Privacy for Decision Room on Android

Your account, profile and decisions

We store your email address, account ID and display name. A password is stored as a scrypt hash, never as readable text. If you use Sign in with Apple, we store the link to your Apple account and encrypted information needed to revoke that sign-in.

We store your profile choices, including role, experience, industries, focus areas, timezone and language. Case sessions contain your choices, confidence, marked evidence, information requests, reflections and lessons. Scores, insights and practice patterns are derived from this information.

We use this information to operate your account, show and sync your decisions, adapt practice and protect the service. Product events about screens and features used are recorded on our server with an account ID to understand and improve the product. Sign-in sessions use hashed tokens and technical session information.

AI on your phone and in the cloud

From version 0.31, the app automatically chooses between your phone’s AI and our cloud service when you start Deepen with AI, Compare your decisions or Help me explore my reason. Locking a decision, reading evidence or changing screens does not start a new AI analysis.

For a new request, the app uses Gemini Nano through Google ML Kit and AICore when the phone supports the feature, the system model is already ready and the app is in the foreground. Version 0.31 does not use Qwen or start a model download.

If the phone’s AI is unavailable, busy, takes too long or returns a response that fails the app’s language and content checks, the request may continue in the cloud. This can also happen if you leave the app during local analysis. The input may then be sent to OpenAI as described below, even if the request started on the phone. Cloud features require internet.

When the phone’s system model is used, AI input and output are processed on the phone. Google’s SDK diagnostics are described below. Saved AI deepenings and comparisons are encrypted on the device, tied to your account and service, and excluded from Android backup. Saved responses are reused; an existing server analysis can be retrieved or followed without starting a new one. Cases and ordinary results work without AI.

AI deepening through our server

When cloud AI is used for deepening, your final decision must be locked. The feature does not change your score.

Our server checks the account and locked decision. It sends your final choice, applicable selected reasons and risks, and a bounded selection of the blind case material you opened or requested to OpenAI. The AI request excludes your name, email, account ID, session ID, private notes, scores and historical outcomes.

The AI response and technical operation status are saved on our server, linked to your account and decision. An accepted review is also saved encrypted on your phone. Stopping observation or closing the app does not guarantee cancellation of a server request already underway. You can reopen a saved result without starting a new analysis.

We use the OpenAI API with response storage disabled (store=false). This does not mean zero retention: OpenAI may process prompts and responses in security and abuse-monitoring logs, normally for up to 30 days and longer when required by law or protection against harm. Provider prompt caching may also retain temporary state. See the OpenAI data controls linked below.

Help reasoning before your decision

You can tap Help me explore my reason before locking your decision. From version 0.31, the choice between the phone’s AI and the cloud described above also applies here. When the cloud is used, our server sends your preliminary choice, optional writing of up to 600 characters and a limited selection of blind case material you have opened to OpenAI. Account details are not added to the input, but if your own writing contains names, email addresses or other personal data, those are sent too.

The help selects one of the app's existing reflection questions and, when such evidence is available, an existing excerpt to compare with your writing or choice. It does not grade you or change your score. Writing text, reading evidence or changing screens does not start this AI request.

Your writing and the prompt are not saved in our database. When the cloud is used, we store technical status, a hashed request fingerprint and selected reference IDs linked to the account and case session. These operation records are removed on account deletion. OpenAI's prompt and response retention, including security logs and temporary caching described above, also applies to the writing you send here. Cloud deepening, reasoning help and decision comparisons share the same spending and request limits.

Compare your decisions

From version 0.31, you can select 3 to 5 completed cases and start an AI comparison yourself. The same choice between the phone’s AI and the cloud applies here. The comparison concerns recorded choices and does not change your scores.

When the cloud is used, the app sends references to the selected case sessions and the language to our server. The server checks that the sessions belong to your account and that the decisions are locked and completed. It compares different cases; replays and multiple versions of the same case are not included together.

