Psyched Privacy Policy

Effective: 21 August 2026
Last updated: 10 November 2026

The short version

• Psyched works with no account at all. If you never make one, nothing you write is sent to our servers. It stays on your phone, in your phone's own backup, and, only if you turn on "Sync with iCloud", in your own iCloud.
• If you make an account, everything you write while signed in is copied to a database we run so you can get it back on another phone. That includes event titles, the fear you wrote down, and your notes afterwards.
• The AI model that writes the companion lines never sees any of your writing. It gets event types and your 0–10 ratings, and nothing else. This is the one claim in this policy we care most about being exactly true. You can also switch the AI-written lines off in Settings, and then nothing is sent to it at all.
• You can delete your account inside the app. It really deletes. There is no undo.
• No ads. No analytics SDKs. No trackers. Nothing sold to anybody, ever.

This policy covers the Psyched app on iPhone and on Android, and the Psyched pages on our website. Where the two apps differ, the section "If you use the Android app" says how.

What Psyched is

Psyched is a performance psychology tool. You log something you're about to do, rate how bad you expect it to be, then rate how bad it actually was, and the app shows you the gap between the two over time.

It is not a medical service, a mental health service, or therapy. It does not diagnose anything, treat anything, or give clinical advice.

Who is responsible

Psyched is published by Ruike Liu. For anything about your data, write to PsychedSupportTeam@gmail.com.

What stays on your phone

Your events live on your device in the app's own database (Apple's SwiftData on iPhone). That's the real copy. The app reads and writes it whether or not you have an account, and whether or not you have any network connection.

Also stored on your device, in standard app storage:

• Which companion character you picked, your language choice, whether AI-written companion lines are on, and whether "Sync with iCloud" is on.
• The country of the App Store you downloaded Psyched from, which the app uses to choose which of our servers to talk to.
• A random identifier generated once when you install the app. It is not linked to you, your name, or your Apple Account. It exists so our server can limit how many companion lines one install asks for in a day.
• If you sign in: your username, an account ID, when your session expires, which of our servers holds the account, and bookkeeping for sync (when it last ran and where it left off).
• If you sign in, your session token, stored in the iOS Keychain rather than in ordinary app storage, because it is a credential.
• If you make an account, its recovery code, saved to your iCloud Keychain. Apple syncs it, end-to-end encrypted, to your other devices signed in to the same Apple Account; with iCloud Keychain off it stays on this iPhone. Our server sends the code to your phone when it is issued and keeps only a hash of it. The code comes back to us only if you use it to reset your password, and that reset replaces it with a new one.

Companion lines the app has already fetched are held in memory while it is open, so the same screen doesn't ask for the same text twice. They are not written to disk.

Reminder notifications are scheduled locally by iOS. The notification text contains your event title, and it never leaves your device to be delivered.

Like any app's data, all of this is included in your phone's own backup (an iCloud Backup, or a backup to your computer) if you have one switched on. That backup is between you and Apple; we can't see it.

If you turn on iCloud sync

On iPhone, Settings has a "Sync with iCloud" switch. It is off by default, and it has nothing to do with a Psyched account: you can use either, both, or neither.

If you turn it on, your events are copied to your own private iCloud storage, tied to your Apple Account, so they appear on your other Apple devices. That copy includes everything in each event, including the free text you wrote, the same list as under "What happens if you make an account" below. It travels straight between your phone and Apple. It never passes through our servers, we cannot read it, and it is covered by Apple's privacy policy.

Turning the switch off stops the copying. What is already in your iCloud stays there until you delete it, which you can do in the iPhone's Settings, under your name and iCloud, where iCloud storage is managed.

What happens if you make an account

An account is optional. It exists for one reason: so your history survives losing your phone, and so you can sign in on a new one.

When you register, we store:

• Your username, as you typed it, plus a lowercased copy used to check that no two accounts share a name.
• A hash of your password. Not the password. We run it through PBKDF2-HMAC-SHA256 with 100,000 iterations and a random 16-byte salt, and store only the result. It cannot be turned back into your password. We cannot read your password, tell you what it was, or email it to you, because we genuinely do not have it.
• A hash of your recovery code, stored the same way. The app saves the code itself to your iCloud Keychain when you sign up; we keep only the hash.
• The time the account was created and last changed.

