Privacy Policy

Overview

Raily LLC is the controller for the Service and product data. Accounts are optional. Photographs use encrypted temporary processing storage; after a photograph is deleted, Raily retains only non-identifying derived scores and a random technical identifier. Raily does not verify the depicted person's identity or maintain a mapping from that identifier to a real-world identity. TEMNIKOVA LDA independently sells and bills Credits; Stripe processes card payments. This policy explains the purposes, recipients, choices and retention that apply. A Raily device needs an account.

Information We Collect

You choose whether to create an account, upload a photograph, import a public profile, save a report, enable Matching or connect a channel. Data needed for a feature is required to provide that feature; otherwise it is optional. We handle:

• Photographs you upload (full-face and profile images) — used only for the requested analysis and deleted when processing finishes. The remaining task record contains only a random technical ID, not the photograph.
• Non-identifying derived scores and a random technical identifier. A display label, if provided or explicitly saved from an import suggestion, is arbitrary user-supplied or user-confirmed text; Raily does not verify that it corresponds to the depicted person.
• Account, wallet, purchase, subscription, support, notification and connected-channel data when you use those features; and IP, browser, user-agent and security logs needed to operate and protect the Service.
• Language and consent preferences stored in your browser, plus temporary visible profile fields, canonical URL and photo when you deliberately use the extension or public-profile import.

How We Use Your Information

We process data to perform our contract with you, pursue legitimate interests in operating and securing the Service, meet legal obligations, and rely on consent where law requires it, including optional analytics in the EEA and UK. The purposes are:

• Providing requested analyses, reports, comparisons, Matching, imports and AI explanations.
• "Almost made it" in Matching: if you nearly match someone (a score of 60–69), they may see that score and the general area where you differed — never your name, photo, city or age. The score and the reason are kept for at most 14 days.
• Operating accounts, wallets, Credits, subscriptions, support, notifications, connected channels and saved user choices.
• Preventing abuse, enforcing rate and usage limits, debugging failures and maintaining service reliability.
• Protecting users and the Service, handling moderation and incidents, complying with law, and producing aggregate product analytics.

Third-Party Processors

Depending on the feature and launch configuration, recipients include Supabase (database, authentication and storage), Raily Merlin (deep photo analysis), LLM and AI inference providers (requested explanations and moderation), real-time voice AI providers (voice conversations, as described under Raily devices and voice), Upstash (rate limiting), Google Analytics/Tag Manager (optional web analytics), Stripe and TEMNIKOVA LDA (billing), Resend (email), Apple (push notifications for the Raily Device app), TypeSafe (ranking of pre-written FAQ and chat prompts — receives selected self-brief fields, match context, used prompt IDs, and sanitized recent message excerpts), Cloudflare (delivery, public-profile browser resolution and voice conversation memory), LinkedIn (optional sign-in/import connection), Telegram (optional connected channel), and DigitalOcean (hosting). Inactive or unconfigured integrations do not receive data.

Data Storage

Our architecture is designed to minimize data persistence:

• Accounts are optional — guests use an anonymous prepaid wallet that holds Raily Credits, identified only by a random token stored in your browser. If you choose to sign in, we store your email and link your wallet to it.
• We do use a database. During processing, a photo appears there only as a separate encrypted recovery copy and is deleted when processing finishes. If a technical failure prevents deletion at that point, an automatic safety limit removes it no later than 6 hours after upload. Saved reports, your numerical profile, Matching identity, cards, connections and messages, wallet and purchase records use the retention periods listed above.
• An unsaved analysis result is also kept in your browser's sessionStorage for the tab session; the authoritative copy is the one described above.
• Your language preference is stored in your browser's localStorage and can be cleared at any time.

Data Retention

All data has strict, minimal retention periods:

• Photographs: deleted when processing completes or finally fails, or on account deletion. If a technical failure prevents normal deletion, an automatic safety limit removes the encrypted recovery copy no later than 6 hours after upload. The remaining task record contains only a random technical ID. Backup/WAL remnants follow the database provider's bounded retention. Non-identifying derived scores are normally kept for 30 days unless you save the report or enable Matching. A Matching avatar you deliberately enable is separate derived imagery, stored until you turn it off; display stops immediately and file deletion follows the documented purge process.
• Analysis results: your own report is kept until you delete it or your account, provided you signed in within 24 hours of the analysis. A report about another person, or one made without signing in, is deleted after 24 hours unless you save it. A report you explicitly save is kept until you delete it or delete your account.
• Rate limit counters: Automatically expire after ~25 hours.
• Task metadata: Purged after 24 hours or when the task queue exceeds 100 entries.

