App Privacy Policy

Last updated: October 18, 2026.

THE SPACE is operated by Rheos Labs LLC (“we,” “us”). It is a non-clinical relational-support app — not therapy, not a medical service, and not a crisis service. This policy explains what we collect, how we use it, who processes it on our behalf, and how long we keep it.

1. Information we collect

• Account details — your email address and authentication information, so you can sign in.
• Beta requests — if you ask to join a beta on our website, the first name and email address you give us. We use them to reply about the beta and, only if you ticked the box asking us to, to tell you when THE SPACE opens for subscription. You can ask us to delete them at any time.
• Profile & orientation — the name you ask us to use and the context you choose to share when you orient THE SPACE to you.
• Your conversations — the messages you exchange with THE SPACE, and a short rolling memory of your recent turns so the experience has continuity. Rehearsal Mode keeps its own separate recent memory.
• What THE SPACE comes to understand — brief notes on the “What I’ve Come to Know” page, drawn from your conversations and rehearsals, so THE SPACE can carry an understanding of you from one conversation to the next. They are included when THE SPACE replies to you. You can read, edit, or remove any of them at any time.
• Content you add — files you upload to Content Keeper, Workshop outputs, saved passages, and keepsakes you save from Close Encounters or Reach & Reconnect. When you add a file to Content Keeper we also check it automatically for safety, write a short description of what it contains so it can be found later, and pull out the text of PDFs. The file, that description, and the note you write about it are stored with your account until you delete them. In Close Encounters, if you or your partner keep an activity, both people’s answers are saved to the Archive of the person who kept it. Saved passages and the notes you write on them are stored, and reach the AI only when you choose “Bring this in” for one message.
• Information about other people — if you name a support person in Reach Out, the name and email address you give us for them, and whether they agreed. If you ask a licensed professional to confirm your age, the name and license details they give us. What you tell THE SPACE about the people in your life is part of your conversations.
• Age verification — whether you passed our 18+ check and the date. The ID itself is handled by Yoti and never reaches us (see Section 5).
• Payment information — if you subscribe, your plan and its status. Payments are handled by Apple (App Store) or Google (Google Play); we never see or store your card details, and your app store decides who is eligible for a free trial.
• Voice input (optional) — if you use hands-free or dictation, your browser converts your speech to text. See Section 4.
• Technical & usage data — basic device/browser information and error reports, to keep the app working, and a record of which device is signed in.

2. How we use your information

We use it to provide THE SPACE and its rooms, to keep your experience consistent across sessions, to process your subscription, to verify you are an adult, to keep the service safe and working, and to communicate with you about your account. We do not use your information to build advertising profiles.

3. What we do not do

We do not sell or rent your personal information. We do not share your relational content with third parties for advertising or marketing. THE SPACE is non-clinical and does not diagnose, treat, or provide medical advice.

Who at Rheos Labs can see your conversations. Your conversations are stored so THE SPACE can carry your experience across sessions. We do not read them in the ordinary course of running THE SPACE. A very small number of authorized people at Rheos Labs have the technical ability to access stored data, and would look at a conversation only if you ask us to look into a problem, if it is needed to keep the service secure, if someone reports a safety concern to us as described next, or if the law requires it.

Safety. THE SPACE is not monitored and is not an emergency service, and no one at Rheos Labs is alerted when a conversation turns to danger. When its automated safety systems notice signs that someone could be at serious risk of harming themselves or someone else, what happens is inside the app: THE SPACE points to crisis resources such as 988 and 911 and opens Reach Out. A person at Rheos Labs looks at a conversation only if someone reports a concern to us at contact@rheoslabs.com, if you ask us to, if it is needed to keep the service secure, or if the law requires it. That inbox is not watched around the clock. If a report leads us to believe in good faith that there is an immediate danger of death or serious physical injury, we may share what is needed with emergency services or law enforcement. Because no one watches conversations as they happen, this is something we may do, not something we can promise, and you should never rely on THE SPACE to get help in an emergency. And if what we read ever leads us to suspect that a child, or an adult who cannot protect themselves (for example, because of age, illness or a disability, including an intellectual disability), is being abused, neglected or exploited (including having their money or property taken), we will report it to the authorities who protect them, as New Mexico law asks of everyone. We do not contact a support person you have named; only you can do that, through Reach Out. THE SPACE is a wellness app, not a therapy or counseling service, and looking at a conversation does not create a clinical relationship with you.

