Abyss Privacy Policy

This policy explains how we handle personal information when you visit abyss.ie, join our waitlist, create an account or use Abyss. It covers your reflections, AI processing, Archive and Patterns, and any information you choose to share through Resonance.

1. Who operates Abyss

Abyss is operated by Huanqing Liao, trading as Abyss App, a sole trader in Ireland. The operator is the data controller responsible for the processing described in this policy.

CRO business name registration number: 785729.

Business address: 5 Beresford Green, Donabate, Co. Dublin, Ireland.

Email for privacy questions and requests: hello@abyss.ie.

2. Information we collect and where it comes from

We collect information you provide, information needed to operate the service, and information generated when you use a feature.

If you use Google Sign-In, we receive the basic profile and authentication information authorised through that sign-in process, such as your name, email address, profile image and Google account identifier. We do not receive your Google password. Google Sign-In does not give us access to your Gmail, Drive, Calendar or contacts. We do not use Google sign-in information for advertising or AI model training.

Please avoid submitting unnecessary identifying information about other people, particularly their health or other sensitive information. Another person’s personal data can require separate safeguards even if it appears in your own reflection.

3. Why we use information and our legal bases

The following table describes our bases under Article 6 of the General Data Protection Regulation, or GDPR. Additional rules for sensitive information are explained in section 4.

Account identifiers and authentication information are necessary to provide account-based features. Payment and billing information is necessary to provide a paid subscription. If you do not provide required information, we cannot provide the relevant feature. Optional research, marketing and sharing choices are not required to maintain your account.

We do not rely on legitimate interests alone to process information protected by Article 9 GDPR.

4. Sensitive information and explicit consent

A reflection, transcript or derived pattern may reveal health information, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, sexual orientation or sex life. GDPR gives these categories extra protection.

Where we process these categories to provide a reflection feature, we rely on your explicit consent under Article 9(2)(a), in addition to the relevant Article 6 basis. We request that consent through a clear, affirmative choice before the processing begins. Accepting our Terms, granting microphone permission or simply submitting a thought does not by itself give this consent.

Consent for optional analysis or sharing is explained when you activate the relevant feature. You can withdraw consent using the relevant controls or by emailing hello@abyss.ie. We will stop processing that depends on the withdrawn consent. Withdrawal does not affect processing that was lawful before withdrawal. It may prevent us from providing a feature that needs that information, but it does not automatically close your account.

If information must be retained for a specific legal reason, we will identify that reason and restrict its use accordingly. We do not treat a general reference to safety or legal compliance as permission to use sensitive information for unrelated purposes.

5. Your reflections and feature choices

Your reflections are private by default. We do not sell your personal data or use private reflections for targeted advertising. We do not use private reflections for public posts or testimonials without your separate permission.

Submitted reflections are sent to the Abyss server for processing. Archive entries, responses, emotional interpretations and associated feature records are stored in a Supabase database linked to your account identifier. Archive is a cloud feature. Resonance matching and Patterns also use server processing and database records.

Your browser holds the current interaction and the preferences and usage storage described in section 10. An unsaved reflection can still be sent to Abyss and our AI providers. The choices for Archive, Patterns and Resonance explain saving, analysis and sharing.

Patterns may identify tentative relationships, recurring themes or changes across saved reflections. They can be inaccurate and are not diagnoses or factual assessments of your character or circumstances.

If you participate in Resonance, we use the eligible thought and relevant derived information to look for possible similarities with another participant. A potential match does not automatically give that person access to your account details or wider Archive. The sharing controls explain what will be revealed and to whom before you choose to share.

Information you reveal can itself identify you. Another participant may remember or copy it, and withdrawing permission later cannot guarantee removal of copies they have already made. You can end participation and report concerns to hello@abyss.ie.

Resonance can also display illustrative fragments. These are examples, rather than evidence that another person is currently using Abyss or is geographically close to you. Similarity matching does not establish another person’s location or identity.

