Privacy notice

Difficult Conversations at Work · YSAMPHY LLC
Effective November 4, 2026

Meta User ID: what we collect, store and use

YSAMPHY LLC collects and stores your app-scoped Meta User ID (USER_ID) when you connect your Meta account in Difficult Conversations at Work. This identifier is personal data. It is associated with your account in this app; it is not your email address or password.

Data collected from Meta: your app-scoped User ID, the app ID, and a temporary identity-proof nonce. The Quest app also processes the result of Meta's SDK app-entitlement check. When purchase or recovery features are used, we process product/SKU and purchase/order identifiers, ownership/consumption results and refund or chargeback information. Public checkout and paid-session use are currently off; restricted Meta test transactions still create records.
Why we use the User ID: to verify the signed-in identity, create and restore the same learner account, associate free and purchased session allowances with that account, prevent duplicate free allowances or duplicate purchase credit, link an optional web companion and handle account support/deletion. The app does not use it for advertising or include it in AI prompts.
Where it is stored and who processes it: the User ID and app ID are stored with an internal account ID, account links and session records in our Cloudflare-hosted backend. Cloudflare processes these records on our behalf. We send the User ID and temporary proof to Meta's server API to validate identity. The nonce is processed transiently and is not intentionally persisted or logged by our application. The Meta User ID is not sent to OpenAI; OpenAI receives practice audio, text and coaching requests as described below.
Retention: the stored User ID and account links remain until an account-deletion request is fulfilled. For accounts without transaction records, fulfillment removes these identity links and other account records described below. We no longer retain an identity-derived free-trial marker after account erasure. A later sign-in can create a new account and free allowance because the erased trial history is no longer available. Recovery backups can retain deleted records for up to 30 further days. Financial records require the separate retention review described under Purchases and refunds.

How to request deletion of your Meta User ID and app data

All users, regardless of where they live, may request deletion of their personal data at any time. We do not charge a fee for requesting or fulfilling deletion. You do not need to give a reason for your request. We may verify that the request concerns your account before acting. Any applicable retention limits are explained below.

On Quest, open Account & sessions → Web linking & privacy → Request account deletion and confirm. On web, use Account access and privacy → Request account deletion. You can also email support@ysamphy.com with the subject “Delete my Difficult Conversations at Work data,” including your app account support ID or deletion-request reference if available. Email is available even if you cannot sign in. Do not send your Meta password, access token or sensitive conversation details.

We verify ownership before acting, pause new practice when an in-app request is confirmed, and handle deletion without undue delay. We keep you informed of progress and any outstanding provider or legally required retention. A request is not immediate erasure or a refund. We explain any records retained and why. Removing device access only disconnects a device; it does not delete your Meta User ID or account. Full scope, financial-record limits and local-file controls are described below.

What the app processes

The app processes microphone audio, typed responses where available, conversation transcripts, and AI feedback to provide workplace roleplay and coaching. Alex is an AI character. Use fictional examples and avoid confidential workplace information or other people's personal information.

Where the data goes

Quest audio passes through our Cloudflare-hosted service to OpenAI. Browser voice uses a connection to OpenAI established by our service. Transcripts are sent through our service to OpenAI when you request feedback. Cloudflare provides hosting, connection coordination, and operational diagnostics. Meta separately processes information associated with its headset and distribution services under its own policies.

Storage and retention

Our application backend does not intentionally persist audio, transcripts, or coaching content. These are processed in memory. To avoid generating the same result repeatedly, validated feedback and generated narration may be reused privately within the same device and learning session. Backend reuse expires after 15 minutes and is cleared for linked account devices when an in-app deletion request is accepted; it may also end sooner on restart or memory eviction; it is not written to persistent storage. Browser narration can remain in page memory until a new practice, replacement feedback, or page closure. A successful deletion request in the web companion clears that page's conversation, feedback and generated narration; other open companion tabs in the same browser are also notified where browser storage is available. Close other running app instances to clear their local runtime content. Quest clears the current transcript, feedback, retry content and generated summary audio when leaving practice. Account refresh clears these when it detects a pending deletion request; the web companion also stops practice and clears its current content when account refresh detects the request. Offline or suspended instances cannot receive that update until they reconnect; close them to clear runtime content. If you download a web reflection, that file stays on your device until you delete it.

