1. Overview and scope
This Privacy Policy explains how Iris Light Within LLC (“Iris,” “we,” “us,” or “our”) handles information when you use irislightwithin.com, the limited-access Iris web app at irisapp.app, and Iris-operated support, privacy, and account-request channels that link to this Policy (collectively, the “Services”). Native mobile apps have not been publicly released and are not treated here as available products.
Iris is an adult-focused AI service for private reflection and everyday support. Iris is not a human, therapist, medical provider, lawyer, financial adviser, or emergency service.
Plain-language summary: We use information to provide and protect the features you request, administer accounts and web billing, honor choices, and meet legal obligations. We do not sell personal information, and we do not give private conversations to advertising partners for behavioral advertising.
2. Information we collect
Account, authentication, and contact information
Depending on the sign-in methods enabled, we may collect an email address or phone number, a password hash or authentication token, identifiers from Google or Apple sign-in, display name, age confirmation, language, country or region, account and session identifiers, and information you send to support.
Conversation and feature content
We process the messages you send and responses generated for you. If you use the related features, this may include conversation history, conversation summaries and titles, journal entries, saved reflections, a cross-conversation memory profile, feedback, images you attach, voice transcripts, closing notes, notification preferences, and files or content you intentionally upload.
Technical, safety, and usage information
We may collect device and browser type, operating system, app or site version, IP address and approximate region inferred from it, time zone, locale, session activity, last activity, message and entitlement counts, feature events, consent records, security and anti-abuse signals, error and performance data, and moderation categories or timestamps. Optional analytics are described below.
Payment and subscription information
Stripe processes web payment credentials. Iris may receive Stripe customer, checkout, transaction, price, product, subscription, entitlement, promotion, cancellation, refund, and status information. Iris does not receive your full payment-card number or bank-account credentials.
3. Sensitive information you choose to provide
Private conversations may reveal health or mental state, grief, trauma, relationships, sex life or sexual orientation, gender identity, finances, religious or philosophical beliefs, unusual experiences, precise personal circumstances, or other deeply personal information. Memory and summaries may derive or infer similar information from what you say.
You decide what to share. We process sensitive content to provide the feature you request, personalize Iris where you allow it, maintain safety and security, and meet legal obligations. Where law requires consent that is separate from this Policy, we will request it before the relevant collection or sharing.
Do not include another person’s private information unless you have the right to share it. Do not send passwords, full payment-card numbers, government identifiers, or information that is not needed for your use of Iris.
4. How we use information
- Provide accounts, guest sessions, AI conversations, history, memory, journals, voice when enabled, topic features, sounds, notifications, support, exports, and settings.
- Authenticate users; apply free or paid access and usage allowances; administer Stripe web billing; and prevent duplicate, fraudulent, or abusive use.
- Generate responses, summaries, titles, memory, safety notices, and other requested outputs.
- Secure the Services, run automated moderation, investigate misuse, diagnose errors, and maintain reliability.
- Respond to support, privacy, account-deletion, dispute, and legal requests.
- Measure privacy-limited product events and improve accessibility, reliability, safety, and design without sending private chat, journal, or memory content to product-analytics tools.
- Comply with law, enforce our Terms, and protect users, Iris, and others.
Iris does not make medical, legal, credit, employment, housing, insurance, or other consequential decisions about users.
5. AI processing, model training, and provider retention
Iris uses OpenAI models and DeepSeek models through AI service providers. Depending on the feature, OpenAI or DeepSeek may receive content needed to fulfill your request, such as your current message, relevant conversation history, a summary, memory, Iris reference material, or transcript text.
Iris does not use private conversations to train its own general-purpose AI model. OpenAI states that API inputs and outputs are not used to train its models by default unless a customer opts in. Iris does not use OpenAI Zero Data Retention, so OpenAI may retain abuse-monitoring logs containing prompts, responses, or related metadata for up to 30 days, unless law requires longer. DeepSeek may process and retain inputs, outputs, and related data under its applicable terms, Iris’s service settings, and legal obligations; its public Open Platform materials do not state one universal retention period for end-user API content.
AI outputs may repeat details from your input or memory and can be inaccurate, incomplete, outdated, or inappropriate. Do not treat them as verified facts.
6. Voice processing
If you use live voice, microphone audio is transmitted to OpenAI for realtime transcription and response. Iris may retain transcript text, generated closing notes, and limited session metadata as described in this Policy. Browser, operating-system, and network providers may receive technical data needed to establish the connection.
Do not use voice if you do not want audio transmitted for this processing. Voice availability depends on the release and account.
8. Automated safety systems and limited human access
Text and, when voice is enabled, transcript text may be sent to automated moderation systems to identify possible crisis, abuse, fraud, or policy concerns. Automated systems can fail, miss risk, or make mistakes. Iris does not provide continuous human monitoring, real-time intervention, or emergency dispatch.
