Psyched Privacy Policy

Effective: 21 August 2026
Last updated: 21 August 2026

---

The short version

• Psyched works with no account at all. If you never make one, nothing you write leaves your phone.
• If you make an account, everything you write in the app is copied to a database we run so you can get it back on another phone. That includes event titles, the fear you wrote down, and your notes afterwards.
• The AI model that writes the companion lines never sees any of your writing. It gets event types and your 0–10 ratings, and nothing else. This is the one claim in this policy we care most about being exactly true.
• You can delete your account inside the app. It really deletes. There is no undo.
• No ads. No analytics SDKs. No trackers. Nothing sold to anybody, ever.

What Psyched is

Psyched is a performance psychology tool. You log something you're about to do, rate how bad you expect it to be, then rate how bad it actually was, and the app shows you the gap between the two over time.

It is not a medical service, a mental health service, or therapy. It does not diagnose anything, treat anything, or give clinical advice.

Who is responsible

Psyched is published by Ruike Liu. For anything about your data, write to PsychedSupportTeam@gmail.com.

What stays on your phone

Your events live on your device in Apple's SwiftData store. That's the real copy. The app reads and writes it whether or not you have an account, and whether or not you have any network connection.

Also stored on your device, in standard iOS app storage:

• Which companion character you picked, and your language choice.
• A random identifier generated once when you install the app. It is not linked to you, your name, or your Apple Account. It exists so our server can rate limit requests per install and return you the same companion line if a request retries.
• Cached companion lines, so the same screen doesn't regenerate text repeatedly.
• If you sign in, your session token, stored in the iOS Keychain rather than in ordinary app storage, because it is a credential.

Reminder notifications are scheduled locally by iOS. The notification text contains your event title, and it never leaves your device to be delivered.

What happens if you make an account

An account is optional. It exists for one reason: so your history survives losing your phone, and so you can sign in on a new one.

When you register, we store:

• Your username, as you typed it, plus a lowercased copy used to check that no two accounts share a name.
• A hash of your password. Not the password. We run it through PBKDF2-HMAC-SHA256 with 600,000 iterations and a random 16-byte salt, and store only the result. It cannot be turned back into your password. We cannot read your password, tell you what it was, or email it to you, because we genuinely do not have it.
• A hash of your recovery code, stored the same way. The code itself is shown to you once, at signup, and never again.
• The time the account was created and last changed.

Once you're signed in, the app syncs your events to our server. A synced event includes everything in it, including the free text you wrote:

• the event title
• the event type (exam, quiz, presentation, interview, tryout, other)
• the date and time of the event
• your focus intention
• the fear you wrote down — what you were afraid would happen
• your dread rating and your reality rating, 0 to 10
• when you completed the pre-event protocol
• your outcome note — what you wrote afterwards
• created and updated timestamps, and a deletion marker if you deleted the event

We are stating that plainly rather than hiding it behind "content you provide." If you sign in, the sentences you write in Psyched sit in a database we run. If you would rather they never did, don't make an account — the app is fully usable without one and we designed it that way on purpose.

Our server also briefly records failed sign-in attempts against your username and against the network address you connected from, so somebody can't sit there guessing passwords. Those counters expire on their own and are not part of your account.

What DeepSeek sees

The companion characters are written by DeepSeek, an AI model provider based in China. Their servers are outside our control, so what we send them matters more than anything else in this policy.

We send DeepSeek only the following, and never anything else:

• which companion you picked, and which language you're using
• which moment in the app you're in (pre-event, evidence, outcome)
• the event type — the word "exam" or "interview", nothing about which exam
• your dread and reality ratings, and figures our own code calculates from them: how many events you've logged, your average dread, your average reality, the average gap, how many events you over-predicted, and up to your twenty most recent events as type-plus-two-numbers
• labels our code derives, like whether your gap is narrowing or widening
• if you're using the reappraisal screen, which body sensation you tapped from a fixed list of six

For App Store privacy disclosure, we conservatively classify that fixed sensation selection as Health data. It is not linked to your username, account, Apple Account, or random install identifier.

We never send DeepSeek:

• your event titles
• the fear you wrote down
• your focus intention
• your outcome notes
• any date, for any event
• your username, your account, or your random install identifier

There is no path in our code from the synced-events database to the code that builds model prompts. That separation is enforced by an automated test that fails the build if anyone ever wires the two together.

Everything the model writes back is checked by our own code before you see it, and anything that reads as clinical language, invents a number we didn't supply, or breaks character is thrown away and replaced with a line built into the app.

Where your data is stored

If you have an account, your data sits in Cloudflare D1, a hosted SQLite database, in the Western North America (wnam) region, reached through a Cloudflare Worker. Cloudflare operates the infrastructure and can see the network requests that reach it, including your IP address, in the ordinary way any web host does. We don't keep our own logs of your requests.

