← Back to Home

Privacy Policy

Last Updated · June 11, 2026 · Effective · June 11, 2026

1. Introduction and Scope

Orlyn ("Orlyn", "we", "us", or "our") respects your privacy and is committed to protecting your Personal Data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Orlyn mobile application, the orlyn.ai website, and related services (collectively, the "Service"). This Privacy Policy applies to all Users of the Service.

Orlyn is a quit-drinking and sobriety-support application. It helps you track a live sober streak, complete a one-tap daily check-in, work through cravings, and converse with a 24/7 AI support coach (the "Coach"). Because the Service is built around your relationship with alcohol, much of the information you give us is data concerning health within the meaning of Article 4(15) and Article 9 of the GDPR, and "consumer health data" under certain US state laws. We treat it accordingly, as described throughout this Privacy Policy.

This Privacy Policy is designed to comply with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") for Users in the European Economic Area, the UK Data Protection Act 2018 and UK GDPR for Users in the United Kingdom, the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA") and other US state privacy laws, the Washington My Health My Data Act ("MHMDA") and comparable consumer-health-data laws, and Canadian federal and provincial privacy law (including PIPEDA and Québec Law 25).

Capitalised terms not defined in this Privacy Policy have the meanings given in the Terms of Service. By accessing or using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with it, please do not access or use the Service.

2. Controller, Representatives, Data Protection Officer, and Supervisory Authority

The data controller responsible for processing your Personal Data is:

Controller: Luca Diaz Hilterscheid (Einzelunternehmer), operating as a sole proprietor under the laws of the Federal Republic of Germany.

Postal address: Märkische Heide 5, 14532 Kleinmachnow, Germany

Email (privacy and general): luca@orlyn.ai

Support email: support@orlyn.ai

Privacy contact: Luca Diaz Hilterscheid — luca@orlyn.ai

EU representative (Article 27 GDPR): The controller is established in Germany. A representative under Article 27 GDPR is therefore not required.

United Kingdom (Article 27 UK GDPR): Users in the United Kingdom may contact the controller directly about any data-protection matter at: Luca Diaz Hilterscheid, Märkische Heide 5, 14532 Kleinmachnow, Germany — luca@orlyn.ai.

Data Protection Officer (Article 37 GDPR): The controller has assessed its processing activities under Article 37 GDPR and has determined that the appointment of a Data Protection Officer is not strictly mandatory at this time, principally because the controller is a sole proprietor whose current scale of processing is not considered to be "large-scale" within the meaning of Article 37(1)(b)–(c). We recognise, however, that the processing of data concerning health (including sobriety status, alcohol-use answers, cravings, moods, reflections, and Coach conversations) is now a core activity of the Service. We will keep this determination under active review and will appoint a Data Protection Officer (which may be an external or fractional appointment) if and when our scale of processing meets the threshold, publishing the contact details here at that time. All privacy-related inquiries should be directed to the privacy contact above.

Lead supervisory authority: Because the controller's place of establishment is in Kleinmachnow, Brandenburg, the competent lead supervisory authority is Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg (LDA Brandenburg), https://www.lda.brandenburg.de. Complaint paths for other jurisdictions are set out in Section 18.

3. Information We Collect

This Section describes the categories of Personal Data we collect. Where a category is, or may be, data concerning health, it is identified as such in Section 3.4.

3.1 Information You Provide Directly

3.2 Information Collected Automatically

3.3 Information from Third Parties and Sign-In Providers

3.4 Health Data (Data Concerning Health)

The following categories are, or may be, data concerning health under Article 9 of the GDPR (and "consumer health data" under the MHMDA and comparable laws). We process them only on the basis of your explicit consent (Article 9(2)(a) GDPR) and as further described in Section 4 and Section 5:

We do not derive characteristics about you from your health data beyond what is necessary to operate the features described in this Privacy Policy, and we do not use your health data for advertising or to train third-party AI models.

3.5 Consent, Terms, and Deletion Records

4. How and Why We Use Your Information, and Our Lawful Bases

We use your information for the purposes set out below. For Users in the EU, EEA, and UK, each purpose is matched to its lawful basis under Article 6 of the GDPR, and — for any processing of data concerning health — to the additional condition under Article 9. All processing of data concerning health is carried out only on the basis of your explicit consent under Article 9(2)(a) GDPR, which you may withdraw at any time (see Section 9).