Cookies and Tracking

Necessary browser storage supports language, session, wallet and security functions. Google Tag Manager and Google Analytics 4 may collect pseudonymous page, feature and conversion events; we do not send names, email addresses, message content, photos or analysis results to Google. In the EEA and UK, these analytics remain off until you accept them; you can reject or later withdraw through the privacy settings. We do not use advertising trackers. Our first-party product journal records bounded product events tied to wallet and session identifiers, never free text, message content or photos; identifiers are removed after 14 months and on account deletion, while aggregate counts may remain.

Chrome Extension (Raily AI - Send Profile)

The optional Raily AI Chrome extension is a capture client for your own Raily account. It does not create a separate product or advertising surface.

• What it may collect: the visible name, visible heading, canonical profile URL, and one profile photo from the single profile page you open — or one photo you choose via the panel file picker, a file drop, or a URI drop. A dropped file's filename (without extension) is sent as the display name for that photo-only import.
• When transfer happens: only after you click the extension icon or in-page action, review the local preview, confirm you have permission and that the person is over 18, and approve the one-time upload in your Raily account.
• Where data goes: only to your own Raily account on this website for a private insight. We do not sell the data, use it for advertising, or use it for purposes unrelated to that private analysis.
• What it never accesses: LinkedIn cookies, access tokens, passwords, messages, connections, posts, search history, full-page content, or any page data beyond the fields listed above (or the single photo you drag in).
• Retention: the pending local snapshot is cleared on cancel, after upload, or the next time the extension hydrates pending state after ten minutes of idle time (there is no separate expiry alarm). A server-side imported photo is deleted when processing finishes; if a technical failure prevents normal deletion, the same automatic 6-hour safety limit applies to its encrypted recovery copy.
• The extension is not affiliated with or endorsed by LinkedIn or any other third-party social network.

Raily devices and voice

"Device" here means any Raily hardware used with the Raily Device app: Raily Keyring with a screen, Raily Keyring without a screen, Raily Keyring mini, and Raily Pin (a future product, not currently for sale). A Raily device is an optional physical button. A press tells your Raily agent that you are open to meeting someone nearby right now. This section explains what a device, the app and our servers handle, and how voice conversations with your agent work on every Raily surface.

