SERENIO
    Open web app

    Privacy

    Privacy Policy

    How we collect, use, share and protect your personal data, in plain words.

    In short

    • We use your data to run Serenio for you: to reply to you, keep your history, and remember what you have chosen to let Yuyu remember.
    • Yuyu is an AI. To reply, your messages and related context are processed by Microsoft Azure OpenAI Service and OpenAI, which do not use your data to train their models.
    • We don't sell your personal data, and we don't show ads.
    • You can see and edit what Yuyu remembers, download your data and delete your account from inside the app.
    • Serenio is not an emergency service, and no one monitors your conversations.

    1. Who we are

    Serenio AI Limited ("Serenio", "we", "us") is a company incorporated in Hong Kong (company no. 3299059). We provide the Serenio app for iPhone, the Serenio web app at webapp.serenio.ai and this website at serenio.ai (together, the "Services"). We decide how and why your personal data is processed, which makes us the data user (or "controller") under Hong Kong's Personal Data (Privacy) Ordinance (Cap. 486) and similar laws. On the App Store, the Serenio app may be listed under our founder's developer account; this policy applies to it in exactly the same way.

    2. What we collect

    Information you give us

    • Account: your email address and password. Passwords are stored in hashed form by our sign-in provider.
    • Profile: the name you'd like Yuyu to call you, your age range, language, time zone, an optional note about yourself, and your reminder preferences.
    • What you share and create: your messages to Yuyu; journal pages (writing, voice notes and photos), with moods and tags; mood check-ins; letters and time-capsule letters; your safety plan; your answers to the check-in questionnaires (PHQ-9 and GAD-7) and their results; the practices you use; and any summaries you choose to share.
    • Photos: images you add to a chat or your journal. We remove location data from photos when you upload them.
    • Voice: when you speak instead of typing, your recording is sent for transcription. Recordings made in chat are not kept after they are transcribed. Voice notes you save in your journal are kept as part of your journal until you delete them.
    • Messages to us: what you send by email or through our contact form.

    Information created as you use Serenio

    • Yuyu's replies, and what Serenio derives from your content to be helpful: short conversation summaries; memories (for example, the people you mention, your hopes and what helps you); emotion notes (for example, "calm" or "heavy") with an estimate of intensity; topics; reflections; and insights.
    • Technical information needed to run and secure the Services, such as IP address, device and browser type, and timestamps, held in service logs. When the safety checks detect risk, we log only a category code, never your words.

    Sensitive information

    What you share with Serenio may reveal information about your health, including your mental health, and other sensitive matters. We use it only to provide the Services to you. You choose what to share, and you can delete it at any time.

    3. How we use your data

    We use your personal data to:

    • provide the Services: write Yuyu's replies, keep your history across sessions and devices, remember what you have let Yuyu remember, and create reflections, insights, letters and check-in results;
    • keep you safe: check messages for signs of crisis and show support resources;
    • send the reminders you ask for;
    • secure, maintain, fix and improve the Services, using de-identified or aggregated information wherever we can;
    • reply when you contact us; and
    • meet our legal obligations.

    We don't use your conversations for advertising, we don't sell your personal data, and we don't make decisions that have legal or similarly significant effects on you based solely on automated processing.

    We may create de-identified or aggregated statistics, such as how many people use a feature. These don't identify you, and we may share them, including with academic partners. We will not share your conversations or journal, even de-identified, without your consent.

    If you are in the European Economic Area, Switzerland or the UK, we rely on these legal bases: our contract with you (to provide the Services); your explicit consent for health information you choose to share (which you can withdraw by deleting it or your account); our legitimate interests in keeping the Services secure and improving them; and our legal obligations.

    4. How the AI uses your data

    • Replies. When you send a message, we send it, together with the context Yuyu needs to reply, to Microsoft Azure OpenAI Service, or to OpenAI if Azure is unavailable. That context can include the name you'd like to be called, your age range, your note about yourself, recent conversation summaries, relevant memories, recent practices and, during a support moment, parts of your safety plan. Your email address is not sent.
    • Background work. We use OpenAI models to check messages for risk, note emotions, pick out memories, summarise conversations, write journal reflections, daily questions, insights, letters and check-in summaries, describe and check photos, build search indexes for your memories, and transcribe voice. Voice input in the iPhone app is transcribed by Microsoft Azure OpenAI Service.
    • No model training. Microsoft and OpenAI process this data under their business terms, under which they do not use it to train their models. They may keep it for up to 30 days to detect abuse, and then delete it.
    • Journal videos. If you ask Serenio to paint a day as a short video, a text description that includes up to 600 characters of your most recent conversation is sent to Volcengine (a ByteDance company), which creates the video on servers in mainland China. We send no account details, such as your email address, but the conversation excerpt itself may contain personal information. If you never create a video, nothing is sent to Volcengine.
    • iPhone voice conversations. In voice mode, the iPhone app uses Apple's speech recognition. Depending on your language and device, this happens on your iPhone or on Apple's servers (Cantonese uses Apple's servers). Apple's privacy policy applies to that processing. Replies read aloud use your device's built-in voice.
    • AI can be wrong. Yuyu's replies, reflections and insights are generated automatically and may be inaccurate or incomplete.

