US state privacy notice · Last updated 2 November 2026
US State Privacy Notice
This US State Privacy Notice (the "Notice") applies to the Rizzpond application, this website and their related services (the "Service"), provided by Darabos Group ("we", "us" or "our"). It supplements, and should be read together with, the Privacy Policy, which describes the processing carried out by the Service. This Notice sets out the disclosures required by the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), and by the comprehensive consumer privacy laws of other US states, using the terminology of those laws. It does not describe any collection of personal information in addition to that described in the Privacy Policy. In this Notice, "you" means any individual who uses the Service.
Applicable laws
Twenty US states have enacted a comprehensive consumer privacy law, among them California (CCPA, as amended by the CPRA), Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Kentucky, Rhode Island and Indiana. Almost all of these laws apply only to businesses that exceed a size threshold, typically the processing of the personal data of 100,000 residents a year, or annual revenue above USD 25 million.
Darabos Group is a one-person company and does not meet any of those thresholds. Accordingly, most of these laws do not currently apply to us. We nevertheless publish this Notice because the thresholds, and not the principles of these laws, are the only reason they do not apply, and because you should not be required to assess our revenue in order to understand how your messages are handled. We will honour each right described in this Notice, whether or not a statute currently requires us to do so.
Categories of personal information collected
The table below sets out the categories of personal information collected by the Service, in the form required by California law, together with a description of what each category comprises in our case. All personal information listed is collected from you and from your device, with the exception of the Apple identifier, which is received from Apple when you choose Sign in with Apple.
| Category | What it is for us | Why we have it | Who else sees it |
|---|---|---|---|
| Identifiers | A random account identifier created by the app. If you sign in with Apple: the stable identifier Apple gives us and, only if you allow it, your email address or a Hide My Email relay. If you write to us through a form on this website: the name and email you give us. | To recognise your account, carry your allowance and subscription across phones, and restore a backup. A name and email from a form: only to answer you. | Our hosting provider. Never sent to OpenAI. |
| Commercial information | Whether you have a subscription, the Apple transaction identifier and Apple's signed purchase record, and whether the purchase was live or a sandbox test. | To unlock Rizzpond+, to check with Apple that it is still active, and to count subscriptions from our own record. | Apple, which is the seller. No other company receives it. |
| Internet or other electronic network activity | Counts: scans per day, reply requests per day, whether the free scan was used, how many tokens a request took and what it cost us, how long it took. Anonymous usage events: that the app was opened or closed, which screen and for how long, which quiz step, that a scan was read or a reply copied, and that the subscription screen was opened. Fixed names and numbers, no text; linked to your account identifier, not used for tracking or advertising. | To run the daily allowance, keep the service affordable, stop abuse, and find what in the app is confusing or slow. | Our hosting provider. |
| Geolocation data (coarse) | Your phone's time zone identifier, for example America/Los_Angeles. No GPS data, IP-based location or city is collected. |
So your daily allowance resets at your midnight rather than ours. | Our hosting provider. Not sent to OpenAI. |
| Inferences | The persona and the vibes your quiz answers add up to, and what the app has worked out about how you text. | So the reply sounds like you. Your quiz answers themselves stay on your phone. | Sent to OpenAI with a reply request. The persona and vibes are also stored with the cost record for a reply set. |
| Sensitive personal information | See the next section: the contents of the conversation you ask Wink, the AI inside Rizzpond, to read. | Solely to generate your reply. | OpenAI, to write the reply, under its API terms (see the privacy policy). |
The Service does not collect the following categories of personal information: your name (unless you provide it to us through a form on this website), telephone number, postal address, government identifiers, financial account or payment card details (payment is processed by Apple and is never disclosed to us), biometric information, education or employment records (unless you submit a job application to us), precise geolocation, browsing history across other websites, or any information obtained from a data broker. We do not purchase personal information about you from any person.
Sensitive personal information
Under the CPRA, "the contents of a consumer's mail, email and text messages, unless the business is the intended recipient" constitute sensitive personal information. The Service is designed to process conversations to which we are not a party, and the processing of this category of information is therefore central to the Service. Several other states treat data revealing sexual orientation in the same manner, and the contents of a dating conversation, together with your answer to the question of whom you are texting, may reveal it.
Accordingly, we treat as sensitive personal information the screenshot or pasted text you provide to Wink, the AI inside Rizzpond, and the conversation it contains. The contents of your chats are used for one purpose only: to generate the reply you requested. They are transmitted through our server to OpenAI for that purpose, and only after you have given your consent in the application. Neither we nor our database retain the image or the text afterwards. OpenAI processes them under its API terms, which permit it to retain API data for up to 30 days for abuse monitoring and do not permit its use for training. They are not used to profile you, for advertising, to train any model of ours, or to infer characteristics about you.
California law grants you the right to limit a business's use of sensitive personal information where it is used beyond what is reasonably expected in order to provide the service. We use sensitive personal information only to provide the Service you requested, which is a permitted purpose under that law. There is therefore no use to limit, and no "Limit the Use of My Sensitive Personal Information" link is provided. Should this cease to be the case, such a link will be made available in this Notice and on the home page before the change takes effect, and this section will be amended accordingly.
Washington and Nevada have separate rules governing consumer health data. Their application to the Service is described under consumer health data in the Privacy Policy.
Sale, sharing and targeted advertising
During the twelve months preceding the date on which this Notice was last updated, and at all times before that period:
- We have not sold personal information, as selling is defined by any US state law, whether for monetary or any other consideration.
