Policy Draft

Privacy Policy Draft

Rendered from the repo policy source as a real command-center page. Draft for review, not legal advice.

NyrA Swarm Little Buddy Privacy Policy Draft

Status: Draft for attorney review

Last updated: 2026-05-31

Scope: NyrA Swarm Little Buddy desktop app only

This draft is not legal advice. It is a working publication draft that should be reviewed after the business name, legal entity, domain, support inbox, pricing, hosted AI cap, and final provider stack are confirmed.

Plain-English Summary

NyrA is a Windows desktop companion that can use your microphone, camera, screen, local memory, third-party AI providers, and visible computer-control actions only after you grant the relevant permissions in the app.

NyrA should not be marketed as local-only, always-listening to everything, unrestricted computer control, voice identity recognition, or biometric learning. The app is designed around explicit consent, visible controls, local export/delete controls, paid-license checks, and high-impact action approval gates.

Data We Collect Or Process

NyrA may collect or process these categories, depending on your settings and use:

How We Use Data

NyrA uses data to:

Local Storage

NyrA stores app settings, license cache, consent settings, local memory, and logs on the user's device. Local memory and passive context logs should be optional, reversible, exportable, and deletable from the app.

The current implementation includes:

Third-Party Providers

NyrA may send user prompts, voice transcriptions, screen/camera frames, and task context to third-party AI providers only when the relevant feature and third-party AI consent are enabled.

Current or planned providers include:

Provider data use and retention are governed by the provider's terms and data policies. NyrA should disclose provider links on the public website before paid beta.

The working provider-data map is maintained in AI_PROVIDER_DATA_FLOW_DRAFT.md. That file should be refreshed before publication because provider policies change, and the public policy must match the actual provider stack shipped in the app.

OpenAI Data Controls

The app should default OpenAI Responses API calls to store:false unless the user or business explicitly enables storage for a documented reason. OpenAI's current API data controls state that API endpoint data is not used for training by default, and that abuse monitoring and endpoint retention vary by endpoint.

Billing And Payments

Payments are processed through Stripe. NyrA should not store full credit card numbers, bank account numbers, card security codes, or raw Stripe secret keys in the desktop app or command-center files.

Customers should be able to manage billing, invoices, payment methods, and cancellation through Stripe Customer Portal once the live Stripe integration is deployed.

Choices And Controls

Users should be able to:

Retention Draft

This retention schedule must be reviewed before publication:

Data type Draft retention
Local settings and consent Until changed, reset, or uninstalled
Local memory and passive logs Until deleted by the user or reset by the app
Local license cache Until logout, uninstall, reset, expiration, or replacement
Billing/customer records As required for subscription, tax, accounting, dispute, and legal obligations
Support emails/files As long as needed to resolve support and maintain business records
Cloud command-center uploads Until deleted by the owner or no longer needed for launch operations
AI provider content According to the relevant provider terms and retention controls

Children

NyrA is not intended for children under 13. The product should not knowingly collect personal information from children. If the app is later marketed to minors, the children's privacy policy and consent process must be redesigned before launch.

Biometric And Voice Identity Position

NyrA should not claim biometric voice recognition, voice identity authentication, or voiceprint learning unless a separate explicit enrollment, consent, accuracy, retention, and deletion process is implemented and legally reviewed. Current voice features should be described as voice input, transcription, realtime conversation, and context handling, not identity recognition.

Security

NyrA uses consent gates, paid-feature gates, typed IPC, high-impact action approval, and local export/delete controls. The security policy should also document vulnerability reporting, support triage, dependency updates, signing, and incident response.

Breach And Incident Response

If personal information is compromised, NyrA should investigate, contain the incident, document the scope, notify affected users when legally required, and follow applicable state and federal requirements. South Carolina breach notification rules may apply if personal identifying information of South Carolina residents is involved.

Contact

Support email: nyrasupport@gmail.com pending user creation/confirmation.

Do not publish this policy until:

Source References