    5. Who we share it with

    We share personal data only with service providers that process it for us under contract, and only as much as they need:

    ProviderPurposeLocation
    Supabase (hosted on Amazon Web Services)Database, sign-in and file storageMumbai, India
    VercelHosting the web app and its serversMumbai, India (pages delivered through a global network)
    Microsoft (Azure OpenAI Service)Writing Yuyu's replies, and transcribing voice input in the iPhone appMicrosoft Azure data centres
    OpenAIBackup replies, safety checks, memory, reflections, photo checks and transcriptionUnited States
    Volcengine (ByteDance)Journal videos, only if you create oneMainland China
    AppleApp distribution, notifications, and speech recognition in iPhone voice modePer Apple's terms
    GoogleWebsite analytics on serenio.ai only (see section 11)Global

    We may also share personal data:

    • with your consent, for example when you create a link to share a check-in summary. Anyone with that link can see the lines you chose until it expires after 30 days or you revoke it;
    • when the law requires it, or where it is necessary to protect someone's life or safety, as the law allows; and
    • in a business transfer, such as a merger or acquisition, under confidentiality commitments and subject to this policy.

    We do not sell personal data or share it for advertising.

    6. International transfers

    Serenio is based in Hong Kong, but our providers process data elsewhere, including in India, the United States, wherever Microsoft Azure runs the Azure OpenAI Service for us and, for journal videos only, mainland China. These places may have data-protection laws that differ from yours. We choose providers with strong security commitments and rely on contractual safeguards when your data moves across borders.

    7. How long we keep it

    • We keep your account and content until you delete them or your account.
    • Journal pages: after you delete a page, you have about ten minutes to undo. It is then permanently removed, together with what Yuyu learned from it.
    • Memories: when you forget a memory, it is removed, including from conversation summaries.
    • Conversations: individual conversations can't yet be deleted one by one. Deleting your account deletes all of them.
    • Shared summary links expire after 30 days, and you can revoke them sooner.
    • Chat voice recordings are not kept after transcription.
    • Deleting your account removes your stored files, then your account and everything linked to it, and we check that nothing is left. Copies in our providers' routine backups disappear as those backups expire.
    • Service logs are kept for a limited time for security and troubleshooting.
    • iPhone versions without accounts, and earlier versions: versions of the iPhone app that don't ask you to sign in (before version 1.1) keep your conversations and journal on your iPhone, and deleting the app removes them. Messages, voice for transcription and any journal-video requests are still processed by the providers described in this policy so that Yuyu can reply. Data from those versions, and from any earlier version of Serenio that we hold, is not included in the in-app download or deletion: email us and we will send it to you or delete it.

    8. How we protect it

    • Data is encrypted in transit (HTTPS/TLS) and encrypted at rest by our infrastructure providers.
    • Database rules mean each account can access only its own records.
    • Photos, voice notes and videos are kept in private storage and shown only through links that expire.
    • Access to production systems is limited to the people who need it to run Serenio.

    No system is perfectly secure. If a breach affects your personal data, we will notify you and the relevant authorities where the law requires.

    9. Your rights and choices

    Wherever you live, you can:

    • see, correct and delete your data: edit your profile, review, edit or forget memories, and delete journal pages;
    • download your data with "Download everything" in the You tab;
    • delete your account and all of its data with "Delete my account" in the You tab;
    • pause new memories with "Remember new things";
    • withdraw consent, by deleting the content concerned or your account; and
    • turn reminders on or off.

    Depending on the laws that apply to you, you may also have the right to request access to and correction of your data (in Hong Kong, under the Personal Data (Privacy) Ordinance), to restrict or object to processing, and to data portability. To make a request, email support@serenio.ai. We may need to verify your identity, and we will respond within the time the law requires (for a data access request under the Ordinance, 40 days).

    If you have a concern, please contact us first. You can also complain to the Office of the Privacy Commissioner for Personal Data in Hong Kong or, if you are in the EEA, Switzerland or the UK, to your local data protection authority.

    10. Children

    Serenio is for adults aged 18 and over. It is not directed at children, and we don't knowingly collect personal data from anyone under 18. If you believe someone under 18 is using Serenio, please contact us and we will delete the account.

    11. This website: cookies and analytics

    This website (serenio.ai) uses Google Analytics to understand how many people visit and which pages help them. Google Analytics sets cookies and collects information such as pages viewed, approximate location, device and browser. If your browser sends a Do Not Track or Global Privacy Control signal, the website does not load Google Analytics at all. Advertising features are turned off for everyone, and visitors in the EEA, the UK and Switzerland are counted without analytics cookies. The website also remembers your language choice in your browser's local storage.

    The Serenio apps don't contain advertising or analytics trackers. The iPhone app sends reminders only if you allow notifications, and you can turn them off at any time in the app or in iOS Settings.

    Serenio shows helplines and links to other services. When you contact a helpline or visit another website, that organization's own terms and privacy policy apply.

    13. Changes to this policy

    We may update this policy from time to time. We'll post the new version here with a new "last updated" date and, if the changes are significant, tell you in the app or by email before they take effect.

    14. Contact us

    Serenio AI Limited (Hong Kong company no. 3299059). For privacy questions, requests and complaints, email support@serenio.ai.

    If a translation of this policy differs from the English version, the English version prevails.

    Last updated: 28 September 2026