Per-purpose lawful-basis table. The following list maps each processing purpose to its lawful basis:

Where we rely on consent, you may withdraw it at any time, and withdrawal is as easy as giving consent (see Section 9). Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal. Where we rely on legitimate interests, you may object as described in Section 9.

5. The AI Coach and DeepSeek (International Transfer to China)

The Service offers an optional 24/7 AI support coach (the "Coach"). The Coach is a support-only feature: it is not a human, not a therapist, and not a medical service, and it does not diagnose, treat, or provide medical advice (see Section 16 and the Terms of Service).

What is sent. When you send a message to the Coach, only the message text you author is transmitted to our AI provider to generate a reply. We do not add your name, email address, account identifier, or other system-level identifiers to the content sent to the provider. We apply data minimisation so that the provider receives the conversational text needed to respond and nothing more.

Who generates the replies. The Coach's replies are generated by DeepSeek, a third-party large-language-model provider that processes data in China. DeepSeek acts as our processor for this purpose and is bound by a data processing agreement.

This is an international transfer to China. Sending your Coach message text to DeepSeek is a transfer of Personal Data — including data concerning health — to China. The European Commission has not adopted an adequacy decision for China, and neither has the United Kingdom. We therefore rely on the following safeguards:

Potential impact you should understand. Despite these safeguards, you should be aware that transferring data to China carries risks that cannot be fully eliminated by contract. In particular, a foreign government or authority may be able to access data under local laws in ways that differ from, and may offer less protection than, the standards you are used to in the EEA, the UK, or your home country, and your ability to obtain effective legal redress in such circumstances may be limited. A data protection authority could also restrict or suspend transfers of this kind in the future.

You can decline. Use of the Coach is optional. If you do not wish your message text to be processed by DeepSeek in China, you can simply decline to use the Coach — the rest of the Service (streak tracking, check-ins, craving toolkit, and leagues) works without it. You may request a copy of the safeguards applied to this transfer by contacting us at luca@orlyn.ai (we may redact commercial information).

You are always clearly told, in the chat itself, that you are interacting with an AI and not a human.

6. How We Share Your Information and Our Subprocessors

We do not sell your Personal Data, and we do not sell consumer health data. We share your information only as described below, and only to the extent necessary.

6.1 Subprocessors

We share Personal Data with the following service providers (subprocessors), each engaged under a data processing agreement that requires it to process Personal Data only on our documented instructions and to apply appropriate technical and organisational measures. The list states each provider's purpose and processing region:

The advertising-attribution pixels (Meta and TikTok) operate on the website only and are set only with your consent. The Service does not use Apple HealthKit, the Apple Screen Time API, step-count data, wallet, banking, money-transfer, or staking integrations of any kind.

6.2 Other Recipients

7. International Data Transfers

Your Personal Data may be transferred to, and processed in, countries other than your country of residence, including those of the subprocessors listed in Section 6.1. These countries may have data protection laws that differ from those of your country.

For transfers from the EEA, the UK, or Switzerland to countries not deemed to provide an adequate level of data protection, we implement appropriate safeguards, including:

The most significant transfer is to DeepSeek in China, which has no adequacy decision; this transfer, its safeguards, and its potential impact are described in detail in Section 5. Where US providers participate in a recognised transfer framework, we rely on that framework or on the Standard Contractual Clauses as applicable. For Canadian Users, please also see the cross-border processing notice in Section 11.

You may request a copy of the safeguards applied to a specific transfer by contacting us at luca@orlyn.ai. We may redact commercial information.

8. Data Retention and Deletion

We retain Personal Data only for as long as necessary for the purposes for which it was collected, subject to legal retention obligations.

Account deletion. You may delete your account at any time from within the Service (in-app account deletion is available in Settings). On deletion, your account enters a 30-day soft-delete period (or is deleted immediately, depending on the path you choose), after which an automated server-side process cascade-deletes the rows associated with your account, including your authentication record, profile, streak and relapse history, check-ins, onboarding-quiz responses, Coach conversations, league presence, and other Personal Data linked to your account. The only item retained is a one-way hash of your email address, which cannot be reversed to recover your email and is kept solely to honour your deletion and prevent re-creation of a deleted account, together with any records we are required by law to retain or that are necessary to establish, exercise, or defend legal claims.