• Account: unlike the rest of the Service, a Raily device works only with a signed-in Raily account.
• The device itself: on a press it sends your phone only a press counter, the time since the device was switched on, and the kind of press. It has no GPS; some devices' boards have a microphone and a motion sensor, but the device's software does not use them today. Its device ID comes from its chip, and phones within Bluetooth range can read that ID and the firmware version without pairing. The time since power-on stays on your phone.
• Location: the app reads your phone's location only at the moment of a press, for up to 10 seconds, including when the app is in the background; it does not track your location between presses. So that a press from your pocket still gets a location, iOS shows its location indicator while a device is linked and location access is allowed. A press sends one location fix, accepted only if it is no more than 60 seconds old and accurate to 100 metres or better, together with the press counter, device ID, press time and the firmware and app versions. Our servers never store the exact coordinates: they turn them into an area of about 150 metres and keep only that area and its accuracy. A press that cannot be sent right away waits on your phone, exact coordinates included, until it is sent or pushed out by newer presses (the queue normally holds 10); one that has expired is normally deleted the next time the app processes its queue.
• Nearby matching: after a press, your area counts as your current presence for 1 hour. We look for people within about 500 metres who pressed their own device during the last hour and use them only to narrow the pool of Raily matches you can be shown.
• What other people see: you see nearby matches, and they may see you, as an anonymous match — a nickname, match score and band, the main intent, and your Matching avatar only if you turned it on and your privacy settings allow it. If you are already connected, or you have already crossed paths in Matching and your Matching privacy is open, they see what Matching shows them: your first name, your last name if you chose to show it, your city and, if you turned it on, your avatar. Exact location and distance are never shown. Appearing on someone's list does reveal that you were within about 500 metres during the last hour. A person on your list may get a "press again" notice that names nobody. Otherwise your name is shown to someone only when you send them a first message; contact details and an ongoing chat open only after both of you accept each other through Matching.
• With a screen: the app sends the device only what its screen shows: your agent's state (for example on watch or paused), the number of new people and of people looking at you, the kind and number of unseen notifications, your mascot's shape and material, the app's language, whether the voice agent is speaking, a signal to light the screen up for a new notification unless you turned that off, your screen settings (modest mode, screen off), and a quiet-hours signal while your quiet hours are on, so the screen never lights up by itself. The app keeps the screen settings on your phone. Your quiet hours (start, end and time zone) are kept in your Raily account, so the device, the app's alerts and your agent follow the same ones; during them the app's alerts arrive without sound. The screen never shows names, photos, message text, places or distances. The device keeps this only in memory and clears your agent's state, the counts and the notifications after 30 minutes without an update; only your mascot's look is stored on the device so it survives a restart, and it is erased when the device is unlinked.
• Box code: if your device came with a box code, it proves that you hold that device. We store only a one-way hash of its secret, the device ID, and which account claimed it and when. This claim record stays after you unbind the device, so the box code keeps working only for your account. When you delete your account, the record stops naming you but keeps the device ID, the hash and its dates, and whoever holds the box code can claim the device again.
• Device secret: your device makes a random secret and gives it to Raily only locked (sealed) to a key that exists only on our servers. We use it to confirm commands to your device — a restart or a firmware update — and to let a device you unbind be set up by its next owner. We keep it in that locked form with the device ID and no account. After you unbind the device or delete your account it stays, naming no one, until the device's next owner sets it up or for at most 30 days, whichever comes first.
• Bluetooth, camera and notifications: the app scans for nearby Bluetooth devices to find yours; other devices it detects nearby are only counted on the phone and are never uploaded. If a firmware update has to be recovered, the app may note the phone-local identifier of a nearby device in update mode in a diagnostic log that stays on your phone. The camera is used only to scan the box code. "Press again" alerts are created on your phone and can also come as a push notification, described next. To check for device firmware updates the app contacts Raily while you are signed in and downloads updates from Raily.
• Push notifications: if you allow notifications for the Raily Device app and keep its Notifications setting on, the app sends Raily its Apple push token, a random ID for this installation, the app's language and whether it is a test or an App Store build. When someone's press nearby finds you, we ask Apple's push service to show "Someone found you nearby" on your phone and to wake the app so it can signal your device. The notification never says who pressed or where. We keep the token until you turn the setting off, sign out or delete your account, or Apple reports that it no longer works.
• Crash reports: when the app crashes or freezes, Apple's on-device diagnostics give the app a technical report (code locations, app and iOS versions, iPhone model, error type). The app sends it to Raily unless you turn off "Send crash reports" on the app's Get help screen. We remove everything outside a fixed list of technical fields. Crash records have no account field, but if you were signed in the report also opens a support ticket on your account so that we can help. Reports are deleted after 90 days, and a grouped summary 180 days after the last matching crash.
• Voice conversations (Raily Device app, website and Mac app): when you talk to your agent, your microphone audio streams directly from your phone or computer to one of our real-time voice AI providers under a short-lived access key that Raily issues for your account. The provider receives your voice and the account context your agent needs to answer. These providers may process voice data outside the EEA, including in the United States; the current list is available on request at [email protected]. On the website and Mac app, each finished spoken turn is also sent as text, with contact details removed, to TypeSafe to decide what your agent should do next. Raily does not store the audio. The final text of each turn is kept as short-term memory, stored with Cloudflare, and deleted within 7 days. If you delete your account, it is deleted as part of that deletion, before the deletion completes.
• Kit emails: on devices.railyai.com/build you can leave an email to get the Raily Keyring build kit links. We store the address and when we last sent the links. If you tick the box, we also store that you agreed to hear when new parts of the kit are ready, when you agreed and the wording you saw. This list is separate from Raily accounts; we send its emails through Resend. Every kit email has a one-click unsubscribe, and unsubscribing deletes your address; we keep only a one-way hash of it so the opt-out holds if someone types it in again; we keep that hash until you ask us to delete it. Addresses without that agreement are deleted 30 days after the last links email; addresses with it stay until you unsubscribe.
• Keyring Air early access: on devices.railyai.com you can leave an email to hear when Keyring Air early-adopter spots open. We store the address, the version of the form wording you agreed to, when you joined and when we last emailed you. We use it only for emails about Keyring Air early access. This list is separate from Raily accounts and from the kit list; we send its emails through Resend. Every email has a one-click unsubscribe, and unsubscribing deletes your address; we keep only a one-way hash of it so the opt-out holds if someone types it in again; we keep that hash until you ask us to delete it. Addresses stay until you unsubscribe, and no longer than 12 months after you joined.
• Partner enquiries: the contact form on devices.railyai.com/contact stores your name, your company if you give one, your email and your message, and we use them only to answer your enquiry. We do not add your address to any mailing list. The form is separate from Raily accounts; each enquiry is emailed to us through Resend. Enquiries are kept no longer than 12 months after they arrive.
• Retention: presence (the area used to find people nearby) is deleted after 1 hour. Presses and their area of about 150 metres are kept for 24 hours; only the device's owner sees them, on the press map in the app, and unbinding the device or deleting the account deletes them sooner; the scan's working copy is deleted as soon as the scan succeeds, or within 1 hour if it fails, and candidate lists and "press again" notices are deleted with the press.
• Your choices: unbinding the device deletes its device record, your presses and presence, your place on other people's candidate lists, and "press again" notices. Deleting your account deletes all other device data; only the box-code record and the sealed device secret described above remain, without your account, and crash reports, which carry no account, follow their own retention. Firmware-update recovery data and its diagnostic log stay on your phone until you delete the app. Turning the app's Notifications setting off or signing out deletes its push token. The account data download includes your device and its presses (area, accuracy, firmware and app versions), and which installations get push notifications (installation ID, build type, language and dates). You can turn off location, Bluetooth, camera or microphone access in iPhone Settings; a device cannot work without location and Bluetooth.