- We have not shared personal information for cross-context behavioural advertising. We do not conduct any advertising.
- We have not used personal information for targeted advertising.
- We have not processed personal information for profiling in furtherance of decisions that produce legal or similarly significant effects. We make no such decisions about you.
Accordingly, no "Do Not Sell or Share My Personal Information" link is provided, as there is no sale or sharing to which it could apply.
Global Privacy Control
Certain browsers and extensions transmit a Global Privacy Control signal, which constitutes a request to opt out of sale and sharing in California and several other states. As we do not sell or share personal information, there is no processing for the signal to stop, and nothing on this website operates against it. This website runs no scripts other than its own and sets no cookies. See the Privacy Policy.
Disclosure of personal information
We disclose personal information only to service providers and processors, each bound by a contract that limits it to processing on our behalf, and only for the business purposes described above. The following four recipients constitute the complete list:
- Supabase — our database and server functions, hosted in Frankfurt, Germany.
- OpenAI — the models that read the chat and write the reply, in the United States. OpenAI does not receive your name, your email address or your account identifier. Requests carry a one-way hash so that abuse can be detected without identifying you.
- Apple — Sign in with Apple, and payment for Rizzpond+, under Apple's own terms.
- Simply.com — this website, its contact forms and our email inbox, hosted in the EU.
We do not disclose personal information to advertisers or data brokers, and we do not use any third-party analytics provider. We would disclose personal information where validly required by a court or by law; no such disclosure has been made to date.
Retention
The complete retention schedule is set out in the Privacy Policy. In summary: the screenshot and the chat are held on our side for seconds and are never stored (OpenAI's own retention is described in the Privacy Policy); the replies Wink wrote are retained for 30 days, or until you delete your account, so that the same request can be answered again without a second charge to your allowance; rate-limit records and replies written in advance of your request, 2 days; the cost of each reply, 90 days, after which only daily totals not linked to any account are kept; anonymous usage events, 180 days; counts, your time zone, your subscription link and your backup are retained for as long as your account exists; all other information is held only on your device. We do not retain personal information for longer than is necessary for the purpose for which it was collected, and every record in our database is linked to your account and deleted with it.
Your rights and how to exercise them
Depending on your state of residence, you may have some or all of the following rights. We extend them to every person who submits a request, regardless of where they reside:
- Know and access. The right to know what personal information we have collected about you, its sources, the purposes for which it is used and the recipients to whom it has been disclosed, and to obtain a copy of it.
- Delete. The right to delete all of your personal information, which you may exercise from within the application.
- Correct. The right to correct inaccurate personal information. Almost all correctable information is held on your device, where you may edit it yourself.
- Portability. The right to obtain a copy in a usable format.
- Opt out of sale, sharing, targeted advertising and profiling. None of these activities takes place, so no opt-out is required.
- Limit the use of sensitive personal information. Such use is already limited to providing the Service, as described in the section on sensitive personal information.
- Non-retaliation. We will not charge you a different price, provide a different level of service, or degrade the Service because you have exercised any of your rights. The Service contains no mechanism capable of doing so.
Deletion within the application
Deletion does not require any correspondence with us or any waiting period. In the application, select You → Account → Delete account (or Delete my data if you have not signed in). The data held on our server is deleted first and the data on your device only thereafter, so that no data remains on our side if the process is interrupted on the device. Your account, every count, your subscription link, your purchase record, your usage events and your backup are deleted. If you hold a subscription, you must also cancel it with Apple: deleting the account does not cancel the subscription, Apple will continue to bill you until it is cancelled, and the confirmation screen provides a direct link for that purpose.
Requests to us
You may submit a request through the contact form by selecting Privacy and data, or by email to info@rizzpond.app, stating what you request. You are not required to cite any law or to use any particular terminology. We will respond within 45 days and will inform you if we require the extension permitted by the applicable statutes.
Verification. Your account is anonymous by design, and we hold no name, telephone number or address against which to verify your identity. To act on a request received by email, we must therefore match it to an account, normally by means of the email address with which you signed in, or by information known only to the account holder. If we cannot make that match with reasonable confidence, we will decline the request and explain the reason. Deletion from within the application does not require such verification, and the function is provided in the application for that reason.
Authorised agents. An authorised agent may submit a request on your behalf. The agent must provide written permission signed by you, and we may nevertheless ask you to confirm the request directly.
Appeals
Colorado, Connecticut, Virginia, Texas, Oregon, Montana and several other states grant you the right to appeal a refusal of your request. We extend this right to every person. To appeal, reply to our refusal or write to info@rizzpond.app with "appeal" in the subject line. Each appeal is reviewed by a person; as Darabos Group is operated by one person, that is the same individual who reviewed the original request. We will respond within 45 days with our decision and the reasons for it in writing. If your appeal is refused, you may lodge a complaint with the Attorney General of your state, and we will provide the relevant contact details in our response.
California "Shine the Light"
California Civil Code § 1798.83 permits California residents to request, once a year, information about personal information disclosed to third parties for those third parties' own direct marketing purposes. We do not make any such disclosure to any person. If you wish to receive written confirmation of this for your records, you may request it at info@rizzpond.app.
Contact
Darabos Group (David Pal)
Frederiksborggade 37, 1. tv
1360 Copenhagen K, Denmark
info@rizzpond.app
Darabos Group determines the purposes and means of the processing of your personal information and is the "business" under California law and the "controller" under the laws of the other states. There is no separate privacy department: the contact form and the address above both reach the individual who developed the Service.