1. Who is responsible for your data
Hamza Iraqi Houssaini, operating Reyn from Morocco, is the controller for the personal data described in this policy. Reyn is currently operated by an individual, not an incorporated company.
Contact: support@reynflow.com. A public business address and Moroccan CNDP filing reference are not yet available and will be added before broad commercial release.
2. What this policy covers
This policy covers reynflow.com, official Reyn Studio preview builds, the YC access service, support communications, and diagnostic material you choose to submit. It does not control Cloudflare, an operating-system vendor, a download host, or another third party acting under its own policy.
3. Data Reyn processes
Website and security data
Cloudflare processes requests needed to deliver and protect the website. This can include IP address, requested URL, date and time, request headers, browser and device information, approximate location, network identifiers, security signals, and error-reporting information.
Reyn does not intentionally use advertising pixels or cross-site tracking. Cloudflare Web Analytics is disabled at the response layer. Cloudflare may still process edge analytics and Network Error Logging information for delivery, reliability, and security.
YC preview access
When the invitation-only access service is enabled, it processes the shared preview username and transiently receives the plaintext password over HTTPS. The Worker derives and compares protected HMAC representations in memory; it does not store the plaintext password. Authentication events contain an HMAC pseudonym of the IP address, outcome, timestamp, app version, platform, architecture, and accepted legal versions. A successful response returns a short-lived session token, which is not written to the authentication event.
Beta access and support communications
If you request beta access or contact support, Reyn processes your email address and message. A beta request may include the name, organization, preferred platform, and intended use you choose to provide. Support messages may also include any project, STL, screenshot, log, model bundle, or diagnostic file you choose to send. Do not submit personal data or confidential material that is not needed for the request.
Data stored by Reyn Studio
Reyn Studio stores projects, geometry, case settings, model bundles, results, evidence, exports, recent-file paths, preferences, recovery records, and bounded crash state on your device. The app uses a loopback connection between its native process and bundled Python engine. It does not send your geometry, projects, models, or results to Reyn.
Evidence-signing keys on supported macOS builds are stored in the local Keychain. The current Windows preview does not provide those signing controls. Local files are not encrypted by Reyn Studio; use operating-system account controls and disk encryption where appropriate.
Optional diagnostics
Product analytics and remote crash reporting are off. Reyn may add an optional diagnostic submission in the future, but it will require a clear opt-in before any diagnostic data leaves your device.
4. Why Reyn processes personal data
- Deliver and secure the website and preview access service.
- Review beta access requests, communicate decisions, and administer approved preview access.
- Authenticate invited testers and prevent credential abuse.
- Answer support, privacy, legal, and security requests.
- Diagnose material you deliberately submit for support.
- Comply with law, enforce the Terms, and protect people and systems.
Where a legal basis is required, Reyn relies on performance of a contract or steps requested before a contract, legitimate interests in security and service reliability, compliance with legal obligations, and consent for any optional diagnostic submission. You may withdraw consent without affecting processing that was lawful before withdrawal.
5. Cookies and device storage
The public website does not set a Reyn advertising cookie or use browser storage to profile visitors. Cloudflare may use strictly necessary security mechanisms when responding to abuse or a challenge.
The official preview app holds a short-lived access session only in process memory. It clears the session when it expires and does not restore it after the app closes. Local project and settings files remain until you delete them through the app or operating system.
7. International processing
Reyn operates from Morocco, while its infrastructure and download providers process data through international systems. Data may therefore be processed outside your country. Where transfer rules apply, Reyn will use an available legal mechanism and contractual safeguards appropriate to the service and destination.
Reyn does not currently target the European Economic Area or United Kingdom with local campaigns. The preview website remains globally accessible. This position will be reassessed before targeted launches in those markets.
8. How long data is kept
- YC authentication events: up to 30 days.
- YC access session tokens: held only in app memory, not persisted by the access service, and valid for no longer than 24 hours.
- Support files and diagnostics: deleted within 90 days after the issue closes.
- Beta-access requests and support correspondence: retained only while needed to review or service the request, administer approved preview access, meet legal obligations, or maintain dispute records.
- Local app data: retained on your device until you delete it.
- Cloudflare data: the shortest practical retention supported by the enabled security service and account plan.
Reyn may retain a limited record longer where law requires it, a dispute is active, or deletion would compromise security. The retained record will be limited to what is needed for that purpose.
9. Security
Reyn uses HTTPS, access controls, short-lived sessions, protected credentials, bounded logs, dependency inventories, and package-integrity checks where available. No system is completely secure, and this policy does not promise that unauthorized access can never occur.
Report a suspected vulnerability or privacy incident to support@reynflow.com. Do not include exploit details in a public issue.
10. Your privacy rights
Reyn offers a common rights process where technically and legally feasible. You may request access, correction, deletion, restriction, portability, or a copy of personal data, and may object to processing or withdraw consent.
Send a request to support@reynflow.com. Reyn may ask for information needed to verify the request and will respond within the period required by applicable law. You may appeal a refusal by replying to the decision.
Depending on your location, you may complain to a local regulator. In Morocco, the relevant authority is the Commission Nationale de contrôle de la protection des Données à Caractère Personnel (CNDP).
11. Regional disclosures
Moroccan Law No. 09-08 governs Reyn as a controller operating from Morocco. European and UK visitors may also have rights under the GDPR, UK GDPR, and ePrivacy rules where those laws apply. Canadian, Brazilian, Australian, and United States privacy laws may apply according to their territorial and threshold rules.
Reyn does not currently sell or share personal data, use targeted advertising, process sensitive data for inference, or make decisions that produce legal or similarly significant effects. Global Privacy Control and “Do Not Sell or Share” signals therefore do not trigger a conflicting practice.
12. Children
Reyn is not directed to children and does not knowingly collect personal data from children. A person who cannot form a binding contract in their jurisdiction may use the preview only through a parent, guardian, school, or organization with authority to accept the Terms.
13. Changes to this policy
Reyn will update the effective date and version when this policy changes. Material changes affecting preview users will be shown before renewed access or at the next app launch. Earlier versions will be retained where practical.
14. Contact
Privacy, legal, support, and security requests may be sent to support@reynflow.com.
Last updated July 30, 2026.