We store hashed device credentials and expiry times for access control, temporary pairing records, session identifiers for cleanup, and aggregate usage counters. Pairing codes are valid for 10 minutes and are consumed when access is granted; expired records are removed by cleanup. Device credentials expire after 30 days and expired records are cleaned automatically. Connection leases are removed at session closure or expiry; account allowance records follow the retention described below. Aggregate counters roll over daily when used. Cloudflare recovery backups can retain deleted storage records for up to 30 days.

Operational systems may process IP addresses, request paths, timestamps, connection/error information and technical logs. We do not deliberately include conversation content or access credentials in application logs. Infrastructure and provider retention may differ from the app's in-memory processing.

OpenAI's API data controls apply separately. Its published default includes abuse-monitoring retention of up to 30 days, with exceptions described in its policy. We do not claim Zero Data Retention. Coaching requests set store:false to disable stored Responses application state; this does not disable abuse-monitoring retention. See OpenAI API data controls.

Your controls and deletion requests

In Quest, the microphone records while you hold the talk control; release submits the turn, and opening the menu stops the session. In the browser, use mute or end to stop microphone transmission. You can deny or revoke microphone permission in your device/browser settings.

Quest Settings → Remove device access removes the local credential and requests server revocation. If offline, server access expires automatically after 30 days. Remove downloaded reflection files yourself. For access, correction, or deletion requests, contact support@ysamphy.com and identify your app account or deletion request without emailing passwords, access tokens, or sensitive conversation content. We will explain what records we can locate and any applicable retention constraints.

Service-provider processing

OpenAI provides AI responses and speech; Cloudflare hosts our service and account storage. Their published processing terms describe processing on customer instructions and assistance with data-subject requests: OpenAI Data Processing Addendum and Cloudflare Data Processing Addendum. Contact support@ysamphy.com to request deletion or ask about a provider-retention constraint. We do not promise that deleting an app account instantly erases every provider-held copy.

Spoken coach

Rowan is an AI coach, separate from Alex. Authored lesson audio is pre-generated and can play without microphone access. Live opening rehearsal sends audio or typed responses to OpenAI, like roleplay. If you choose to hear a coaching summary, its text is sent through our service to OpenAI for speech generation. Our backend does not intentionally persist this speech or its text. Provider retention still applies. Reading the lessons and feedback remains available.

Preparation cards

On web, card edits remain in the current page unless you choose Save card in this browser or download. Clear saved card removes browser storage; delete downloaded files separately. Quest stores only your chosen draft-wording indices in local settings. Cards do not sync between devices and are not sent with conversation or coaching requests.

Purpose and audience

This app is intended for adult workplace practice. It does not provide a validated assessment or make employment decisions. The app does not include advertising or sell conversation content. Do not submit children's information. Contact us if you believe inappropriate personal information has been provided.

Usage and cost records

Usage records expire after 30 days and are removed by scheduled cleanup. They include random session identifiers, timestamps, development/user labels, model names, token counts, audio duration estimates, request outcomes and estimated API costs to monitor operating costs. These records exclude conversation text, audio and access credentials. Browser usage reports may be incomplete; estimates are reconciled separately with provider billing. Cloudflare recovery backups may retain deleted records for up to 30 further days.

Accounts and session allowances

We store a random account ID, an optional administrator-supplied tester label, device-to-account links, session balances, complimentary grants, and allowance reservation/use/restoration records. These records contain no conversation content. Account and allowance records remain for the life of the account until a deletion request is fulfilled; recovery backups may retain deleted records for up to 30 days. Connection-attempt records expire after 24 hours. Removing device access does not delete the account or reset its free allowance. Browser access is tab-only by default, or saved in local storage if you choose Remember this browser; Quest credentials remain in device settings. Normal Quest sign-in and Quest-to-web linking do not require administrator approval. A legacy administrator-approved pilot pairing service also remains available for existing testers. Public checkout is disabled; limited Meta test-account checkout is described below. We do not collect payment-card information.