Your Rights (GDPR / CCPA)

Regardless of your jurisdiction, we extend the following rights to all users:

• Right to access — request a copy of any data we hold about you.
• Right to deletion — ask us to delete eligible account, report, Matching, message and connected-channel data. Photos are deleted when processing finishes or on account deletion; if a technical failure prevents normal deletion, an automatic safety limit removes the encrypted recovery copy no later than 6 hours after upload. Financial records for Raily Credits and security records may be retained where law or dispute handling requires it; bounded backups expire on the provider schedule.
• Right to correction — ask us to correct account information or a saved display label. Re-running a model is available but is not a substitute for correcting account data.
• Right to access and portability — request a copy of data associated with your account or wallet in a commonly usable format where applicable.
• Right to object, restrict or withdraw consent — ask us to assess an objection or restriction request and withdraw optional analytics consent without affecting earlier lawful processing.

Contact [email protected]. We may request information reasonably necessary to locate the account or wallet and verify that the request comes from the authorised account holder. You may also complain to the QFC Data Protection Office and, where applicable, your local data protection authority.

Children's Privacy

The Service is not directed at individuals under the age of 18 (or the age of majority in your jurisdiction). We do not knowingly collect data from children. If you believe a child has submitted personal data through the Service, contact us at [email protected] and we will take appropriate steps to address the matter.

International Data Transfers

The Service is operated from Qatar and providers may process data in other countries, including the United States. Where transfer restrictions apply, we use the applicable provider terms, contractual safeguards or other lawful transfer mechanism and assess them for the relevant entity and region. Contact [email protected] to request information about safeguards relevant to your data.

Changes to This Policy

We may update this Policy prospectively and will publish the revised version and effective date. We will provide reasonable notice of material changes and request renewed acceptance where applicable. Continued use alone will not replace consent or acceptance where law requires an affirmative choice.

Contact Us

For any privacy-related questions, data subject requests, or concerns, please contact us at:

Raily LLC

Al Shoumoukh Towers, 10th Floor, Tower B, Al Sadd, Doha, Qatar

Email: [email protected]