Short-lived counters for rate limiting live in Cloudflare KV. Cached companion lines are also stored there, keyed by a hash of the ratings that produced them rather than by the ratings themselves, and never by anything identifying you.

Apple sees whatever it normally sees when you download an app: your Apple Account and purchase records. That's between you and Apple, and we don't get names or email addresses from it.

Staying signed in

Signing in gives your phone a session token, which is 32 random bytes. The server never stores the token itself, only a SHA-256 hash of it, so a leak of our database would not hand anyone a working login.

A session expires 90 days after you sign in. After that the app asks you to sign in again. Signing out deletes that one session. Using your recovery code invalidates every session on every device.

If you lose your password

There is no password reset by email, because we never collect an email. There is no SMS reset, because we never collect a phone number. The recovery code you were shown at signup is the only way back in.

If you lose your password and your recovery code, your account cannot be recovered by anyone, including us. We cannot verify who you are, so we will not hand over an account to someone who asks nicely. This is a deliberate design choice and the cost of not collecting your contact details. Write the recovery code down somewhere real.

Your history is still on your phone in that situation. It's the server copy and the username that are gone.

Deleting your account

Settings has a delete option. It asks for your password and asks you to confirm twice, and then:

• every event of yours on the server is deleted, including the free text
• every session of yours is deleted
• your user record, with your username and both hashes, is deleted
• the app clears your local store and returns to how it looked on first launch

This is a hard delete, not a "deactivated" flag we could restore. It is not reversible and we cannot get it back for you. If you want to keep your history, save it somewhere else first.

Cloudflare's own infrastructure backups may hold a copy for a short period before rolling off. We don't read them and can't selectively edit them.

What we don't do

• No advertising, and no ad networks.
• No analytics SDK. No Firebase, no Amplitude, no Mixpanel, nothing of that kind.
• No third-party trackers, pixels, or fingerprinting.
• No data brokers. We do not sell, rent, or trade your data, and we never will.
• No location, contacts, photos, microphone, camera, HealthKit data, or advertising identifier. The app doesn't request them. The only body-related information sent off-device is the fixed sensation selection described in "What DeepSeek sees."
• No profile-building across other apps or websites. There is nothing to build one from.

The only third parties in the picture are Apple (app distribution), Cloudflare (hosting), and DeepSeek (companion text, with the strict limits described above).

If you are under 18

A lot of people using Psyched are students, and many of them are under 18. Pretending otherwise would be dishonest, so here's how that works.

• You must be at least 13 to use Psyched.
• If you are under 18, an adult — a parent or guardian — should read this policy and the Terms with you and agree to them on your behalf. They are the legal party.
• We ask for a username and a password. We do not ask for your real name, your age, your school, your email, or your phone number, and you shouldn't put any of those into a username or an event title.
• Everything in "What DeepSeek sees" applies to you exactly as written. Your writing is not sent to an AI provider.
• A parent or guardian can write to PsychedSupportTeam@gmail.com to ask what data we hold for an account, or to ask us to delete it. Because we can't verify identities, we'll walk them through deleting it inside the app rather than doing it from a request in an email. That protects the account from someone impersonating a parent.

If you are in a place with specific children's privacy rules, note that we designed around them by collecting as little as possible rather than by age-gating you out.

What you can do

• Use the app with no account, in which case none of the server sections apply to you.
• See everything we hold, by opening the app — the synced copy is the same as the copy on your phone.
• Delete individual events, which removes them from the server too.
• Delete your whole account and all of it, from Settings.
• Ask us anything at PsychedSupportTeam@gmail.com.

How long we keep things

While your account exists, we keep your events so sync works. Sessions expire after 90 days. Rate-limiting counters expire within hours. Cached companion lines expire on their own and contain no identifying data. When you delete your account, everything tied to it goes at once.

Security, honestly

We hash passwords with PBKDF2 at 600,000 iterations, compare secrets in constant time, store only hashes of session tokens, and talk to the server over HTTPS only. Account deletion is written as explicit deletes inside a single transaction rather than relying on database cascade rules to fire.

No system is perfect, and this one is built by a small team. If you find a security problem, please write to PsychedSupportTeam@gmail.com before telling anyone else, and we'll fix it.

Changes to this policy

If we change what we collect or who we send it to, we'll update this page and the "Last updated" date, and the app will point you at it. If a change is significant — new third party, new category of data — we'll say so in the app rather than quietly editing the page.

Questions

Write to PsychedSupportTeam@gmail.com. This policy is governed by the law of the Commonwealth of Massachusetts, United States.