6. Artificial intelligence and voice processing

Abyss uses AI for features such as reflective writing, selecting visual responses, identifying possible patterns and finding potential Resonance matches. Submitted reflection text and necessary context are sent through OpenRouter for model processing. The configured model is OpenAI GPT-4o mini. OpenRouter and the provider hosting the selected model receive the content needed to produce the response. A model name does not by itself identify every infrastructure provider involved.

We do not use private reflections to train our own general-purpose AI models or opt into programmes that contribute them for model training. For external AI processing, we require approved providers and routes that do not use private reflections to train general-purpose models. This requirement also applies to fallback routes. Processing to produce a response and any limited retention for security, abuse prevention or legal obligations are separate from model training; this policy does not promise that every provider immediately deletes every request.

OpenRouter’s privacy information is available at https://openrouter.ai/privacy. You can contact hello@abyss.ie for details of the AI providers and retention arrangements relevant to your use. We remain responsible for selecting appropriate processors and safeguards; a provider’s privacy notice does not replace our obligations to you.

Voice input uses your browser’s speech-recognition service through the Web Speech API. Microphone permission allows audio capture for transcription. Depending on your browser, device and settings, recognition can take place on your device or send audio to the browser or platform provider’s servers. It does not guarantee that audio stays on your device.

The transcript is submitted to Abyss and processed like typed reflection text. Section 9 explains audio retention. You can type without enabling the microphone and revoke microphone permission in your browser or device settings.

We use automated analysis to generate these experiences and possible safety signals. This can amount to profiling because it interprets information associated with your account. We do not use it to make solely automated decisions about you with legal or similarly significant effects. If a restriction on your account concerns you, you can ask us to review it by contacting hello@abyss.ie.

Safety analysis may display crisis resources where language appears to indicate serious danger. It is not a clinical assessment or continuous human monitoring. Abyss is not an emergency-response service. Any exceptional disclosure for a serious threat or legal process must have a lawful basis and, where applicable, a separate legal condition for sensitive information.

7. Providers and other recipients

We use providers for authentication, hosting, AI, payments and service communications. They receive information needed for their role. Where they act as our processors, we require appropriate data-processing terms. Some providers, such as payment providers or Google, also act as independent controllers for their own activities.

Selected Resonance information is also received by the participant with whom you choose to share it. Authorised support or technical personnel may access information where necessary to resolve your request, investigate a report or incident, or meet a legal obligation. Access must be limited to that purpose.

We may disclose information to competent authorities where lawfully required, or to professional advisers where necessary for a legal matter. If the business operator changes, we will explain any resulting controller change and applicable safeguards before the affected processing changes.

8. Processing locations and international transfers

The website and application API are configured on Render in Frankfurt, Germany. Authentication, AI, payments, communications and provider support can involve processing outside Ireland or the European Economic Area, including in the United States. The application server’s location does not determine every provider’s processing location.

For transfers outside the EEA, we require a lawful transfer mechanism. Where an applicable European Commission adequacy decision covers the recipient and processing, that decision provides the transfer basis. Otherwise, we require the European Commission’s Standard Contractual Clauses and any additional measures needed to protect the information. An EU hosting region alone does not prevent international transfers or replace these safeguards.

You can request information about the relevant safeguards, or a copy of them subject to lawful redactions, by emailing hello@abyss.ie.

9. Retention and deletion

We retain information for the purposes described in this policy and delete or anonymise it when no longer needed. The following periods or criteria apply.

