generated images, generation status and consent records. The description is not used by Zenkai for identity verification. See retention details, including vendor storage.
Notifications: device push tokens and notification preferences, when you enable notifications.
Service operations: technical logs, usage and error information used to deliver, secure and troubleshoot the service.
Product analytics: builds with analytics enabled send explicit onboarding events, pseudonymous identifiers and app/OS versions to PostHog. The configured analytics excludes conversation contents, selfies, personal standards, session replay and advertising identifiers.

Who can see your information

Your private conversation, detailed report facts, written character description and private correction notes are not shared with guild members. If you join a guild, members can see your display name, profile/current character image, scores and progress, standards and revision history, day summaries, and shared score-review information. Leaving ends member access through the guild. Members may have retained information they previously saw.

Authorized service providers process information to run their part of Zenkai. We may also disclose information when legally required, to protect people or the service, or as part of a business transfer subject to appropriate safeguards.

Service providers and AI

Supabase: authentication, app database and character storage.
Cloudflare: hosted Kai processing, conversation state and scheduled work.
OpenRouter and the selected model provider: AI responses, interpreting media, summaries and scoring. Relevant messages, evidence and personal standards are included in model requests. Current hosted configurations use Google Gemini models.
fal.ai and its model infrastructure: optional photo interpretation and character generation.
PostHog: limited product analytics when enabled in your build.
Expo, Apple and Google: push notification delivery, and sign-in when the relevant option is available.
Vercel: website hosting and standard request logs.

We do not sell your personal information or use it for targeted advertising. We do not use your character or likeness in advertising or train our own AI models on it. Our OpenRouter account excludes providers that may train on submitted data; this does not mean zero retention. AI vendors can retain operational records under their own policies. The retention page explains the known storage periods and limits.

Retention and deletion

Core account and progress records remain until you delete them or your account. Hosted Kai has separate conversation, memory and job storage; completed dated runtime records expire after 90 local days, while revised memory and summaries can persist. Account deletion starts database deletion and separate hosted cleanup; these do not complete as one instant operation. Vendor records and backups can outlast deletion in the app. See Retention and deletion.

Provider safeguards

Our service providers are required to protect the personal information they handle for Zenkai to a standard at least equivalent to this policy and Apple’s applicable privacy requirements. This includes limiting processing to the service they provide, protecting confidentiality and security, and respecting applicable deletion obligations. Provider retention limits and operational exceptions are disclosed in the retention policy.

Withdrawing consent

For optional photo-based character creation, you can choose a preset character instead and remove an existing photo-based character in the app. To withdraw consent for other processing based on consent, or to request removal of previously shared information, email hello@rabealabs.com. Device permissions for photos, camera, microphone and notifications, where requested, can be changed in your device’s Settings. Revoking a device permission stops future access through that permission; it does not itself erase information already processed. Account deletion and the retention limits below explain how to remove existing data.

Your controls and rights

You can edit your standards, disable notifications, revoke agent access, remove your character, and request account deletion. In the app, open Settings → Delete account. For help, a data copy, correction or deletion request, email hello@rabealabs.com from your account email. We verify requests before releasing information. See Delete your account.

Depending on where you live, you may have rights to access, correct, delete, restrict or object to processing, receive a portable copy, withdraw consent, or complain to your local privacy authority. Information may be processed outside your country, including in the United States. We use providers and safeguards intended to protect it during those transfers.

Security and children

We use encrypted connections, account authentication and access controls to protect information. No service can guarantee perfect security. Zenkai is not directed to children under 13. Photo-based character creation is restricted to adults 18 and over; preset characters do not require a photo.

Changes and contact

We update this date when the policy changes and provide additional notice for material changes where required. Privacy contact: Rabea Labs LLC, hello@rabealabs.com.