Legal
Privacy Policy
What we collect, why we collect it, who processes it and how to get it removed — in plain language.
This Privacy Policy explains how Saryal Pty Ltd ("Saryal", "we", "us") collects, uses, discloses and protects personal information. It applies to this website (saryal.com) and to the mobile, desktop and web applications we publish, including those distributed through the Google Play Store.
We are an Australian company and we handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Where the General Data Protection Regulation (GDPR) or comparable laws apply to you, the additional rights described below also apply.
Our approach
- We collect only what a product needs in order to work.
- We do not sell personal information, and we do not share it for cross-context behavioural advertising.
- We do not use your private content to train third-party foundation models.
- We keep personal information only for as long as it serves the purpose it was collected for.
Information we collect
Information you give us
- Account information — where a product requires an account, your email address and authentication credentials. Passwords are stored only as salted hashes by our authentication provider; we never see them in plain text.
- Content you create — the data, settings, layouts, media and configurations you create or upload while using a product.
- Correspondence — the contents of emails you send us, including any diagnostic information you choose to attach.
Information collected automatically
- Device and app information — device model, operating system version, app version, language and region settings.
- Usage information — which features are opened and which actions are taken, recorded against a pseudonymous identifier rather than your name.
- Diagnostics — crash reports, error traces and performance measurements.
- Log data — IP address and standard request metadata when you visit this website or connect to our services.
Information from third parties
- Purchase records — when you buy a product or subscription through the Google Play Store, Google confirms the transaction to us and to our subscription provider. We receive the fact and status of the purchase. We never receive your card or bank details.
How we use information
- To provide, operate and maintain the products and their features.
- To authenticate you and keep your account and content secure.
- To process purchases, activate entitlements and manage subscriptions.
- To diagnose faults, fix defects and improve reliability and performance.
- To understand which features are used, so we can improve the ones that matter and remove the ones that do not.
- To respond to your support, privacy and legal requests.
- To detect, prevent and address fraud, abuse and security incidents.
- To meet our legal, tax and regulatory obligations.
Where the GDPR applies, we rely on the following legal bases: performance of a contract (providing the product you asked for), legitimate interests (security, fault diagnosis, product improvement), consent (optional analytics where consent is required, which you may withdraw at any time), and legal obligation (record-keeping and tax).
AI features
Some of our products include AI-assisted features. Where a feature sends your input to an AI provider in order to produce a result for you, this is disclosed within the product before you use it. We do not sell your content, and we do not permit our providers to use content submitted through our products to train their general-purpose models. Some products can run models locally on your own hardware, in which case the content does not leave your device.
Service providers
We use a small number of established providers to operate our products. Each is bound by contract to process personal information only on our instructions and to keep it secure. Not every provider is used by every product; each product discloses its own data practices in its Google Play data safety section.
| Provider | Purpose | Data involved |
|---|---|---|
| Google Play / Google LLC | App distribution, in-app purchases, subscription billing, crash and install statistics | Purchase and subscription records, device and app version, aggregated install and crash statistics |
| RevenueCat, Inc. | Subscription and entitlement management across app stores | Anonymous or pseudonymous app user ID, purchase and subscription events, entitlement status |
| Supabase, Inc. | Account authentication, application database and file storage | Email address, authentication identifiers, and the content you create or store in a product |
| PostHog, Inc. | Product analytics — understanding which features are used and where people get stuck | Pseudonymous device or user identifier, feature usage events, device type, app version, coarse location derived from IP |
| Sentry (Functional Software, Inc.) | Crash and error reporting so faults can be diagnosed and fixed | Error and stack trace data, device model, operating system version, app version, pseudonymous identifier |
| Cloudflare, Inc. | Website hosting, content delivery and denial-of-service protection | IP address and standard request logs, retained transiently for security and delivery |
We may also disclose personal information where required by law, to enforce our Terms of Service, to protect the rights, property or safety of any person, or in connection with a merger, acquisition or sale of assets — in which case we will require the recipient to honour this policy.
Analytics we may add
We may introduce Google Analytics on this website in future. If we do, we will update this policy before it goes live, run it with IP anonymisation, and — where consent is legally required — request your consent before any analytics cookie is set.
Cookies and similar technologies
This website is deliberately minimal. As published, saryal.com sets no advertising cookies and no third-party tracking cookies. The only client-side storage we use is a single localStorage entry (saryal-theme) that remembers whether you chose the light or dark theme. It contains no personal information, is never transmitted to us, and clearing your browser storage removes it.
Our applications may use device storage and identifiers as described above. Where a product uses cookies or similar technologies that require consent, it will ask you within the product.
How long we keep information
- Account and content data — for as long as your account is active, and deleted when you delete your account.
- Crash and error data — typically up to 90 days.
- Product analytics — typically up to 12 months in identifiable form, after which it is aggregated.
- Purchase and tax records — for the period Australian law requires, generally five to seven years.
- Support correspondence — up to 24 months after the enquiry is resolved.
Deleted data is removed from live systems immediately and purged from encrypted backups on their normal rotation, generally within 35 days.
Security
We use encryption in transit (HTTPS/TLS) for all connections, encryption at rest for stored data with our providers, least-privilege access controls, and multi-factor authentication on the administrative accounts that can reach production systems. No system is perfectly secure, but we take the protection of your information seriously and will notify you and the relevant regulator where a data breach is likely to result in serious harm, as required by the Notifiable Data Breaches scheme.
International transfers
We are based in Australia and several of our providers store or process data in the United States and the European Union. Where personal information is transferred outside your country, we rely on the provider's contractual protections — including Standard Contractual Clauses where applicable — and take reasonable steps to ensure it is handled consistently with this policy.
Your rights and choices
You may ask us to:
- Access the personal information we hold about you.
- Correct information that is inaccurate or out of date.
- Delete your account and associated personal information.
- Export a copy of your data in a portable format.
- Object to or restrict certain processing, or withdraw consent where processing is based on it.
- Opt out of product analytics, where the product provides that setting.
Email support@saryal.com from the address linked to your account. We will verify your identity, respond within 30 days, and will not charge you for a reasonable request. We do not sell personal information, so there is nothing to opt out of in that respect.
Account and data deletion
To delete your account and personal data, email support@saryal.com with the subject Account Deletion, from the email address linked to your account, telling us which product it relates to. We will confirm your identity, delete your account and associated personal data, and confirm once it is complete. Records we are legally required to retain — such as purchase and tax records — are kept for the required period and then destroyed.
Children
Our products are not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, contact us and we will delete it.
Changes to this policy
We may update this policy as our products change or as the law requires. The date at the top of this page shows when it was last revised. Where a change materially affects how we handle your personal information, we will give notice in the product or by email before it takes effect.
Contact and complaints
Privacy enquiries, requests and complaints: support@saryal.com.
Saryal Pty Ltd (ABN 77 647 002 122), Australia.
If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au. If you are in the European Economic Area or the United Kingdom, you may also complain to your local supervisory authority.