Rykie — Privacy Policy
Last updated: 30 September 2026
The short version
Rykie is an organic chemistry practice app. Every question is inside the app, so it works with no account and no network at all. If you do sign in, what leaves your phone is your progress, an account identifier and — if you join the league — a league profile that only the friends you add can see. If you buy premium, the store or payment provider you buy from handles your payment, and we learn that you have it.
There are no ads, no analytics or tracking SDKs, no advertising identifier, and nothing is ever sold or shared for advertising.
Who is responsible
Rykie is made and operated by Josip Car, an individual developer. Questions, requests, or anything to do with your data: rykie.support@gmail.com.
1. What stays on your phone
Rykie keeps all of this locally, and it never leaves the device unless you have an account (see section 2):
- Your progress — which sessions you have finished, how many questions you answered correctly, how long you spent, your streak, XP, coins, hearts, the avatar and title you picked, and where to resume.
- Your app settings — theme, sounds, vibration, coloured atoms, reminders, and which tutorials you have already seen.
- Reminders, if you turn them on: they are scheduled on the phone itself, and nothing is sent to a server to deliver them.
- Your sign-in session, if you signed in. It is stored encrypted in the Android Keystore (or the iOS Keychain), not in an ordinary settings file.
Rykie asks for no location, no contacts, no camera, no microphone, no photos, and no access to your files.
In the web app the same things are kept in your browser’s local storage instead, and the sign-in session too (there is no Keystore in a browser). Clearing your browser’s site data clears them from that browser.
2. What leaves your phone
Rykie signs you in so your progress survives a lost or replaced phone. Both ways in create an account on our server:
| What | When | Why |
|---|---|---|
| Account identifier — a random id. With Google sign-in, also your email address and your Google account id; Google also passes your name and a link to your profile picture, which our sign-in service stores with the account. The app does not show or use them. | When you sign in with Google, or tap “Skip for now” (which creates a guest account with a random id and nothing else). | So the progress on the server can be recognised as yours. |
| Your progress — the same document described in section 1. | Periodically while you use the app. | So it can be restored on a new phone. |
| League profile — a display name you type, the built-in avatar you chose, and a short invite code. Friends you have added see it together with your XP, streak, sessions finished, questions answered and answered correctly, when you joined and when you were last active, the title and profile background you picked, and whether you have premium. | Only if you join the league. | So the friends you have added can follow each other's progress. |
| Purchases — your account identifier, and the premium plan you bought with its dates and status, as reported by the store. | Each time the app starts while you are signed in (to check whether you have premium), and when you buy or restore it. | So premium switches on, stays on across your devices, and switches off when it ends. Your card or other payment details go straight to Google Play or to Paddle, never to us. |
| Friend links — which accounts you added. | Only when you add someone by their invite code. | So the league shows the right people. |
Your email address is never shown to other users. The league shows only the display name you chose, which does not have to be your real name. There is no global leaderboard and no way to search for a person: you are only ever visible to someone you gave your invite code to.
3. What Rykie does not collect
- No advertising identifier, and no ads of any kind.
- No analytics, attribution, or advertising SDKs. The one SDK that talks to a server of its own is RevenueCat’s, which manages purchases (section 4).
- No third-party crash-reporting SDK.
- No location, contacts, calendar, photos, camera, microphone, call or message data.
- Nothing is sold, and nothing is shared with anyone for advertising or profiling.
4. Who else touches the data
- Supabase Inc. hosts the database, authentication and
the server functions. The Rykie project runs in Frankfurt, Germany
(AWS
eu-central-1), so your progress and your account are stored inside the EU. As part of running the service, Supabase records sign-in events, which include the IP address the request came from, in a short-lived security log. - Google LLC, only if you use “Sign in with Google”. Google tells us your email address and account id, and Google’s own privacy policy covers what Google does with the sign-in.
- RevenueCat, Inc. manages purchases. While you are signed in, the app tells it your account identifier each time it starts, to check whether you have premium, along with the usual details an app sends to a purchase service, such as the platform, app version and country. It keeps the record of your purchases so that premium works across your devices.
- Paddle.com Market Limited, if you buy on the website. Paddle is the Merchant of Record: it takes your payment, collects and pays the tax, and issues receipts and refunds. It receives your email, billing country and payment details and is responsible for them under its own privacy policy. Google Play does the same for purchases made on Android.
- Cloudflare, Inc. hosts the website and the web app. Like any web host it sees the IP address and browser details of each request, in standard access logs.
Supabase, Google (for sign-in) and RevenueCat act on our instructions as processors. Paddle and Google Play (for payments) are independent controllers of your payment details. Nobody is given your data for their own marketing.
5. How long it is kept
- Your progress and profile: for as long as your account exists. Deleting the account deletes them immediately — see section 7.
- Guest accounts (created by “Skip for now”): deleted automatically, with their progress, once they have not been used for 90 days. The copy on the phone is not affected. Accounts signed in with Google are never deleted on a timer.
- Purchase records: RevenueCat keeps the record of your purchases for as long as it is needed to keep premium working. Paddle and Google keep payment and tax records for as long as the law requires. Write to us and we will have RevenueCat’s record removed where the law allows it. Deleting your account does not cancel a subscription: cancel it in Google Play, or from Manage subscription on the web, first.
- Security logs at our hosting providers: a short retention window, typically no more than 30 days.
- Everything on the device: until you delete your account or uninstall the app.
6. Children
Rykie is written for secondary-school and university chemistry students. It is not directed at children under 13, and we do not knowingly create accounts for them. If you believe a child under 13 has an account, write to the address above and it will be deleted.
7. Your rights, and how to delete everything
You can see, correct, export, or delete your data at any time.
Deleting your account in the app
Profile → Account → Delete account. This erases the account, your progress, your league profile and your friend links from the server, and wipes the copy on your phone. It happens straight away and cannot be undone. It does not cancel a subscription — cancel that in Google Play, or from Manage subscription on the web, before you delete.
Deleting it without the app
See the account deletion page, or email rykie.support@gmail.com from the address you signed in with. A guest account has no address to write from; it is deleted automatically after 90 days without use (section 5).
If you are in the EU or the UK, you also have the right to complain to your national data protection authority.
8. Security
Everything the app sends travels over HTTPS. Each learner’s rows are protected by row level security policies on the database, so one account cannot read another’s. Sign-in tokens are stored in the phone’s hardware-backed keystore rather than in an ordinary settings file (in a browser, in the browser’s own storage for this site).
9. Changes
If this policy changes, the date at the top changes with it, and a material change will be announced in the app before it takes effect.