Spryng.io Privacy Policy

Last updated: November 2, 2026

This Privacy Policy (“Policy”) describes how Spryng.io LLC (“Spryng,” “we,” “us,” or “our”) collects, uses, discloses, and safeguards information. This Policy applies to: (a) visitors to our websites; (b) users of our Services across active commercial tiers (including 1-Click Starter Inquiry Blueprints, Conference Event Pass, Praxis Collaborative, and Enterprise / Research Organization Projects); (c) individuals using Personal Sensemaking & Journally; and (d) individuals invited to participate in a Project or Event inquiry.

Contact: Spryng.io LLC, 2727 Skyview Dr, #802, Lithia Springs, GA 30122, USA. Email: privacy@spryng.io.

If you do not agree with this Policy, do not access or use the Services.

1. Key Concepts: Who Controls Data?

Spryng supports both organizational and individual use. Responsibilities and roles may differ by context.

1.1 Organizational Projects (Customer as Controller)

When an organization uses Spryng for Projects, the organization (the “Account Owner” or “Customer”) typically determines the purposes and means of processing personal data within that account. In those cases, Spryng generally acts as a processor/service provider under a Data Processing Agreement (“DPA”) where applicable.

1.2 Personal Sensemaking & Journally for Individuals (Spryng as Controller)

When you use Personal Sensemaking or Journally as an individual, Spryng generally acts as the controller for personal data processed to provide that service. Individual reflection entries and self-signified narratives remain private to the author and are protected by user-controlled access controls and encryption in transit and at rest.

1.3 Participants

If you participate in an organizational Project, the Account Owner typically controls how participation data is collected and used. Spryng processes information on the Account Owner’s behalf, subject to the Account Owner’s settings and instructions and the DPA where applicable.

Where the Terms of Use require a Spryng Care Agreement for participant Personal Information collection, this Policy describes how information is handled once authorized; it does not independently authorize an Account Owner or Admin to configure a Project to collect that information without the required Spryng Care Agreement.

2. Information We Collect

We collect information depending on how you interact with the Services.

2.1 Website and Usage Information

  • pages viewed, actions taken, referrer URLs

  • device type, browser type, operating system, language

  • approximate location derived from IP address (general region)

  • cookie identifiers and analytics identifiers

2.2 Account and Profile Information

  • name, email address, and organization (if provided)

  • account settings and preferences

  • authentication method (e.g., email/password, OAuth)

2.3 Project Participation Information

Depending on Project design and Account Owner settings:

  • responses to prompts (including narratives and interpretations)

  • participation metadata (e.g., timestamps, completion indicators)

  • identity handling that may be anonymous, pseudonymous, or identified, depending on configuration

2.4 Personal Sensemaking & Journally Content (Individual)

  • personal reflection narratives, journal entries, and self-signified patterns

  • optional media or attachments (if enabled by the user)

  • device and app diagnostic information (e.g., crash logs)

2.5 Communications

  • emails and messages you send to support

  • support tickets and correspondence

  • newsletter subscription preferences (if applicable)

2.6 Logs and Security Data

  • access logs, error logs, and security logs

  • audit-related events where applicable

  • fraud prevention and abuse detection signals

3. Cookies and Similar Technologies

We use cookies and similar technologies to: keep you signed in; remember preferences; analyze site usage; and improve performance and reliability. Some cookies are essential to operate the Services. The Cookie Policy describes the categories.

On the marketing website (spryng.io, www.spryng.io, and stagex.spryng.io), usage measurement is Google Analytics 4 and PostHog. Where Google Analytics is allowed to load, it receives the public page path, the site name, a production or staging label, limited campaign labels, a reduced referrer, and technical browser and device data. It does not receive form contents. PostHog receives page views and named product events, plus technical data such as browser and IP address, through g.spryng.io. PostHog, Inc. processes that data for Spryng. For a browser whose time zone does not begin with Europe/, PostHog may also record a session replay, click heatmaps, and dead clicks. The replay configuration in the browser sets maskAllInputs, masks every text node, and blocks form, input, textarea, and select elements so those elements are replaced with an empty block. Masking runs in the browser before the recording is sent. That is the configuration this site sets. It is not a statement that every element on every later page will stay masked. Exception capture and surveys stay off. Where session replay is on, clicks and form submits are recorded on the elements of the page, so heatmaps, dead clicks, and rage clicks can be studied. Session replay is on for a browser whose time zone does not begin with Europe/, without a PostHog cookie. The data-attr marks on retailer links, Studio signup links, the book activation form, pilot and contact forms, webinar registration links, and pricing buttons remain. Typed input values are not captured. Copied text is not captured. The text of input, textarea, and select elements is removed before the event is sent. Labels on buttons and links can be included. Recordings that do run mask all inputs, mask all text, and block form fields. PostHog keeps its identifiers in memory only on this site: it sets no cookie, and no identifier is shared with app.spryng.io or added to signup links. Neither tool is an advertising pixel. Website analytics, including session replays, are kept for 14 months.