OpenAI receives the blind case titles, authored option text for your first and final choices, your final self-reported confidence, whether the choice changed, and selected reasons and risks. When a final choice differs from the first choice, the initial reasons and risks are not carried forward as support for the new choice. Long text may be shortened. Names, email addresses, account and session IDs, your own writing, private notes, scores, company identities and historical outcomes are excluded from the AI input.

The server stores the comparison’s AI response and technical operation details, including references to the selected sessions, language and a hashed request fingerprint, linked to your account. An accepted response is also saved encrypted on the phone. The same selection of cases and language reuses the existing server request. OpenAI’s retention described in the deepening section also applies here.

Google ML Kit and diagnostics

The app also includes Google's ML Kit/AICore support for AI on compatible Android devices. Google states that ML Kit does not send prompt contents or generated responses to its servers. The SDK may send diagnostics and usage metrics to Google: device and app information, user, device or installation identifiers, configured or identified languages, performance, input and output sizes, event types and error codes.

Google uses these metrics to operate, debug and improve its APIs and prevent misuse. The phone’s AI can therefore send technical diagnostics to Google while processing the input and AI response locally.

Older app versions with Qwen

Some older Android versions offer a separate Qwen model of about 2.75 GB that you download yourself from Hugging Face and its HTTPS infrastructure. Those servers receive technical connection information, such as an IP address, to deliver the file. The download does not send account tokens, case answers or AI prompts. The public model file contains no account information. This applies to older app versions; version 0.31 does not use Qwen.

In version 0.21, cloud deepening may start automatically when you lock your final decision, while you read the result. From version 0.22, it starts only when you tap Deepen with AI. Older 0.21 clients may continue to start automatically until the app is updated.

Hosting and other recipients

Vercel operates the web and application servers. Neon provides the PostgreSQL database. These providers process information to operate the service. Apple handles authentication if you choose Sign in with Apple. Google processes the technical diagnostics described above. In older versions with Qwen, Hugging Face also processes technical information for the model download. OpenAI processes inputs and responses for the cloud features you use. Network traffic uses HTTPS.

The app contains no advertising. Google Play handles payments; we process purchase references and status to verify and restore access. We do not receive full card or bank details. We do not sell personal data or share it for marketing. The app does not request access to location, contacts, camera, photos or health data. Comparisons between users use anonymous aggregates with a minimum group size; your reasoning is not shown to other users.

Subscriptions

Five complete cases are free with no time limit or payment details. An optional monthly or annual Google Play subscription gives access to the full case library and new cases while subscribed. Payment is charged on confirmation and renews automatically at the displayed price until canceled. Cancel in Google Play before renewal; access continues until the paid period ends. Saved results remain available afterwards. AI features retain their displayed limits; unlimited cloud AI is not promised.

We store the store, product, purchase reference, hashed original buyer binding, status, subscription period, renewal status, expiry dates, timestamps and the link to your Decision Room account. Google Play tokens are encrypted at rest. Account deletion removes the token and account link. Minimal purchase evidence may remain without a link to an active account while restoration is supported, for restoration and duplicate-claim prevention. Google separately retains its payment records. Account deletion does not cancel your subscription or request a refund. Manage your subscription in the store account before deletion.

Retention and deletion

Account, profile, case answers and associated results are kept while the account exists. Account deletion removes them from the service's active database and revokes linked Apple grants. Public cases authored by an administrator may remain with their author link removed. Historical product events may retain counts after the link to the account is removed. Daily cost and request records may retain amounts, counts and a hashed account reference to enforce spending limits; they contain no decisions or AI responses.

Technical provider logs, backups and Google's SDK diagnostics follow the relevant provider's retention practices. Contact us if you need information about retention or a request concerning those systems.

Uninstalling the app removes its local data and any Qwen file from an older app version but does not delete the server account. When deletion is requested outside the app, local copies may remain on an offline device; uninstall the app or clear its app data to remove those copies too.

Your rights

You may request access, correction, export or deletion of your personal data and object to processing by contacting us. We verify that requests concern your own account. Never send passwords or sign-in codes. You may also contact the Swedish Authority for Privacy Protection with a complaint.