AI training. We do not use your personal data, including your conversations, to train AI models, and our AI provider does not use them to train its models.

Your health information and HIPAA. HIPAA is a federal law that covers health care providers, health plans, and the companies that handle health information on their behalf. THE SPACE is none of these. You use it on your own, not through a doctor, therapist, or health plan, so HIPAA does not apply to what you share here, even when it is about your health. That does not leave it unprotected: this policy, our Consumer Health Data Privacy Policy, state health privacy laws, and federal consumer protection law enforced by the Federal Trade Commission still apply. We treat everything you share about your health as sensitive. We do not sell it, we do not use it for advertising, there are no advertising or analytics trackers in THE SPACE, and it goes only to the providers in Section 4 so that THE SPACE can work. If a doctor or therapist suggested THE SPACE to you, that does not make it part of their care, and they cannot see what you share here. If you work in health care, please do not enter information that identifies your patients or clients (see our Terms of Use, Section 7).

4. Service providers who process your data

We rely on a small set of trusted providers, each handling only what its job requires, under its own privacy terms:

• Supabase — secure hosting of your account, profile, conversations, and saved content.
• Railway — hosting of the server that runs THE SPACE. Your messages pass through it on the way to being answered.
• Anthropic — the AI that powers your conversations. This includes files from your Content Keeper: when something you saved relates to what you are talking about, that file (or the text taken from it) is sent along with your message so THE SPACE can talk about it with you. It is handled the same way as anything you type, under the terms below. Your messages are sent to Anthropic to generate replies; Anthropic may retain message data for up to 30 days for safety and abuse monitoring, or for up to 2 years if its automated systems flag a message as a possible violation of its usage policy, under its own policy. Because a third party processes this content, we do not describe your conversations as fully private or “ephemeral.”
• Apple and Google — subscriptions and payments, through your App Store or Google Play account, under their own terms and privacy policies.
• Resend — sending account and feature emails, including the pre-written notes you choose to send to a support person through Reach Out.
• ElevenLabs — optional voice narration. When THE SPACE speaks aloud, the words it is about to say are sent to ElevenLabs to be turned into audio. Those words are part of your conversation. No recording of your own voice is ever sent. Nothing is sent when voice is off.
• Yoti — one-time age verification (see Section 5).
• Sentry — error monitoring. When something in THE SPACE breaks, a technical error report is sent to Sentry so we can find and fix it. It is set up not to include your messages or your personal details; a report contains technical information such as the error itself, the screen it happened on, and your browser type.
• Typeform — hosts the optional feedback evaluation offered to beta participants. If you choose to fill it out, your answers are stored by Typeform under its own privacy policy. The evaluation does not ask for your name or email address.
• Your browser’s speech service — if you use voice input, your browser (e.g., Google in Chrome, Microsoft in Edge, Apple in Safari) may send your audio to its own servers to transcribe it, under that vendor’s policy. THE SPACE keeps no voice recording, and voice used for navigation is never added to your conversation or sent to the AI.

5. Age verification

THE SPACE is for adults 18 and older. To confirm your age we use Yoti, a third-party verification provider. You verify with a photo of a government-issued ID, which Yoti reads only to confirm that the document is genuine and that you are 18 or older. We ask for your consent before it is collected, and it is used solely to verify your age; the result is never sold or shared. Yoti deletes the ID document shortly after the check. THE SPACE never receives or stores your ID image, your ID number, or your date of birth — we keep only whether you passed and the date of the check. The age check does not scan or compare your face, and we do not collect biometric information. Yoti’s handling of your ID is governed by Yoti’s own privacy policy.