Where you are is read only from your browser's time zone; the site uses no server, CDN, or cookie location hint. When the time zone begins with Europe/ or cannot be read, no analytics load at all: no request is sent to Google or to PostHog. For any other time zone, PostHog keeps memory only (no analytics cookie), Google Analytics may load, and session replay, heatmaps, and dead clicks may run. A visitor in the EEA, the United Kingdom, or Switzerland whose browser time zone does not begin with Europe/ (for example Atlantic/Reykjavik, Atlantic/Canary, Asia/Nicosia, or UTC) can therefore receive Google Analytics and session replay. Analytics do not load when the browser sends Global Privacy Control or Do Not Track, so session replay does not start. "Opt out of analytics" in the footer stops Google Analytics, PostHog events, heatmaps, dead clicks, and a session replay that has already started in that browser. The footer also shows "Do not sell or share my personal information" to every visitor, which uses the same opt-out. You can also manage cookies in the browser. Disabling cookies may reduce or disable certain functionality.

4. How We Use Information

We use information to:

  • provide, operate, and maintain the Services;

  • authenticate users and enforce role-based access where applicable;

  • support Projects and participant experiences;

  • respond to inquiries and provide customer support;

  • secure the Services, detect and prevent abuse, and enforce our Terms;

  • improve features and user experience; and

  • comply with legal obligations.

5. Transcription, Translation, PII Redaction, and Third-Party Processing

Some features may use automated or third-party processing for transcription, translation, or PII redaction. When enabled:

  • Content may be sent to feature providers solely to perform the requested transcription, translation, or PII redaction;

  • outputs may contain errors and should be reviewed; and

  • processing is governed by our agreements with those providers and our subprocessors disclosures.

No AI Model Training Commitment: Spryng does not use Customer Content, lived narratives, participant self-interpretations, or survey responses to train, re-train, or fine-tune third-party artificial intelligence models, foundation models, or public large language models (LLMs).

AI Use: Spryng's AI-assisted features are transcription, translation and redaction of responses, and the optional AI Pattern Synthesis add-on. Each is optional. An account owner can ask us to turn any of them off for their organization by emailing privacy@spryng.io, and we confirm in writing when it is done. Turning off AI redaction does not turn off rule-based redaction. Spryng does not guarantee the accuracy of optional third-party technical utility services (such as automated speech-to-text transcription, machine translation, or regex-based PII redaction).

6. How We Share Information

We may share information:

  • with subprocessors and service providers (e.g., hosting, analytics, messaging, and feature processors) to operate and deliver the Services;

  • with the Account Owner and authorized users within a Project, consistent with configured settings;

  • with law enforcement, regulators, courts, or other parties when required by law or to protect rights, safety, and the integrity of the Services; and

  • in connection with a corporate transaction (e.g., merger, acquisition, financing, or sale of assets), subject to appropriate safeguards.

We do not sell personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined in the California Consumer Privacy Act and similar state laws. We have not done so in the past 12 months. We honor Global Privacy Control and Do Not Track as a request to opt out: when your browser sends either signal, our analytics tools do not load and session replay does not start. The "Do not sell or share my personal information" control in our footer turns off Google Analytics, PostHog, and session replay in that browser for one year.

7. International Transfers

Spryng may process information in the United States and other locations depending on service configuration, enabled features, subprocessor operations, and applicable customer agreements. Where required for cross-border transfers (including EU/EEA/UK), Spryng uses appropriate safeguards such as Standard Contractual Clauses (SCCs), UK addenda, and additional technical and organizational measures, consistent with the DPA and applicable law. Marketing-website analytics transfers are described in section 9.4.

For projects involving Australia, New Zealand, or other jurisdictions with additional cross-border, hosting-region, notice, retention, or public-sector requirements, project-specific review may be addressed through the applicable order form, DPA, proposal, or security review process. Public legal pages summarize Spryng's posture; deployment-specific requirements are scoped with the customer.

8. Data Retention

Retention depends on context, plan, Project settings, and legal obligations:

  • Website analytics: retained for 14 months. Security logs: retained for limited periods appropriate to security needs.

  • Account information: retained for the life of the Account and as necessary for billing, dispute resolution, and legal compliance.

  • Project participation content: generally controlled by the Account Owner’s configuration and contractual arrangements, subject to legal requirements.

  • Support communications: retained as needed to support continuity, resolve issues, and maintain operational records.

  • Newsletter sign-ups: when you ask to subscribe, we keep your email address, where you signed up and when. If you do not confirm using the link we email you, we delete the request after 30 days and do not send you the newsletter. If you confirm, we keep it as the record of your request and consent, including after you unsubscribe. You can ask us to delete it.

Where you request deletion, we may retain limited information if required to comply with legal obligations, resolve disputes, enforce agreements, or protect platform integrity.

Read-only and export windows after an account ends, and our notice before routine deletion of hosted Content, are set out in Section 18 of the Terms of Use. They apply to free and expired accounts too.

8.1 De-identified Data for Service Improvement

(Restating practice in effect since January 1, 2019.)

