PRIVACY POLICY

1. SCOPE

This Privacy Policy applies to the Teylis mobile application and the account, cloud, artificial-intelligence, subscription and related services used to provide Teylis.

Teylis is intended only for adults aged 18 or older.

2. INFORMATION WE COLLECT

Teylis processes information that you provide, information created through your use of Teylis, and limited technical information required to operate and secure the Service.

This may include the categories described below.

3. ACCOUNT AND PROFILE INFORMATION

When you create and use a Teylis account, we may process: - your email address; - your Teylis profile or Player name; - your Supabase account identifier; - authentication and session information; - account status; and - account-related timestamps and technical metadata.

Your email address is used primarily to authenticate your account through email-based one-time-password sign-in.

If you contact Teylis Support by email, we process the sender address, message content and any attachments you choose to include so that we can review and respond to your request.

4. GOALS AND PERSONAL-DEVELOPMENT CONTENT

Teylis processes information you enter or create as part of the personal-development experience.

This may include: - Goal titles; - Goal Context; - Goal type and priority; - experience calibration; - Skill names and Skill Trees; - Activities you log; - Quest Results or outcomes; - available-time preferences; - manually prioritized Goals; and - other information you choose to enter into free-text fields.

This information is used to provide and personalize Teylis's features.

5. QUEST AND PROGRESSION INFORMATION

Teylis also creates and stores information generated through use of the App, including: - Daily Quests; - Quest Chains; - Boss Quests; - Quest descriptions and completion criteria; - Quest completion or failure status; - Quest timestamps; - Skills and Skill progression; - Player XP and Player level; - Attributes; - Achievements; - Boss Gauge information; - Chronicle history; - progression transactions; - milestone information; - weekly progress information; and - tutorial and onboarding state.

These values are part of Teylis's internal progression system.

6. SUBSCRIPTION INFORMATION

Teylis uses Apple's StoreKit system to manage subscriptions.

Teylis may receive or process: - subscription product identifier; - monthly or annual plan status; - introductory-trial eligibility; - subscription expiration; - renewal status; - revocation or refund status; - transaction verification information; and - an account token used to associate an Apple entitlement with your Teylis account.

Apple processes your payment.

Teylis does not receive or store your full payment-card number or other payment-card credentials.

Apple may retain purchase and transaction information independently under Apple's own privacy policies and legal obligations.

7. INSTALLATION AND SECURITY INFORMATION

Teylis creates technical identifiers used to secure accounts and enforce supported installation behavior.

This may include: - an app-created installation identifier; - an installation security credential; - account-to-installation ownership information; - authentication state; - security status; and - app/runtime metadata.

The security credential is stored using Apple's Keychain.

These identifiers are used for security, account protection, backup access and prevention of unauthorized installations.

8. NETWORK AND TECHNICAL INFORMATION

When Teylis communicates with its backend, service providers may automatically process technical information required to route, secure and operate those requests.

This may include: - IP address; - user agent; - request timestamp; - request size; - request status; - network provider information; - session or request identifiers; and - approximate geographic information derived from the IP address, such as country, region, city or postal area.

Teylis does not request access to your device's GPS or Core Location services.

Approximate network-derived location is technical infrastructure data and is not used by Teylis to provide location-based personal-development features or targeted advertising.

9. INFORMATION STORED ON YOUR DEVICE

A substantial part of Teylis's active gameplay and progression state is stored locally on your device.

Local storage may include: - Player data; - Goals; - Skills; - Quests; - Activities; - Results; - progression history; - Chronicle information; - achievements; - onboarding state; - preferences; - notification settings; - tutorial state; - installation identity; and - local backup/runtime metadata.

Teylis uses technologies including SwiftData, UserDefaults, local files and Apple's Keychain according to the type of information involved.

10. CLOUD BACKUPS

During normal authenticated use, Teylis automatically creates private recovery backups when your account state has meaningfully changed. These backups support account recovery, logout safety and restoration.

Cloud backups may contain a broad snapshot of your Teylis account state, including: - Player progression; - Goal titles and Goal Context; - Skills; - Quest history and Quest Chains; - Activities; - Quest Results; - evidence and progression records; - achievements; - Chronicle history; - weekly progress information; and - account runtime/preferences required to restore the Teylis experience.

Backups are transmitted through authenticated Supabase services and stored in private cloud storage associated with your Teylis account.

Teylis normally retains the three most recent successful production backup snapshots. When a new snapshot is stored, older snapshot files are normally removed during rotation.

Snapshot rotation removes older backup files, not historical records that remain in your account. Historical Quests, Activities, Quest Results, Skills, progression and Chronicle records may therefore continue to appear in newer backup snapshots.

11. ARTIFICIAL INTELLIGENCE AND PERSONALIZATION

Teylis uses artificial intelligence to provide certain personalized features.

AI may assist with functions including: - generating Skill Trees; - checking Goal eligibility and safety; - generating Daily Quests; - generating or evaluating Quest Chains; - generating Boss Quests; - adjusting Quest difficulty; - classifying Activities; - assigning metadata to Skills; and - creating milestone reflections.

AI does not independently control Teylis's deterministic XP and progression formulas.

12. INFORMATION SENT FOR AI PROCESSING

To provide an AI-powered feature, Teylis may send only the information relevant to that feature.

Depending on the request, this may include: - Goal titles and Goal Context; - Skill names and identifiers; - recent Quest history; - completed Quest information; - Quest Results; - recent Activities; - current progress summaries; - current Goal focus; - availability preferences; - Quest Chain state; - Boss-related progress; and - other progression context required to generate the requested result.

Different AI requests use different subsets of this information.

Teylis's current AI payloads are designed not to send your account email address or profile/Player name to the AI model.

13. OPENAI

Teylis currently uses OpenAI's API to process AI-powered requests.

Teylis sends AI requests to OpenAI through Teylis's authenticated Supabase backend. The iPhone application does not contain the private OpenAI API key.

Teylis currently configures its OpenAI usage so that: - optional sharing of API inputs and outputs for model improvement is disabled; - API input/output sharing with OpenAI for training or model improvement is not enabled; - OpenAI API call logging is disabled in Teylis's API account settings; and - Responses API calls use store:false so generated responses are not intentionally stored for later retrieval through the Responses API.

OpenAI states that API inputs and outputs are not used to train its models by default unless an API customer explicitly opts in.

OpenAI may still retain API inputs and outputs for a limited period for service delivery, security and abuse-monitoring purposes under its applicable API data-retention rules. Under the standard API configuration, this may currently be up to 30 days unless a different retention arrangement applies.

OpenAI's own privacy and data-processing terms also apply to its processing as a service provider.

14. SENSITIVE INFORMATION IN FREE TEXT

Teylis does not ask you to provide medical records, diagnoses, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic or biometric identification data, sex-life information or sexual orientation.

However, Teylis contains free-text fields.

You may therefore choose to enter information that is personal or sensitive when describing a Goal, Activity, Result or other context.

Please avoid entering highly sensitive personal information unless it is genuinely necessary for the feature you are using and you are comfortable with that information being processed as described in this Privacy Policy.

Teylis does not use personal-development content for advertising, credit decisions, employment decisions, insurance decisions, healthcare eligibility or other similar high-impact decisions.

15. HOW WE USE INFORMATION

We use personal information to: - create and maintain your Teylis account; - authenticate you; - provide the Teylis Service; - generate and personalize Quests and Skill Trees; - classify Activities; - maintain progression; - provide Chronicle and achievement functionality; - create and restore cloud backups; - provide subscription access; - respond to support emails; - verify active installations; - schedule requested local notifications; - prevent abuse and unauthorized account access; - troubleshoot failures; - protect the security and integrity of Teylis; - comply with legal obligations; and - improve reliability and operation of the Service.

We do not use your personal-development content for third-party advertising.

16. LEGAL BASES FOR PROCESSING

Where the General Data Protection Regulation or similar law applies, Teylis processes personal information on one or more of the following legal bases:

Performance of a contract: Processing necessary to create your account and provide the features you request, including personalization, progression, backups, AI-powered functions and subscription access.

Legitimate interests: Processing reasonably necessary to secure accounts, prevent fraud or abuse, maintain service reliability, diagnose failures and protect Teylis's systems, where those interests are not overridden by your rights and interests.

Consent: Where a feature or applicable law requires consent, for example device notification permission.

Legal obligations: Processing necessary to comply with applicable legal, tax, regulatory or law-enforcement obligations.

17. AUTOMATED PROCESSING

Teylis uses automated systems and artificial intelligence to generate personalized content and classify information you submit.

Examples include Quest generation and Activity classification.

These systems do not make decisions that produce legal effects or similarly significant effects concerning you, such as employment, insurance, credit, healthcare eligibility or legal status.

Teylis's Player level, Skills, Attributes and other progression values are game/progression mechanics and are not objective professional or legal assessments of you.

18. SERVICE PROVIDERS

Teylis relies on external service providers to operate the Service.

Current key providers include:

APPLE Apple provides App Store distribution, StoreKit subscription functionality, device operating-system services and local-notification functionality. Apple independently processes information under its own privacy policies where applicable.

SUPABASE Supabase provides: - account authentication; - database/backend infrastructure; - Edge Functions; - installation-security functions; - subscription entitlement verification infrastructure; - private cloud backup storage; - account deletion infrastructure; and - operational logging. The current primary Supabase project region is London, United Kingdom. Supabase infrastructure and Edge Functions may process requests through additional infrastructure regions where necessary to provide, secure or route the service.

OPENAI OpenAI provides the AI model processing described above.

ZOHO Zoho provides email hosting used for correspondence with Teylis Support. When you email support@teylis.com, Zoho processes the email address, message content, attachments and related delivery metadata needed to provide email service.

We may also use other infrastructure providers or subprocessors used by these providers in accordance with their applicable data-processing terms.

19. OPERATIONAL LOGS

Service providers may maintain limited technical logs for service operation, diagnostics, security and abuse prevention.

Supabase infrastructure logs may include data such as: - IP address; - approximate IP-derived location; - request and session identifiers; - user agent; - request path; - timing; - response status; and - other technical metadata.

Teylis's current system-ai implementation does not deliberately write raw AI prompts or full AI responses into its own application log messages.

Log retention depends on applicable infrastructure configuration and provider policies and may change if service plans or infrastructure change.

20. NO SALE, ADVERTISING OR CROSS-APP TRACKING

Teylis does not currently: - sell personal information; - rent personal information; - use personal information for third-party targeted advertising; - use third-party advertising SDKs; - use the Apple Advertising Identifier (IDFA); - perform cross-app behavioral tracking; - request App Tracking Transparency permission; or - use third-party attribution SDKs.

Teylis currently contains no third-party advertising.

If this changes materially in the future, this Privacy Policy and applicable App Store disclosures will be updated before such processing begins.

21. ANALYTICS

Teylis does not currently include third-party product-analytics or advertising-analytics SDKs such as Google Analytics, Firebase Analytics, Mixpanel, Amplitude, Meta Analytics or equivalent advertising/analytics systems.

Operational backend logs used for security and service reliability are not used for advertising.

22. NOTIFICATIONS

Teylis may ask for permission to send a Weekly Progress notification.

The current Weekly Progress reminder uses Apple's local notification system.

Teylis does not currently register an APNs remote-push token for this feature.

The notification body is designed not to contain sensitive personal-development content.

You may disable notifications in Teylis or through iOS settings.

23. DATA RETENTION

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, subject to legal obligations and service-provider retention rules.

In general:

ACCOUNT AND PROFILE DATA Retained while your Teylis account exists, unless earlier deletion is available for a particular item.

GOALS, ACTIVITIES, RESULTS, QUESTS AND PROGRESSION Retained as part of your Teylis account and progression history while the account exists, subject to the deletion behavior described below and the separate account-deletion procedure.

INDIVIDUAL GOAL DELETION Deleting an individual Goal removes it from your current active Goal state. Associated historical Quests, Activities, Results, Skills, progression and Chronicle records are not necessarily erased and may remain as part of your account history. Older backup snapshots may also contain the deleted Goal until those snapshots are replaced through normal backup rotation. Full Teylis account deletion follows the separate account-deletion procedure described below.

CLOUD BACKUPS Teylis normally retains the three most recent successful production backup snapshots while the account exists. Older snapshot files are normally removed during rotation, but historical records that remain in the account may continue to appear in newer snapshots. Teylis-owned backups are deleted as part of account deletion.

AI USAGE RECORDS Teylis maintains limited account-linked AI usage metadata for metering and service operation. Teylis-owned AI usage records are deleted during account deletion.

OPENAI PROCESSING OpenAI may retain API inputs and outputs for a limited period under its API data-retention rules, currently up to 30 days under standard abuse-monitoring/service-delivery settings unless a different approved configuration applies.

OPERATIONAL LOGS Technical/security logs are retained for limited periods according to the applicable provider and service configuration.

SUPPORT CORRESPONDENCE Support emails are retained only for as long as reasonably necessary to respond, maintain support history, resolve disputes, protect legal rights or comply with applicable law, subject to the email provider's service and retention rules.

APPLE TRANSACTION RECORDS Apple may retain App Store and transaction records independently according to Apple's policies and legal obligations.

Information may be retained longer where reasonably necessary to comply with law, resolve disputes, prevent fraud or enforce legal rights.

24. ACCOUNT DELETION

You can permanently delete your Teylis account from within the App.

Teylis's account-deletion process removes Teylis-owned account data including: - the Supabase authentication account; - private Teylis cloud backups; - AI usage records associated with the account; - account profile data; - installation/account association records; - Teylis subscription-entitlement association records; and - locally stored account-owned gameplay/progression data.