If the ID check cannot confirm your age, you may ask a licensed professional who knows you through their work to confirm that you are 18 or older. What we keep about that professional is described in Section 1.

6. How long we keep your information

• Account & profile — kept while your account is active; deleted within 30 days after you close your account.
• Conversations & memory — kept so your experience carries across sessions; you can clear them at any time, and they are deleted within 30 days after account closure. (Note: Anthropic may keep message data for up to 30 days, or longer if a message is flagged, as described in Section 4.)
• Content you add — kept until you delete it or close your account.
• Age-verification result — the pass/fail result and date are kept while your account is active and deleted when you close your account. The ID itself is never stored by us (Section 5).
• Payment records — kept for 7 years after the end of the year of the payment, to meet tax and accounting record-keeping rules, even after account closure.
• Technical & error logs — kept for up to 90 days.
• Accounts no one uses — if no one signs in to an account for 2 years, we email a warning 60 days and 7 days before, and then delete the account the same way as if you had closed it. Payment records are still kept as described above. To know when an account was last used, we record only the date it was last opened.
• Records kept after closure — a small number of records are kept after you close your account, because they are proof we may need later: that you accepted these policies, that you consented to the age check, and that you acknowledged a support-person note is not an emergency service. We keep them for 6 years after you close your account, the period in which a legal claim about them could be brought.

7. Your choices and rights

You can view and update your profile, clear your conversation history, and turn voice input off at any time. You may close your account, which deletes your personal data on the schedule above (except records we must keep by law). To ask for a copy of your information, to correct it, to delete it, or to receive it in a portable form, email contact@rheoslabs.com. We will respond within 45 days. If we decline a request, you can appeal by replying to our decision and asking for a review; we will answer the appeal in writing within 45 days. If your appeal is denied, you may contact the attorney general of your state (for example, Connecticut residents may contact the Connecticut Attorney General at portal.ct.gov/ag). Depending on where you live, you may have additional rights under your local privacy laws.

Health information. Some of what you share in THE SPACE can count as “consumer health data” under laws such as Washington’s My Health My Data Act. Our separate Consumer Health Data Privacy Policy explains what that covers, who processes it, and your rights. You can read it in Settings → Privacy & Terms, or at rheoslabs.com/health-data-privacy.

8. Security

We use industry-standard measures to protect your information, including encryption in transit and access controls. No system is perfectly secure, but we work to safeguard your data and to limit what we collect in the first place. If we learn that your information was accessed or disclosed without authorization, we will tell you, and anyone else the law requires us to tell, without unreasonable delay.

9. Children

THE SPACE is intended only for adults 18 and older, and we do not knowingly collect personal information from anyone under 18. If we have reason to believe a user is under 18, we suspend their access at once. Unless they confirm through our age check that they are an adult, we close the account and delete its data within 7 days. If we learn a user is under 13, we delete their data immediately.

10. Legal requests and business changes

We may disclose information when the law requires it, such as in response to a valid court order or subpoena, and we will disclose only what is required. If Rheos Labs is ever involved in a merger, sale, or reorganization, your information may be transferred as part of it; we will tell you before it becomes subject to a different privacy policy.

11. Your device, tracking, and where we operate

THE SPACE stores a small amount of information in your browser, such as your sign-in and your preferences, so that it works. It does not use advertising cookies, analytics trackers, or tracking pixels, and it does not track you across other websites. Because of that, there is nothing for a browser “Do Not Track” or Global Privacy Control signal to switch off. We do not sell or share personal information, and we do not give it to anyone for their own marketing.

THE SPACE is operated from the United States and is intended for people located in the United States. It is not currently offered to people who live in Illinois or Vermont. Some of the providers in Section 4 may process information in other countries.

12. Changes to this policy

We may update this policy. If we make material changes, we will tell you by email and in the app before they take effect and, where the law requires it, ask for your consent again. The date at the top shows when it was last updated.

13. Contact

Rheos Labs LLC · 1209 Mountain Road PL NE #11238, Albuquerque, NM 87110 · contact@rheoslabs.com · (575) 651-1854