Once you're signed in, the app syncs the events you log while signed in to our server. Events you logged before making an account, or while signed out, belong to the phone's signed-out profile: they stay on the phone and are never uploaded. A synced event includes everything in it, including the free text you wrote:

• the event title
• the event type (exam, quiz, presentation, interview, tryout, other)
• the date and time of the event
• your focus intention
• the fear you wrote down — what you were afraid would happen
• your dread rating and your reality rating, 0 to 10
• when you completed the pre-event protocol
• which body sensations you tapped at the protocol's check-in, from the fixed list of six (heart pounding, sweaty palms, racing thoughts, and so on), so Insights can show which ones come up most often on any phone you sign in on
• your outcome note — what you wrote afterwards
• created and updated timestamps, and a deletion marker if you deleted the event

We are stating that plainly rather than hiding it behind "content you provide." If you sign in, the sentences you write in Psyched sit in a database we run. If you would rather they never did, don't make an account — the app is fully usable without one and we designed it that way on purpose.

So that somebody can't sit there guessing passwords or usernames, our server keeps three kinds of counter:

• failed sign-in and failed recovery attempts against a username, counted over 15 minutes
• failed sign-in and failed recovery attempts from a network address (IP address), counted over 15 minutes
• requests to create an account from a network address, counted over an hour. Every such request is counted, including the successful one that made your account.

Each counter is one row holding the username or the network address, a count, and the time its current window started. Nothing in a row says which account it belongs to. The username counter is deleted when you sign in successfully and when you delete your account. The network-address rows are not deleted on a schedule. A row starts again from one the next time that address trips it, and otherwise stays in the database. So we hold a list of network addresses that have tried to create an account or failed to sign in, each with the time of its latest window. An address that created an account has a row whose time is close to the time that account was created, which means someone with access to our database could often work out which address made which account.

What DeepSeek sees

The companion characters are written by DeepSeek, an AI model provider based in China. Their servers are outside our control, so what we send them matters more than anything else in this policy.

We send DeepSeek only the following, and never anything else:

• which companion you picked, and which language you're using
• which moment in the app you're in: the body check-in or the evidence step of the pre-event protocol, the outcome screen, or one of the two readings on Insights
• the event type — the word "exam" or "interview", nothing about which exam
• for the short companion lines on the protocol and outcome screens, your ratings only as rough bands: whether your dread was low, medium or high, and whether reality came in under, over or close to it. The exact numbers stay on your phone.
• for the two Insights readings, your exact dread and reality ratings and figures our own code calculates from them: how many events you've logged, your average dread, your average reality, the average gap, how many events you over-predicted, and up to your twenty most recent events as type-plus-two-numbers
• the same kind of figures broken down by event type — for each type, how many you logged, the average dread, the average reality, the average gap, and how many ran hotter than reality
• labels our code derives, like whether your gap is narrowing or widening
• if you're using the reappraisal screen, which body sensation you tapped from a fixed list of six

For App Store privacy disclosure, we conservatively classify that fixed sensation selection as Health data. What DeepSeek is sent is not linked to your username, account, Apple Account, or random install identifier. The copy that syncs with your events, if you have an account, is stored with your account like the rest of the event.

We never send DeepSeek:

• your event titles
• the fear you wrote down
• your focus intention
• your outcome notes
• any date, for any event
• your username, your account, or your random install identifier

You can switch this off. In Settings, under AI, turn off "AI-written companion lines". From then on the app asks for no generated text at all, so nothing from it reaches DeepSeek, and your companion speaks in the lines built into the app and skips its comment on the next-move card. Everything else, including your chart, works exactly the same.

If you downloaded Psyched from the China mainland App Store, the app does not ask for generated companion text at all, so nothing from it reaches DeepSeek. You see the companion lines built into the app instead. The app learns which App Store it came from a moment after its first launch. Until then it goes by your phone's region setting, so a phone set to mainland China is treated as a China mainland download from the first second, and a phone set to any other region may ask for a generated line before the App Store has answered.

Requests for generated text go to our server, which talks to DeepSeek. DeepSeek never receives your network address or anything else about your phone. Our server builds each prompt from scratch out of the items listed above: every choice must match a fixed list and every number must be in range, or the request is refused, and anything else in a request is ignored. The code that handles accounts and synced events and the code that builds prompts are separate parts of the server that do not call each other, so there is no path from the synced-events database to a prompt. That separation is kept by how the code is organised and reviewed; no automated check enforces it yet.

Everything the model writes back is checked by our own code before you see it, and anything that reads as clinical language, invents a number we didn't supply, or breaks character is thrown away and replaced with a line built into the app.

Where your data is stored

If you have an account, your data sits in Cloudflare D1, a hosted SQLite database, in the Western North America (wnam) region, reached through a Cloudflare Worker. Cloudflare operates the infrastructure and can see the network requests that reach it, including your IP address, in the ordinary way any web host does. We don't keep our own logs of your requests. The one place our own database records a network address is the sign-in and sign-up counters described under "What happens if you make an account."