If you signed in using Sign in with Apple, we additionally call Apple's token-revocation endpoint as part of deletion, so that Orlyn no longer appears under "Apps Using Apple ID" in your iCloud settings. If you cannot use the in-app deletion flow, you may contact us at luca@orlyn.ai and we will process your request manually.

9. Your Rights (GDPR / UK GDPR) and How to Exercise Them

If you are in the EU, EEA, or UK, you have the following rights with respect to your Personal Data:

How to exercise your rights. You can request a copy of your data using the "Request my data" action in the in-app Settings, which opens a pre-addressed email to our privacy contact; email us directly at luca@orlyn.ai; and delete your account at any time using in-app account deletion (see Section 8). Please include enough information for us to verify your identity (such as your account email address). We will respond within one (1) month under the GDPR and UK GDPR, extendable by two (2) further months for complex or numerous requests. We do not charge a fee unless a request is manifestly unfounded or excessive, and you may appeal a refusal in accordance with applicable law.

10. US State Privacy Rights

This Section applies to Users who are residents of US states with applicable privacy laws. We do not sell Personal Data, and we do not sell sensitive or consumer health data.

10.1 California (CCPA/CPRA)

California residents have the right to know/access, delete, and correct Personal Information, to opt out of the sale or sharing of Personal Information, to limit the use and disclosure of Sensitive Personal Information, and to non-discrimination for exercising these rights.

10.2 Virginia, Colorado, Connecticut, Texas, Oregon, Montana, and Other States

Residents of Virginia, Colorado, Connecticut, Texas, Oregon, Montana, and other states with comprehensive privacy laws have the rights to access, correct, delete, and obtain a portable copy of their Personal Data, and to opt out of the sale of Personal Data, targeted advertising, and certain profiling. Because health data is "sensitive data" under these laws, we process it only with your opt-in consent, which you may revoke as easily as you gave it.

10.3 Washington and Other Consumer-Health-Data States

If you are a Washington resident (or a resident of another state with a consumer-health-data law, such as Nevada, Connecticut, or Colorado), your sobriety, craving, mood, AUDIT-C, reflection, and Coach data are "consumer health data." Your consumer-health-data rights, the categories we collect, our sources and purposes, the categories of third parties and the specific affiliates and processors with whom we share consumer health data (including DeepSeek), and how to exercise your rights, are set out in our separate Washington Consumer Health Data Privacy Policy, available at orlyn.ai/consumer-health-data. That standalone policy governs consumer health data and is incorporated here by reference. We do not engage in geofencing around health-care facilities.

11. Canada (PIPEDA, Québec Law 25, and CASL)

For Users in Canada, we handle Personal Data in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws, including Québec's Law 25 and the Canadian Anti-Spam Legislation (CASL).

12. We Are Not a HIPAA Covered Entity

Orlyn is a direct-to-consumer wellness application. We are not a "covered entity" or "business associate" under the US Health Insurance Portability and Accountability Act (HIPAA), and HIPAA does not apply to the Service. Instead, our handling of health-related information is subject to the Federal Trade Commission Act (including the FTC's prohibition on unfair or deceptive practices and the FTC Health Breach Notification Rule) and to state consumer-health-data laws such as the Washington My Health My Data Act. This means your health-related information is not protected by HIPAA, but it is protected by the commitments in this Privacy Policy and by those laws.

13. Data Security

We implement appropriate technical and organisational measures to protect Personal Data against unauthorised access, alteration, disclosure, or destruction.

Technical measures: encryption in transit (TLS); encryption of data at rest; salted hashing of authentication secrets; least-privilege access controls; secure development practices; and ongoing monitoring.

Organisational measures: access limited to authorised personnel on a need-to-know basis; confidentiality undertakings; documented incident-response procedures; periodic review of security practices; and data minimisation.