Meta accounts and web companion

The Quest app checks app ownership using Meta's Platform SDK before requesting your User ID and identity proof. Our server validates the proof with Meta to create or restore your account; normal sign-in does not use the in-app-purchase API to check base-app ownership. We collect and store the User ID as explained above. We do not request your friends list or social profile. A one-use code from a verified Quest account can link a browser to the same account. Codes expire after 10 minutes and are stored as hashes. Do not share a code with anyone. Companion access does not authorize Meta purchases or paid Quest sessions on web. Access to the unreleased Quest app depends on its Meta release-channel entitlement and approved platform-feature access.

Purchases and refunds

Public checkout and paid-session use are currently disabled. A specifically authorized Meta test account can access test checkout using Meta test cards. Test transactions also create purchase and balance records. The server integration can process Meta user IDs, product and purchase/order identifiers, purchase verification and consumption results, refund/chargeback notifications, reconciliation records and session balances. Meta handles checkout and payment-card details; we do not collect payment-card information. These records support purchase verification, duplicate-credit prevention, session delivery and investigation of purchase or refund problems. Transaction and reconciliation records remain while needed to operate the account. On a verified deletion request, an operator reviews the current financial inventory. Records are erased unless specific minimum financial fields must be retained under a documented legal requirement. Any such exception is separated from the active account, restricted to administrative access, assigned an explicit expiry and automatically removed after that expiry. The requester receives the reason and retention period. Uncertain store-consumption results must be reconciled before fulfillment; they are not treated as an indefinite retention exception. A financial-record retention schedule and remaining purchase/refund validation must be completed before public checkout is enabled.

Request account deletion

In Quest, open Account & sessions → Web linking & privacy → Request account deletion. On web, use Account access and privacy → Request account deletion. Confirming submits a request reference, pauses new practice and asks our service to close active sessions. It does not immediately delete the account, erase files on your devices or issue a refund. We aim to respond within 30 days. Requests are reviewed by support; email support@ysamphy.com with the reference for progress, cancellation or help if you cannot sign in. Do not send passwords or access tokens.

For accounts without transaction records, our deletion tool removes linked device access, identity links, account details, balances, grants, allowance and usage records. We do not keep an identity-derived marker or deleted-account identifier solely to block future free-trial claims. Ordinary reconnection preserves the existing account and allowance; after completed erasure, a later sign-in creates a new account. Transaction-linked accounts can also be erased after a documented review, including associated purchase, order and reconciliation records. Only specifically justified minimum financial fields may be held separately until a recorded expiry; expired holds are removed by scheduled cleanup, normally within an hour. A hold is not an active account or permission to use the records for practice, marketing or free-trial tracking. Account deletion in our application is separate from deletion of your Meta platform account. For data processed on our behalf by OpenAI or Cloudflare, support coordinates applicable deletion requests with those providers, records their responses and explains any remaining retention limits; our application does not have a control that guarantees immediate erasure of provider abuse-monitoring logs or recovery backups. We do not treat local account cleanup as proof of provider deletion. Accepted requests abort in-flight backend coaching requests and discard their late results; aborting a request cannot retract data already received by a provider. Recovery backups may retain deleted storage for up to 30 days.

Removing device access only disconnects that device; it is not account deletion. Local settings, saved preparation cards and downloaded files must be cleared on each device separately. We retain a pending deletion request until it is resolved. Financial records are not automatically erased or claimed to be deleted while review is outstanding.

Remembering a browser

Web access is stored for the current tab by default. If you choose Remember this browser, its device credential is stored in this browser’s local storage so access can be restored after closing and reopening. The server still enforces credential expiry and revocation. Use this option only on a private device. Unchecking it removes persistent access but keeps the current tab connected. Disconnect this browser clears its saved credential and attempts server revocation; an offline failure is shown explicitly. This does not delete your account, change your balance, disconnect Quest or erase saved preparation cards.

Updates

We will update this notice when the app's data practices change. Contact support@ysamphy.com for questions or to report an AI response.

Return to practice · Practice guide