• Account information. While your account is active, followed by deletion when you close it, subject to the limited legal and backup exceptions below.
• Reflections that are not saved to Archive. For the current interaction and completion of the requested processing. They are not kept as your Archive history unless you choose to save them. If you separately enable Resonance, its matching records follow the feature rule below. Any limited record needed for a particular technical problem, security incident or legal obligation follows the relevant rule below. External AI processing is subject to section 6.
• Saved reflections, Patterns and matching representations. For the feature you have enabled, until you delete the information, withdraw the relevant consent or close your account. Related derived information must also be deleted or updated where necessary.
• Microphone audio. Abyss keeps the resulting text transcript rather than a raw audio recording. Any audio handled by your browser or platform speech service follows that provider’s processing and retention arrangements. Consult the speech or voice privacy information for your browser or device before enabling voice input. Transcripts follow the rules for the relevant reflection.
• Waitlist information. Until we have fulfilled your invitation request or you withdraw it. Minimal information needed to honour an outstanding promotional offer is kept until that offer is redeemed or expires.
• Billing and accounting records. Generally six years where required by Irish tax law, and longer only where a specific legal requirement applies. This does not require keeping your private reflections.
• Support records. While the enquiry remains open or a specific related complaint, dispute or investigation remains unresolved. We then delete or anonymise them unless a specific legal requirement or legal claim justifies keeping a limited record.
• Optional research records. For the purpose and retention period or end condition stated in the separate research information and consent notice. Research participation is optional.
• Security and error logs. For the security monitoring or technical investigation for which they were collected, followed by deletion or anonymisation when that purpose is complete. Relevant records may be isolated for longer where necessary for a specific unresolved incident, legal obligation or legal claim. Private reflection content must not be retained as routine analytics.
• Backups. Until the backup containing the information expires or is overwritten in the regular recovery-backup rotation. Copies awaiting expiry are restricted to recovery and are not used for ordinary product features. Deletion requests are reapplied if a backup is restored.

The Archive provides controls to remove entries or clear saved entries. For full account deletion and removal of linked information, including relevant Resonance and derived records, email hello@abyss.ie. Signing out does not delete your account or saved reflections. We will explain any information that must be kept and why. Where a backup is restored, deletion requests must be reapplied before the restored information returns to ordinary use.

10. Cookies and browser storage

We use cookies or similar technologies where necessary for the service you request, such as signing in, maintaining a secure session or remembering a choice you ask us to keep. Strictly necessary storage does not require cookie consent, but we still explain its use.

Non-essential analytics, advertising or other tracking that requires consent must remain disabled until you opt in. You can change or withdraw that consent as easily as you gave it. Refusing optional tracking does not prevent access to the basic service.

The application uses first-party storage named abyss_mode_usage_v1 to record feature usage and free-plan limits, abyss_intro_seen_v1 to remember whether the introduction has been seen, and abyss_cookie_prefs_v1 to remember cookie choices. Clerk also uses browser storage for authentication. Cloudflare web analytics is described in section 7; a cookie-free analytics script can still process technical information.

Session storage lasts for the relevant browser session. Persistent storage remains until its configured expiry or until you remove it through your browser. Cookie Settings provides the purpose, provider, category and lifetime of the items used on the site before you choose optional storage. You can also clear cookies and site storage in your browser; doing so may sign you out or reset saved choices.

11. Your rights

Subject to the conditions in GDPR, you can ask to access your personal information, correct it, delete it, restrict its use or receive eligible information in a portable format. You can object to processing based on legitimate interests. If we use information for direct marketing, you can object to that use at any time.

Where we rely on consent, you can withdraw it at any time. You can also question or request correction of inaccurate information associated with a generated pattern. A tentative AI interpretation is not an established fact about you.

Send requests to hello@abyss.ie. We normally respond without undue delay and within one month. If a request is complex or there are multiple requests, GDPR may allow up to two additional months. We will explain any extension within the first month. Requests are normally free, and any identity check must be proportionate to the information and risk involved.

You can complain to the Irish Data Protection Commission at www.dataprotection.ie or to the supervisory authority in the EU or EEA country where you live, work or believe an infringement occurred. You do not have to contact us first.

12. Security

We use appropriate technical and organisational measures to protect information, including secure connections, access controls and limited access for authorised personnel. No online service can guarantee absolute security.

Report a suspected security issue to hello@abyss.ie. We will assess it and make any notifications required by data-protection law.

13. Age requirement

The current Abyss service is for people aged 18 or older. We do not knowingly offer it to children. Contact hello@abyss.ie if you believe we hold information from someone under 18 so that we can investigate and take appropriate action.

14. Changes to this policy

We will update this policy when our processing changes and show the update date above. We will give appropriate notice of material changes before they take effect. Where a new use requires your consent, we will request that consent; updating this policy does not itself provide it.

For privacy questions or requests, contact hello@abyss.ie.