Privacy Policy

Last updated: October 11, 2026

Amaranto makes personalized audio sessions. To do that, you tell us things that are personal: your goals, your fears, what blocks you. This policy explains exactly what we collect, what we do with it, and what we will never do with it.

The short version: we collect only what the product needs, we use no advertising trackers, and we never sell your data. Ever.

Who we are

Amaranto is operated by Zyndo AI Inc., based in San Antonio, Texas. Zyndo AI Inc. is the data controller for the information described here.

• Address: 335 Abiso Avenue, San Antonio, TX 78209, US
• Contact: [email protected]

This policy covers amaranto.app, my.amaranto.app, the Amaranto app for iOS and Android, and the emails we send.

What we collect

Account. You can sign in with email and a password, Google, or Apple in the mobile app. For email sign-in, we store a hash of your password, not the password itself, and use your email to verify your account or reset your password when you ask. Google and Apple share your name and email address with us; Google may also share your profile picture. If you use Sign in with Apple and choose to hide your email, we receive Apple's relay address.

Session inputs. During onboarding and weekly check-ins you share your goals, fears, mental blockers, and how sessions land for you. This is the most personal data we hold. We use it for exactly one thing: writing and adjusting your sessions.

Generated content. We store the scripts and audio files we generate for you, so you can replay them and so future sessions can build on past ones.

Billing. Stripe processes web payments, including web checkout opened from the iOS app for customers with a United States App Store account. Apple or Google processes purchases made through their in-app payment systems. The payment provider collects your card details; we do not store your card number. We store your plan, subscription status, renewal and cancellation details, whether the 3-day refund window on a first annual payment is open, and the customer, subscription, or purchase identifiers needed to manage your access and billing. The monthly plan does not open that window.

Usage events. We record product events, such as a session being started or finished, to understand what works and send relevant reminders. These events can be linked to your account or device; they are not anonymous. We do not put the content of your answers, goals, or session scripts into event properties. On the web, our analytics provider can record a replay of how you use the interface. We configure these replays to mask text inputs and exclude sensitive display surfaces.

Notifications. If you allow push notifications, we store a device push token, platform, language, time zone, and delivery history so we can send reminders and tell you when a session is ready. You can turn notifications off in the app or your device settings.

Technical logs. Our servers log IP addresses for rate limiting and abuse prevention.

What we do not collect

• No advertising trackers, pixels, or ad identifiers.
• No precise location tracking or location history. We use the country and, for Canada, province inferred from your IP address only to choose the browser analytics setting.
• No access to your contacts, photos, microphone, or camera.
• No data brokers, no buying or selling of personal data in any direction.

Cookies

On the web, cookies keep you signed in, remember your language on the app, and connect an invitation to your new account. The landing site remembers your language in local storage. Where browser analytics is enabled, our product analytics provider uses cookies and local storage to recognize a browser across visits to amaranto.app and my.amaranto.app and measure how people use the service. Visitors in the EEA, United Kingdom, and Québec are asked before browser analytics starts. In other known locations, browser analytics is on unless you decline it. If we cannot determine the visitor's location or, in Canada, the province, browser analytics stays off until accepted. We remember your analytics choice across amaranto.app and my.amaranto.app for six months; you can change it at any time through Cookie settings. The mobile app stores its session token securely on the device and uses a mobile analytics SDK rather than browser cookies.

How we use your data

1. To write and generate your personalized sessions.
2. To operate your account, subscription, and library.
3. To send service emails and, if you allow them, push notifications: welcome, session ready, reminders, billing, and account notices. Non-essential emails have an unsubscribe link that works with one click.
4. To understand product use and keep the service safe: analytics, rate limiting, and abuse prevention.

We do not use your data for advertising. We do not share it with anyone except the processors below.

Who processes your data

Running Amaranto takes a small set of providers. Each receives only what its job requires, under terms that limit use to providing the service:

• Google and Apple, for sign-in.
• Stripe, for web payments. Apple and Google Play, for in-app purchases. A subscription platform keeps that state in sync across them.
• Hosting, network and storage providers, which run our servers and hold your audio. They are established infrastructure companies with independently audited security programs, they process your data only on our instructions under a data processing agreement, and everything they hold is encrypted in transit and at rest.
• An email delivery provider, for the emails we send you.
• A product analytics provider, for the account-linked product events and masked web interface replays described above.
• Leading AI providers, which turn your answers into the script and the voice of your sessions. We use their business APIs, never their consumer products.

We do not use your answers to train an Amaranto model. AI providers may temporarily retain inputs and outputs under their own API terms for safety, troubleshooting, or service operations. Their retention periods and any additional data-use controls depend on the provider and our account agreement. We use your goals and answers to make your sessions, not to sell personal information or build advertising profiles.

We choose providers with privacy and security commitments appropriate to the data they handle. Their terms and retention practices differ; we review them before adding a provider that handles personal information.

A current list of our sub-processors is available on request at [email protected].

Some of these providers are located in the United States. If you use Amaranto from outside the US, your data is transferred and processed there.

Data retention

We keep your data while your account is active. Delete your account, from the app under You, from my.amaranto.app/delete-account, or by asking us, and we delete your account data, session inputs, and generated audio from our systems. We may keep minimal billing records where the law requires it.

Withdrawing your consent

Before your first session we ask, in the app, for your permission to send your answers to the AI providers that write the script and generate the voice. Nothing is sent before you agree.

You can take that permission back at any time, in the app under You, next to sign out. From that moment we stop sending your answers and no new meditations can be built. The sessions you already have stay available, and we ask again if you decide to continue later. To erase everything instead, delete your account.

Your rights

You can delete your account and all of its data yourself, at any time. In the app it is under You. On the web it is at my.amaranto.app/delete-account, which works even if you have already uninstalled the app. You can also email [email protected] from your account address and we will:

• Send you a copy of the data we hold about you.
• Correct anything that is wrong.
• Delete your account and data.
• Remove you from any email list.

Depending on where you live, you may also have the right to object to or restrict processing, to data portability, and to complain to your local data protection authority. We answer within 30 days, usually much faster. There are two of us and we read everything.

Security

All data moves over encrypted connections. Generated audio and session data live in access-controlled storage, and audio is served only through short-lived signed links tied to your account. Access is limited to the two founders. If a breach ever affects your data, we will tell you directly and quickly.

Children

Amaranto is not for children. We do not knowingly collect data from anyone under 16. If that happened, tell us and we delete it.

Changes

If this policy changes in a way that matters, we announce it on the site and by email before it takes effect. The date at the top always reflects the latest version.

Contact

Questions about your data: [email protected].