Requests for companion lines go through the same Cloudflare Worker whether or not you have an account. To cap how many lines one install can ask for in a day, the Worker keeps a counter in Cloudflare KV under your random install identifier and the date. It holds a number, nothing about what you asked for, and expires after two days.

Generated lines are cached in Cloudflare KV for 30 days so the same situation doesn't have to be written twice. A cached line is stored under the inputs that produced it and never under anything identifying you: the short companion lines under the plain combination (companion, language, moment, event type, rating bands), and the Insights readings under a hash of the figures that produced them.

If you downloaded Psyched from the China mainland App Store, new accounts are made on a server we run in mainland China, hosted by Alibaba Cloud, instead of on Cloudflare. Your account, your synced events, and the sign-in counters described above are stored there, in mainland China, and not on Cloudflare. Alibaba Cloud operates the infrastructure and can see the network requests that reach it, the same way Cloudflare can for everyone else. We don't keep logs of your requests there either: the web server's request log is switched off. Its error log is on, and a request that fails can leave a line there with the network address it came from. If you made your account from the China mainland App Store before version 1.2, when accounts there could only be made on Cloudflare, the app moves it — your username, password, and synced events — to the mainland China server the next time it can reach Cloudflare, and then deletes it from Cloudflare. Nothing about signing in changes. Otherwise an account stays on the server where it was made.

Apple sees whatever it normally sees when you download an app: your Apple Account and purchase records. That's between you and Apple, and we don't get names or email addresses from it.

Staying signed in

Signing in gives your phone a session token, which is 32 random bytes. The server never stores the token itself, only a SHA-256 hash of it, so a leak of our database would not hand anyone a working login.

A session expires 90 days after you sign in. After that the app asks you to sign in again. Signing out deletes that one session. Using your recovery code invalidates every session on every device. A session that simply expires stops working, but its record (the hash, your account ID, and its start and end times) stays in the database until you reset your password with your recovery code or delete your account.

If you lose your password

There is no password reset by email, because we never collect an email. There is no SMS reset, because we never collect a phone number. Instead, the app resets your password with the recovery code in your iCloud Keychain: tap "Forgot password?" on any device that keychain reaches and choose a new password. Each reset replaces the code with a new one, saved the same way. Accounts made before the app saved codes to iCloud Keychain were shown the code once at signup, and that code still works.

If you lose your password and your recovery code, your account cannot be recovered by anyone, including us. That happens if your devices with the code are all gone and iCloud Keychain was off, or if you delete it from your keychain. We cannot verify who you are, so we will not hand over an account to someone who asks nicely. This is a deliberate design choice and the cost of not collecting your contact details.

Your history is still on your phone in that situation. It's the server copy and the username that are gone.

Deleting your account

Settings has a delete option. It asks for your password and asks you to confirm twice, and then:

• every event of yours on the server is deleted, including the free text
• every session of yours is deleted
• your user record, with your username and both hashes, is deleted
• the username sign-in counter described earlier is deleted
• on your phone, the app deletes that account's events, their reminders, and the saved recovery code, and signs you out

Events you logged while signed out, your companion and language choices, and the random install identifier stay on the phone. If "Sync with iCloud" is on, the deletion of those events carries through to the copy in your iCloud. The network-address counters are not tied to your account and are not removed.

This is a hard delete, not a "deactivated" flag we could restore. It is not reversible and we cannot get it back for you. If you want to keep your history, save it somewhere else first.

Cloudflare's own infrastructure backups may hold a copy for a short period before rolling off. We don't read them and can't selectively edit them. For accounts on our mainland China server, our nightly backups and Alibaba Cloud disk snapshots may hold a copy for up to 14 days before they are deleted.

Links to other services

The Toolkit tab links to research papers, and its Get support page lists helplines and websites run by other organisations. Tapping one opens Phone, Messages, WhatsApp or your browser. Psyched sends nothing about you when you do, and has no arrangement with any of them; once you call, text, message or visit, that organisation's own privacy policy applies (and WhatsApp's, for a WhatsApp link). Nothing on these pages reads your events, and nothing on them is generated by an AI while you use the app: the text ships with the app, and nothing from these pages is sent to an AI provider.

What we don't do

• No advertising, and no ad networks.
• No analytics SDK. No Firebase, no Amplitude, no Mixpanel, nothing of that kind.
• No third-party trackers, pixels, or fingerprinting.
• No data brokers. We do not sell, rent, or trade your data, and we never will.
• No location, contacts, photos, microphone, camera, HealthKit data, or advertising identifier. The app doesn't request them. The only body-related information that leaves your device is the fixed sensation selection: sent to DeepSeek as described in "What DeepSeek sees," and synced with your events if you have an account or turn on iCloud sync.
• No profile-building across other apps or websites. There is nothing to build one from.