Authorized personnel may access limited information when reasonably necessary to respond to your support or privacy request, investigate a report, protect security, prevent fraud, debug a problem, comply with law, or administer the service. Authorized personnel do not routinely read private conversations and may access full conversation content only when reasonably necessary for the purposes described above.
If danger is immediate in the United States, call 911. For suicide or self-harm crisis support, call or text 988. Outside the United States, contact local emergency or crisis services.
9. Memory and personalization
Cross-conversation memory and automatic memory extraction are enabled by default for eligible accounts. Iris may use conversation content and automated systems to create or update a compact profile so later responses can be more personalized. Certain settings may ask before saving sensitive memory items.
You can view memory, turn memory off, or clear it. Turning memory off pauses its use and future updates but does not erase stored items. Clearing memory stops Iris from using saved memory for personalization but does not delete the original conversations. Use a privacy request or authenticated account deletion to request erasure, subject to the retention exceptions in this Policy.
An automated profile can be inaccurate or include information you did not expect. Review it and use available controls or a privacy request to correct, deactivate, or delete it.
10. Retention and deletion
Iris retains registered-user conversation data for up to 12 months from last activity, guest data for 30 days from last activity, and data associated with a canceled paid account for up to 12 months after subscription cancellation. A user may delete available conversations sooner. Different categories may have shorter or longer periods when reasonably necessary for the purpose described here.
When an eligible user completes authenticated self-service account deletion, Iris closes access immediately and starts deletion. The process removes the authentication account and private account content, including conversations, messages, journals, memory, profile data, activity records, notification records, and associated user uploads. There is no general 30-day recovery window.
We may retain limited transaction and subscription records, consent and legal-policy records, records showing that a deletion request was completed, fraud and security records, dispute and legal-hold material, and information required by law. Where practical, retained operational records are pseudonymized or disconnected from the active account. Retention in support systems, security logs, provider systems, and routine backups may vary as permitted by law.
AI service providers may retain limited data under their applicable terms and legal obligations after deletion from Iris systems. See Delete an Iris Account for the current process. Confirm cancellation of a recurring Stripe subscription separately before deletion.
11. Your rights and choices
Depending on where you live, you may request access, correction, export, deletion, restriction, objection, withdrawal of consent, or information about collection and disclosure. You may also have the right to appeal a decision and use an authorized agent.
- View, turn off, correct, or clear cross-conversation memory.
- Delete individual conversations or the account where available.
- Adjust analytics and marketing choices in the web app.
- Opt out of marketing communications.
- Ask for access, correction, export, deletion, a recipient list where required, or withdrawal of consumer-health-data consent.
- Decline any optional content-contribution or model-training program.
Use Privacy Choices or email app@irislightwithin.com. We may verify identity and an agent’s authority. We will not discriminate against you for exercising an applicable privacy right.
12. Consumer health data summary
Iris conversations, journals, voice transcripts, and memory may include or infer mental, physical, reproductive, sexual, or other health-related information. We use that information to provide requested features, protect security, honor choices, and comply with law. We do not sell consumer health data or share it for targeted advertising.
Where applicable, you may ask to access or delete consumer health data, obtain a relevant recipient list, withdraw consent, or appeal a denied request. Read the separate and more detailed Consumer Health Data Privacy Policy for categories, sources, purposes, recipient types, consent, and request instructions.
14. External sites and unusual-experience submissions
When you follow a link to unusualexperiences.app or another external destination, information you submit is governed by the terms and privacy notice displayed there. Iris is not responsible for a third-party site it does not operate.
15. Security
We use administrative, technical, and organizational safeguards designed to protect information, including encrypted transmission, authentication, role-based access, logging, and data minimization. No system is completely secure, and limited-access software may contain defects. If law requires notice of a security incident, we will provide it in the required manner and timeframe.
Protect your credentials and devices. Use the account-recovery and security options shown in the Services and contact support if you suspect unauthorized access.
16. International processing
Information may be processed in the United States and other locations where Iris or its providers operate. Where applicable law requires it, Iris will use appropriate legal safeguards for international transfers. Mandatory rights in your place of residence remain available.
17. People 18 and over
The Services are intended only for people 18 and over. We do not knowingly offer Iris to children. If we learn that a person under 18 provided personal information, we will take appropriate steps to restrict access and delete information as required.
18. Changes and versions
We may update this Policy as features, providers, or legal requirements change. We will post the revised version and effective date and provide additional notice or obtain renewed consent where required.
19. Contact
Iris Light Within LLC
4235 SE 20th Place, Suite 401A
Cape Coral, Florida 33904
United States
Email: app@irislightwithin.com
Use Privacy Choices for access, correction, export, deletion, consumer-health-data, authorized-agent, and appeal requests. Use Delete an Iris Account for complete account deletion.