Chaz Privacy Policy

Effective Date: December 10, 2025
Last Updated: May 19, 2026

Chaz (the "App") is operated by Starquest Studio LLC ("we," "our," or "us"), a Massachusetts-based company located at:

Contact: [email protected]

We are committed to protecting your privacy. This Privacy Policy explains how Chaz handles information when you use the App.

1. Scope of This Policy

This Privacy Policy applies to the Chaz mobile application and all related services. By using Chaz, you agree to the practices described in this policy.

Chaz is available globally and may be used by both adults and minors.

2. Data Storage Philosophy

Chaz is designed as a privacy-first, local-only app.

All personal content you create inside the App—including:

• Journal entries
• Mood check-ins
• Habit tracking data
• Course progress
• Nicknames
• Profile photos

is stored only on your device and is never uploaded to any server owned or controlled by us.

We cannot see, access, or recover this content for you.

3. Information We Do Not Collect or Retain

We do not collect or retain on our servers:

• Email addresses
• Login credentials
• Uploaded files or images
• Precise location
• Payment card information
• Contact lists

Chaz does not require accounts, logins, or identity verification.

About microphone audio and AI input: when you choose to use the voice ritual or journal-aware features, the microphone audio you produce and the transcript that results from it are routed in real time to the third-party AI providers listed in Section 6 so the feature can run. We do not retain raw audio on our servers, and we do not store voice recordings after a session ends. The third parties process the audio and resulting transcripts under their own privacy policies for the duration of your session.

4. Information We Automatically Collect (Analytics Only)

To understand how the App performs and improve stability, we use analytics tools that automatically collect limited technical data:

• Device type and operating system
• Anonymous device identifiers
• IP address
• App usage events
• Crash reports
• Performance diagnostics

We use third-party analytics and crash-reporting providers to help us collect and process this data.

This data is:

• Pseudonymous
• Used for product improvement, feature development, and understanding how users interact with the App
• Used to inform and improve AI-powered features, including the quality and relevance of AI-generated content
• Never sold
• Not used for advertising or tracking across other apps

We do not enable behavioral advertising, retargeting pixels, or cross-app tracking.

5. Profile Photos & Nicknames

If you choose to set a nickname or profile photo, this information:

• Is stored only on your device
• Is not uploaded to our servers
• Is not included in analytics
• Is not shared with any third party

6. AI Services and Third-Party AI Providers

Chaz includes AI-powered features that rely on third-party AI providers to run. These features only operate after you have explicitly consented in the App to your data being sent to those providers. You can revoke consent at any time in Profile → AI data sharing; revoking disables the AI features but does not delete anything stored locally on your device.

The table below identifies every third-party AI provider we use, what data is sent to each, and what they do with it. We have reviewed each provider's privacy commitments and selected them because they offer protections that are substantially equivalent to those described in this policy.

6.1 Voice rituals (voice-based AI conversation)

When you start a voice ritual, the microphone audio captured by your device is streamed in real time to the providers below. We do not retain raw audio on our servers; the providers process and discard the audio under their own privacy policies for the duration of your session.

• Daily.co, Inc. — WebRTC transport that carries the live audio between your device and our voice-processing backend. Privacy policy.
• Cartesia Inc. — Speech-to-text. Converts your spoken audio into a text transcript in real time. Privacy policy.
• OpenAI, OpenAI L.L.C. — Large language model (gpt-4o-mini). Receives the text transcript plus the system prompt that describes Chaz's role, and generates the assistant's spoken reply. Privacy policy. Chaz uses the OpenAI API; per OpenAI's API data policy, API inputs are not used to train OpenAI models by default.
• ElevenLabs Inc. — Text-to-speech. Synthesizes the assistant's reply into audio that is streamed back to your device. Privacy policy.

6.2 Journal-aware reflections (background analysis)

When you use a voice ritual or journal feature, the final transcripts of what you said may be passed through a separate analysis step that updates your local journal entries. This step sends transcripts and recent journal-prompt snippets — never your name, email, or device identifiers — to:

• Cloudflare, Inc. (Cloudflare AI Gateway) — proxy/observability layer for AI requests. Privacy policy.
• Google LLC (Gemini Flash Lite) — Large language model that decides which journal prompts a transcript is relevant to and rewrites the journal entry text. Privacy policy. Chaz uses the Gemini API; per Google's API terms, paid API inputs are not used to improve Google's products by default.

6.3 Soundboard (canned phrase playback)

The Soundboard feature plays back fixed, pre-written phrases. The phrase text is sent to ElevenLabs for text-to-speech; no user-authored content is sent.

6.4 Summary of data flows

• What we send: microphone audio during voice rituals; transcripts derived from that audio; recent journal prompts and entries when the journal-aware step runs; the canned phrase text for Soundboard. No name, email, or device identifier is sent alongside this content.
• What we never send to AI providers: your profile photo, your nickname, mood entries, no-contact streak data, course progress, or any other personal content stored locally on your device.
• Retention on Chaz's servers: none. Chaz operates a Cloudflare Worker that proxies these requests to keep API keys out of the app binary; the Worker does not log or store the content of your requests.
• Use of your content for AI training: we do not opt your content into training of third-party models. Where the providers above offer "no training on API inputs" terms (OpenAI API, Google Gemini paid API), we rely on those defaults; the other providers operate as transient processors.
• Advertising / profiling: we do not use AI-submitted content for advertising, profiling, or any purpose unrelated to delivering and improving the App's AI features.

6.5 Your consent

The first time you open Chaz, you will see an in-App consent screen that lists the providers above and explains what data is sent. The AI features are disabled until you tap Allow & continue. You can review and revoke this consent at any time in Profile → AI data sharing.

7. Health, Wellness & Medical Disclaimer

Chaz provides general emotional wellness and self-reflection tools only.

• Chaz is not a medical device.
• Chaz does not provide diagnosis, treatment, or clinical therapy.
• Chaz is not a substitute for professional mental health care.

If you are experiencing severe distress or a mental health emergency, we encourage you to seek professional help immediately.

8. Payments & Subscriptions

All purchases are processed exclusively through Apple In-App Purchases.

We:

• Do not store payment details
• Do not process credit cards
• Do not have access to your billing information

Apple's own privacy policy governs payment data.

9. Data Selling & Sharing

We do not:

• Sell personal data
• Rent personal data
• Trade personal data
• Share personal data for advertising

Analytics data is shared only with our analytics providers for internal product improvement.

10. International Users & Legal Compliance

Chaz is intended for global use and is designed to comply with:

• GDPR (European Union)
• CCPA / CPRA (California)
• General U.S. privacy laws

Because Chaz stores personal content only on your device, most rights requests (export, access, deletion) cannot be fulfilled remotely—there is no centralized personal database containing your journal entries, moods, or habits.

11. Data Deletion

Because your personal content never leaves your device:

• Deleting the App permanently deletes all personal content stored within it.
• We have no ability to remotely delete or restore data on your device.
• Analytics data is retained only in aggregated or pseudonymous form.

12. Tracking & Cookies

Chaz:

• Does not use Apple App Tracking Transparency (ATT) cross-app tracking.
• Does not use marketing cookies.
• Does not use retargeting pixels.
• Does not track you across third-party apps or websites.

13. Children & Minors

Chaz may be used by minors. However:

• We do not knowingly collect personally identifiable information from children.
• No account creation is required.
• No personal data is uploaded to our servers.
• No advertising profiling is used.

Parents may delete all local data at any time by removing the App from the device.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we do:

• The "Last Updated" date at the top will be revised.
• Material changes may be communicated within the App.

15. Contact Information

If you have questions about this Privacy Policy, you may contact us at: