Privacy Policy

At a Glance

• We collect what you give us to create your account and use the app (email, username, posts, uploaded files).
• Oral board audio recordings you choose to make, transcribed by OpenAI's Whisper service.
• We use your data to operate the service — study features, AI assistant, community, and security.
• We do not sell your personal information. Ever.
• We do not serve ads or use advertising networks.
• We do not track you across other apps or websites.
• We do not collect your location, contacts, or advertising identifiers.
• You can delete your account at any time from Settings — this permanently removes your profile, content, and uploaded files.

1. Overview & Scope

Flamerz is operated by Rhyan App LLC, a Pennsylvania limited liability company ("Developer," "we," "us," or "our"). This Privacy Policy explains what personal information we collect, how we use and share it, and the choices you have.

This policy applies to the Flamerz mobile applications for iOS and Android, the Flamerz web app, and related services operated by Rhyan App LLC. It does not apply to third-party services that we use to operate the app (such as Supabase or Anthropic), each of which has its own privacy practices.

By using Flamerz, you agree to the collection and use of information as described in this Policy. Please also review our Terms of Service.

2. Information We Collect

Account Information

When you create an account, we collect:

• Email address — used for authentication, password reset, and service communications.
• Username — your chosen display handle within the app.
• Full name — collected at signup for identity context; not displayed publicly in the app.
• Rank / role / station — your fire service rank, certification level, and station assignment, used to personalize features and verify eligibility.
• Password — stored as a secure cryptographic hash by our authentication provider (Supabase). We never see or store your plaintext password.

Content You Create or Upload

• Posts, comments, and community interactions;
• Quiz questions you submit as contributions;
• Documents and PDFs you upload to the study library;
• Profile avatar images;
• Challenge evidence (photos or files submitted in connection with peer challenges);
• Messages you send to the in-app AI assistant ("Ask Rhyan").

Oral board practice and audio recordings

When you use oral board practice features, Flamerz records your spoken answers using your device's microphone, with your permission requested through the standard iOS or Android microphone prompt. Recordings are stored securely in our infrastructure and transcribed using OpenAI's Whisper service, which means your audio is transmitted to OpenAI for transcription processing. Transcripts may also be processed by our AI provider (Anthropic) to generate scoring and coaching feedback. Your recordings and transcripts are available to you inside the app, including download and sharing. Audio recordings and transcripts are deleted when you delete your account, and you may request deletion of specific recordings at any time by contacting us.

Device Information

To enforce the two-device account limit and maintain session security, we store:

• A randomly generated device identifier created on first app launch. This is not your device’s advertising ID, IMEI, or any hardware identifier — it is a UUID we generate and store locally and in our database.
• A basic device name (e.g., "iPhone") for display in your Active Devices settings screen.

We do not collect advertising identifiers (IDFA), IMEI, MAC address, or any other persistent hardware identifier.

Usage Data

• Quiz activity, scores, correct/incorrect counts, and topic areas;
• XP (experience points), level, streak count, win/loss record;
• AI assistant usage count (daily and historical, for rate limiting and premium feature management);
• Feature interaction patterns (e.g., which study categories you access).

Notifications

Flamerz can send local notifications and, if you enable notifications, remote push notifications — for example, to let you know when an AI answer has finished generating. To deliver remote notifications we store a push token that identifies your device. You can disable notifications at any time in your device settings, and push tokens are removed when you delete your account. We do not use third-party push notification analytics services.

Subscriptions & Payments

Subscription purchases are processed by Apple (App Store) or Google (Google Play) depending on your platform. We never receive or store your full payment card details. We use RevenueCat to manage subscription entitlements; RevenueCat receives purchase receipts and transaction identifiers from the app stores in order to activate and maintain your subscription.

What We Do Not Collect

• Precise or approximate GPS location;
• Device contacts or address book;
• Browsing history or cross-app activity;
• Advertising identifiers (IDFA or equivalent);

We do not embed any third-party advertising or behavioral analytics SDKs (e.g., Google Analytics, Facebook SDK, Mixpanel).

3. How We Use Information

We use the information we collect for the following purposes:

• Providing the service: Creating and managing your account; enabling study, quiz, community, and AI features; delivering content you request.
• AI features: Your messages to the AI assistant and documents you upload are processed by our AI providers (Anthropic for responses; OpenAI for text embeddings used in document search). See Section 4 for sharing details.
• Account and device management: Enforcing the two-device limit; processing approval requests; sending authentication-related emails (e.g., password reset, email confirmation).
• Moderation and safety: Reviewing content for violations of our Terms; enforcing community guidelines; investigating misuse.
• Security and fraud prevention: Detecting and preventing unauthorized access, abuse, or security incidents.
• Service communications: Sending emails related to your account (transactional only — we do not send marketing email).
• Service improvement: Understanding usage patterns to improve features. This is done using our own data; we do not use third-party analytics platforms.

We do not sell your personal information. We do not use your data for third-party behavioral advertising.

4. How We Share Information

We share your information only in the following limited circumstances:

Service Providers

• Supabase — Database, authentication, and file storage. Shared: all account data, content, and uploaded files.
• Anthropic — AI assistant responses (Claude). Shared: your messages to the AI assistant; text from documents you’ve uploaded to the study library.
• OpenAI — Text embeddings for document search. Shared: text content of documents processed for search.
• RevenueCat — subscription entitlement management; receives app store purchase receipts and transaction identifiers.
• Expo — remote push notification delivery; receives device push tokens.

Each of these providers processes data only as necessary to perform services on our behalf and is subject to their own data processing and privacy commitments. We do not authorize them to use your data for their own independent purposes beyond providing the services to us.

Legal Compliance and Safety

We may disclose information if required by law, regulation, subpoena, court order, or other legal process; or when we believe in good faith that disclosure is necessary to protect the rights, property, or safety of the Developer, users, or the public.

Business Transfer

If the Flamerz app or its operation is sold, transferred, or merged, your information may be transferred as part of that transaction. We will provide notice through the App before your data is transferred and becomes subject to a different privacy policy.

What We Don’t Do

• We do not sell your personal information to data brokers or any third party.
• We do not share your data for cross-context behavioral advertising.
• We do not share your data with advertisers.

5. Retention & Deletion

We retain your personal information for as long as your account is active and as necessary to provide the Service.

Account deletion: You can permanently delete your account at any time via Settings → Delete Account within the App. Deletion is permanent and irreversible. Upon deletion, we remove:

• Your profile record and all associated account data;
• Your authentication credentials;
• Your uploaded files (documents, avatars, challenge evidence);
• Your posts and community content.

A small number of records may be retained in limited, anonymized or de-identified form for moderation integrity (for example, challenge outcome records with user identifiers removed). These do not contain information that identifies you.

Temporary disable: You may temporarily disable your account (Settings → Disable Account) rather than delete it. While disabled, your account is inactive, but your data is retained. You can reactivate by signing in.

We may also retain information for a limited period as required or permitted by applicable law (for example, for fraud prevention, legal compliance, or dispute resolution).

6. Your Rights & Choices

Access, Correction, and Portability

You may update most of your account information (username, email, password, station) directly within the App settings. To request a copy of personal information we hold about you, or to request correction of inaccurate information, contact us at [email protected].

Deletion

Use Settings → Delete Account to permanently delete your account and data. You may also submit a deletion request to [email protected].

U.S. State Privacy Rights

Depending on your state of residence, you may have additional rights under applicable privacy laws, including the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) and similar laws in other states. These rights may include:

• Right to know what personal information we collect, use, and disclose;
• Right to delete personal information we hold about you, subject to exceptions;
• Right to correct inaccurate personal information;
• Right to non-discrimination for exercising your privacy rights;
• Right to opt out of sale or sharing of personal information — we do not sell or share personal information for cross-context behavioral advertising, so no opt-out is needed for that purpose.

To exercise any of these rights, contact us at [email protected]. We will verify your identity before processing your request and will respond within the timeframe required by applicable law. You may designate an authorized agent to submit requests on your behalf; we may require verification of the agent’s authorization.

Notifications

You can disable push notifications at any time through your device’s Settings → Notifications.

7. Security

We take reasonable technical and organizational measures to protect your information:

• All data transmitted between the App and our servers is encrypted using TLS;
• Our database uses row-level security (RLS) policies that restrict each user’s access to their own data and data they are authorized to view;
• Administrative access to the database is role-restricted;
• Passwords are stored as secure cryptographic hashes — we do not have access to your plaintext password.

No method of transmission over the internet or electronic storage is 100% secure. While we work to protect your information, we cannot guarantee absolute security. In the event of a data breach that affects your rights and requires notification under applicable law, we will notify you as required.

8. Children

Flamerz is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe that a child under 13 has provided us with personal information, please contact us at [email protected] and we will take steps to delete that information.

The App is intended for users aged 17 and older as set forth in our Terms of Service.

9. International Users

Flamerz is operated from the United States. If you are accessing the App from outside the United States, please be aware that your information will be transferred to, stored, and processed in the United States, where our servers are located and our operations are based. Data protection laws in the United States may differ from those in your country. By using the App, you consent to this transfer.

10. Do Not Track

Some browsers transmit "Do Not Track" (DNT) signals. Because Flamerz does not engage in cross-site tracking or behavioral advertising of any kind, there is no cross-site tracking to respond to. We do not track your activity across other websites or applications.

11. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes to how we collect, use, or share your personal information, we will notify you through the App (for example, via an in-app notice) before the changes take effect. The updated Policy will show a revised "Last updated" date at the top. Your continued use of the App after the effective date of any changes constitutes your acceptance of the revised Policy.

12. Contact

For questions, concerns, or requests related to this Privacy Policy or your personal data, contact us at [email protected]. We aim to respond to privacy inquiries within a reasonable timeframe and within any timeframe required by applicable law.