After remote deletion succeeds, Teylis also clears account-owned local data, local backup files, pending weekly notifications, account installation credentials and authentication state.

A technical installation identifier may remain locally on the device after account deletion without remaining associated with the deleted Teylis account.

Some limited information may remain temporarily in service-provider security or operational logs, or where retention is required by law.

Deleting your Teylis account does not cancel an Apple App Store subscription.

If you no longer wish to be billed, you must separately cancel the subscription through Apple's subscription-management system.

25. LOGGING OUT IS NOT ACCOUNT DELETION

Logging out of Teylis does not delete your account.

Before normal logout, Teylis may create or verify a private, authenticated cloud recovery backup.

Teylis then clears local account data from the device but preserves your Teylis account and cloud backup so that the account can be restored when you sign in again.

Use Delete Account, not Log Out, if you want to permanently delete your Teylis account.

26. SECURITY

We use reasonable technical and organizational measures designed to protect personal information.

These include measures such as: - authenticated account access; - email OTP authentication; - installation security credentials; - Keychain storage for sensitive device credentials; - authenticated backend requests; - private cloud backup storage; - encrypted HTTPS network transport; - server-side account validation; and - restricted service credentials that are not embedded in the iPhone app.

No method of electronic storage or transmission can be guaranteed to be completely secure.

27. INTERNATIONAL DATA PROCESSING AND TRANSFERS

Teylis is operated from Germany and uses service providers that may process information in other countries.

The primary Supabase project is currently hosted in London, United Kingdom.

OpenAI, Apple, Supabase and their subprocessors may process data in the United States, Europe, the United Kingdom or other locations where they operate infrastructure.

Where applicable law requires safeguards for international transfers, processing is subject to legally recognized transfer mechanisms such as adequacy decisions, contractual safeguards or other lawful transfer mechanisms used by the relevant service provider.

28. YOUR PRIVACY RIGHTS

Depending on applicable law, you may have rights regarding your personal information.

These may include the right to: - request access to personal information; - request correction of inaccurate information; - request deletion; - request restriction of processing; - object to certain processing; - request portability of applicable information; - withdraw consent where processing is based on consent; and - lodge a complaint with a competent data-protection authority.

Some rights may be subject to legal limitations or exceptions.

You can permanently delete your Teylis account directly from the App.

For other privacy requests, contact: support@teylis.com

29. GDPR AND EUROPEAN PRIVACY RIGHTS

Phillip Glombik is established in Germany and is the controller for Teylis.

Where the GDPR applies, you have the rights granted by applicable European data-protection law.

You may also lodge a complaint with the competent supervisory authority.

Exercising a privacy right will not result in discriminatory treatment.

30. UNITED STATES PRIVACY RIGHTS

Depending on your state of residence and applicable law, you may have rights to request: - access to personal information; - correction; - deletion; - a portable copy of certain information; - information about categories of data processed or disclosed; and - review or appeal of certain privacy-request decisions where required by law.

Teylis does not sell personal information and does not use personal information for cross-context behavioral advertising or targeted advertising.

Because these legal rights differ by state and may depend on statutory thresholds or exemptions, particular rights may not apply in every circumstance.

You may contact: support@teylis.com to make an applicable privacy request.

31. LEGAL REQUESTS AND PROTECTION OF RIGHTS

We may preserve or disclose information where reasonably necessary and legally permitted to: - comply with applicable law or binding legal process; - respond to lawful government requests; - protect the security of Teylis; - investigate fraud or abuse; - protect users or others from serious harm; or - establish, exercise or defend legal claims.

We will limit such processing to what is reasonably necessary under the circumstances.

32. BUSINESS TRANSFER

If Teylis or substantially all assets associated with Teylis are transferred, sold or reorganized in the future, personal information may be transferred as part of that transaction where permitted by law.

Any successor would remain subject to applicable privacy obligations.

Where required by law, users will be informed of material changes affecting their information.

33. CHILDREN AND MINORS

Teylis is available only to users aged 18 or older.

Teylis is not directed to children and does not knowingly permit minors to create Teylis accounts.

If we learn that a person under 18 has created an account contrary to these requirements, we may take steps to delete or restrict the account as appropriate.

34. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy when Teylis, its service providers or applicable legal requirements change.

Material changes will be communicated through the App or another appropriate method where required.

The current Privacy Policy will remain available from Teylis's Legal & Privacy section.

The Effective Date at the top identifies the version currently in effect.

35. CONTACT

For questions, privacy requests or concerns regarding this Privacy Policy, contact:

Phillip Glombik Jülicher Straße 86 40477 Düsseldorf Germany

Email: support@teylis.com