The only third parties in the picture are Apple (app distribution, and iCloud if you use iCloud sync or iCloud Keychain), Cloudflare (hosting), Alibaba Cloud (hosting, for accounts made from the China mainland App Store), and DeepSeek (companion text, with the strict limits described above). On Android, Google takes Apple's place for backup and for saving your recovery code. Our website is served by GitHub, and one page on it loads fonts from Google.

If you use the Android app

Psyched for Android is a separate download from our website. It follows everything in this policy, with these differences:

• There is no iCloud sync. Your events live in the app's database on the phone.
• If Android's own backup is on, your events and settings are included in your Google Account's backup and in a phone-to-phone transfer, like any app's data. Your session token and the on-device copy of your recovery code are left out of both.
• Your session token is encrypted with a key held in the Android Keystore, which never leaves the phone.
• Your recovery code is saved with Google's Block Store, so it can come back when you restore a backup onto a new phone. That copy is held by Google under your Google Account, not by us.
• There is no App Store country to read, so the app goes by your phone's region setting. A phone set to mainland China uses our mainland China server and asks for no AI-written lines.
• The only permissions it asks for are notifications and exact alarms, for the reminder before each event, plus restarting those reminders after the phone reboots.

The website

The Psyched pages at vruikeliu.github.io (the app's page, the support page, this policy, and the Terms) are plain pages hosted on GitHub Pages. They set no cookies and have no analytics, no visit counter, and no trackers. GitHub, as the host, sees the ordinary request your browser makes, including your IP address, under GitHub's own privacy statement. The app's page loads its fonts from Google Fonts, so Google sees that request too. The website never receives anything from the app.

If you are under 18

A lot of people using Psyched are students, and many of them are under 18. Pretending otherwise would be dishonest, so here's how that works.

• You must be at least 13 to use Psyched.
• If you are under 18, an adult — a parent or guardian — should read this policy and the Terms with you and agree to them on your behalf. They are the legal party.
• We ask for a username and a password. We do not ask for your real name, your age, your school, your email, or your phone number, and you shouldn't put any of those into a username or an event title.
• Everything in "What DeepSeek sees" applies to you exactly as written. Your writing is not sent to an AI provider.
• A parent or guardian can write to PsychedSupportTeam@gmail.com to ask what data we hold for an account, or to ask us to delete it. Because we can't verify identities, we'll walk them through deleting it inside the app rather than doing it from a request in an email. That protects the account from someone impersonating a parent.

If you are in a place with specific children's privacy rules, note that we designed around them by collecting as little as possible rather than by age-gating you out.

What you can do

• Use the app with no account, in which case none of the account sections apply to you. Switch off AI-written companion lines as well, and the app contacts our servers for nothing at all.
• See everything we hold, by opening the app — the synced copy is the same as the copy on your phone.
• Delete individual events. Deleting a synced event empties its copy on the server: the title, the fear, the notes and the ratings are erased, and a blank marker saying "this event was deleted" stays so your other phones remove it too.
• Delete your whole account and all of it, from Settings.
• Ask us anything at PsychedSupportTeam@gmail.com.

How long we keep things

While your account exists, we keep your events so sync works. Sessions stop working after 90 days; an expired session's record is removed when you reset your password with your recovery code or delete your account. The daily counter for companion-line requests expires after two days. The sign-in and sign-up counters are kept as described under "What happens if you make an account": the username one is deleted when you sign in or delete your account, and the network-address ones are not deleted on a schedule. Cached companion lines expire after 30 days and contain no identifying data. When you delete your account, your events, your sessions, your user record and your username counter go at once.

Security, honestly

We hash passwords with PBKDF2 at 100,000 iterations, compare secrets in constant time, store only hashes of session tokens, and talk to the server over HTTPS only. Account deletion is written as explicit deletes inside a single transaction rather than relying on database cascade rules to fire.

No system is perfect, and this one is built by a small team. If you find a security problem, please write to PsychedSupportTeam@gmail.com before telling anyone else, and we'll fix it.

Changes to this policy

If we change what we collect or who we send it to, we'll update this page and the "Last updated" date, and the app will point you at it. If a change is significant — new third party, new category of data — we'll say so in the app rather than quietly editing the page.

Questions

Write to PsychedSupportTeam@gmail.com. This policy is governed by the law of the Commonwealth of Massachusetts, United States.