For non-private initiatives — Studio Plans and Projects not designated as private or confidential by the Account Owner, not subject to a Business Associate Agreement (BAA), and not otherwise restricted by an Order Form or DPA — Spryng may create and use de-identified, aggregated, or obfuscated data derived from Content for troubleshooting, debugging, quality assurance, security analysis, and improvement of Spryng's own platform features.

Spryng will not:

  • use Customer Content to train third-party AI or large-language models;
  • use BAA-covered Protected Health Information for these purposes;
  • use Content from private or confidential Projects for these purposes; or
  • re-identify or attempt to re-identify de-identified data.

De-identification will be performed consistent with industry standards, and where PHI may otherwise be in scope, consistent with HIPAA Safe Harbor (45 CFR §164.514(b)) or expert-determination methods.

9. Your Rights and Choices

Rights vary by jurisdiction and by whether Spryng is the controller or processor.

9.1 If You Use Journally as an Individual (if offered)

You may request access, correction, deletion, or portability, subject to legal limits.
Contact: privacy@spryng.io

9.2 If You Participate in an Organizational Project

In most cases, the Account Owner is the controller. You should direct requests (access, deletion, correction) to the Account Owner. Spryng will assist the Account Owner as required under the DPA.

9.3 Website Visitors

You may opt out of marketing-site analytics as described in section 3 and the Cookie Policy, and you may request deletion of identifiable information Spryng controls, subject to legal requirements.

9.4 Visitors in the EEA, the United Kingdom, or Switzerland

For marketing-website analytics, the controller is Spryng.io LLC, 2727 Skyview Dr, #802, Lithia Springs, GA 30122, USA. Contact: privacy@spryng.io.

We process that analytics data on the basis of legitimate interests under Article 6(1)(f) of the GDPR and the UK GDPR: understanding how the public website is used, keeping that measurement limited, and honoring opt-out signals. You can object at any time with the "Opt out of analytics" control in the footer. That control turns off Google Analytics, PostHog events, heatmaps, dead clicks, and session replay in that browser.

Recipients of marketing-website analytics are PostHog, Inc., which processes events for Spryng through g.spryng.io. When the browser time zone begins with Europe/ or cannot be read, as described in section 3, nothing is sent to PostHog or to Google, and neither is a recipient for that visit. Otherwise PostHog processing is memory-only page and event measurement, and Google LLC receives analytics where Google Analytics is allowed to load. Where session replay is on for other visitors, PostHog, Inc. processes those recordings for Spryng. Recordings are kept for 14 months with the other website analytics.

Transfers to the United States. Checked against the Data Privacy Framework list on 25 October 2026: Google LLC (participant listing 5780, next certification due 13 September 2027) and PostHog Inc. (participant listing 2915, next certification due 10 March 2027) are actively certified for the EU-US Data Privacy Framework, the UK Extension to that framework, and the Swiss-US Data Privacy Framework. The Google LLC listing states that the certification covers Google LLC and its wholly-owned US subsidiaries. We rely on that certification where it covers the transfer. Where it does not, we use the European Commission's Standard Contractual Clauses together with the UK Addendum.

Marketing-website analytics are kept for 14 months.

You may ask us to access, correct, or delete personal information we control by emailing privacy@spryng.io. You may lodge a complaint with a supervisory authority. In the United Kingdom, that authority is the Information Commissioner's Office (ICO).

9.5 US state privacy rights

If a US state privacy law applies to you, you may have the right to know, correct, and delete personal information, and to opt out of the sale or sharing of personal information and of targeted advertising. We will not discriminate against you for exercising these rights.

Send the request to privacy@spryng.io. We verify it by matching the email and the other details you give us to information we hold, and we may ask for more information when we cannot match the request. An authorized agent may submit a request for you when you give the agent written permission and we can verify both your identity and the agent's authority.

Retention by category:

  • Website analytics: 14 months.
  • Account information: for the life of the account, and as needed for billing, dispute resolution, and legal compliance.
  • Project participation content: as the Account Owner configures it, subject to the contract and to legal requirements.
  • Support communications: as needed to keep support going, resolve issues, and keep operational records.

If we decline your request, reply to our decision to appeal; we will respond within 45 days.

10. Security

We use reasonable technical and organizational measures to protect information, including access controls and monitoring. No system is perfectly secure. You are responsible for safeguarding your credentials and devices.

11. Children’s Privacy

The Services are intended for individuals who are 18 or older, unless a separate written project contract signed by Spryng and the applicable Account Owner expressly permits under-18 participation for a specific project. We do not knowingly collect personal information from individuals under 18 outside such contractually authorized contexts. If you believe a minor has provided personal information, contact privacy@spryng.io and we will take appropriate steps consistent with applicable law.

12. Changes to This Policy

We may update this Policy from time to time. If changes are material, we will post the updated Policy with a new effective date and, where appropriate, provide additional notice.

13. Contact

Spryng.io LLC 2727 Skyview Dr, #802 Lithia Springs, GA 30122 USA

Questions or requests: privacy@spryng.io