Breach notification. In the event of a Personal Data breach that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within seventy-two (72) hours where required by Article 33 GDPR, and affected Users without undue delay where required by Article 34 GDPR. Where the FTC Health Breach Notification Rule, Québec Law 25, or a US state breach law applies, we will provide the notifications those laws require within the time they prescribe.

No method of transmission over the Internet or electronic storage is completely secure; while we work to protect your Personal Data, we cannot guarantee absolute security.

14. Age — The Service Is for Adults (18+) and Not for Children

The Service is intended only for individuals aged 18 or older. We do not knowingly collect Personal Data from anyone under 18 years of age. If you are under 18, you must not use the Service or provide us with any Personal Data.

If you are a parent or guardian and believe a person under 18 has provided us with Personal Data, please contact us at luca@orlyn.ai. If we learn that we have collected Personal Data from a person under 18, we will promptly delete it and terminate the account. In the United States we comply with the Children's Online Privacy Protection Act (COPPA); in the EU and UK we apply the GDPR and UK GDPR provisions on children's data. Because the Service is offered only to adults, the question of digital consent under Article 8 GDPR does not arise.

15. Cookies, SDKs, and Tracking Technologies

Website. On orlyn.ai, only strictly necessary cookies are used by default. Non-essential technologies — PostHog product analytics (hosted on its EU instance) and, if enabled, the Meta Pixel and TikTok Pixel for advertising attribution — are governed by a regional consent model. Where opt-in consent is required (including the EEA, the United Kingdom, and Switzerland), they are loaded only with your prior consent, collected through a consent banner where you can accept or reject non-essential categories (rejecting is as easy as accepting, and no boxes are pre-ticked); for Users in Germany, this opt-in requirement reflects § 25 TDDDG (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz). In other regions, these technologies run by default and you can opt out at any time. In every region you can make, change, or withdraw your choice through the "Cookie preferences" link in the website footer, and we honour the Global Privacy Control signal as an opt-out as described in Section 10.

Mobile app. Product analytics in the app are on by default: pseudonymous usage events (see Section 3.2) are sent to PostHog's EU-hosted instance to help us understand and improve the Service. The app also includes the AppsFlyer SDK for install attribution: it measures, in pseudonymous and campaign-level form, which advertising campaign (if any) led to your installation, using Apple's privacy-preserving SKAdNetwork framework. The app does not request the App Tracking Transparency permission, does not access the advertising identifier (IDFA), and does not track you across other companies' apps or websites; no health data is ever shared with AppsFlyer or any advertising partner. You can turn analytics off at any time using the analytics toggle in Settings — it governs PostHog and AppsFlyer alike, and your choice takes effect immediately on your device. Crash and error telemetry are used to keep the Service stable as described in Section 4.

16. Automated Processing and the Sober Readiness Score

The Service computes a Sober Readiness score from inputs you provide during onboarding (such as your motivations, your AUDIT-C answers, your stated craving triggers, and whether you have tried to quit before). To give you meaningful transparency about the logic involved:

The Coach generates support responses using an AI model (DeepSeek; see Section 5); these responses are suggestions only and are not professional or medical advice. Because none of these features makes a decision about you based solely on automated processing with legal or similarly significant effect, they do not constitute automated individual decision-making within the meaning of Article 22 GDPR. If you would like a human to look at anything the Service has shown you, you can contact us at luca@orlyn.ai. Under Québec Law 25, you may request information about the automated processing and submit observations.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated Privacy Policy in the Service and on orlyn.ai, updating the "Last Updated" date, and, where we have your email address, emailing you. For material changes that affect how we process your Personal Data, we will provide reasonable advance notice — at least thirty (30) days where practicable — before the changes take effect, except where a shorter period is required by law. Your continued use of the Service after the effective date of a change constitutes acknowledgement of the updated Privacy Policy; if you do not agree, you may delete your account as described in Section 8 before the effective date.

18. Contact and Complaint Authorities

For any question or request about this Privacy Policy or our processing of your Personal Data:

Controller: Luca Diaz Hilterscheid (Einzelunternehmer)

Postal address: Märkische Heide 5, 14532 Kleinmachnow, Germany

Email: luca@orlyn.ai

You also have the right to complain to a supervisory or data-protection authority: