Privacy Policy
Journaly ("Journaly", "we", "us") makes a journaling app with an AI companion. This policy explains what personal information we collect, why, who we share it with, how long we keep it, how we protect it, and the rights and controls you have. Because a journal holds some of the most personal things you will ever write, keeping it private is central to how we build the app, not an afterthought.
For the purposes of the GDPR and UK GDPR, the data controller is [Legal entity name], [address]. If you have questions, contact us at privacy@journalyai.app.
1. Information we collect
We collect only what we need to give you a working, personal journal.
Information you provide
- Account details — such as your name or nickname, email address, and authentication details. If you sign in with Apple or Google, we receive the basic identifiers those services share with your permission.
- Your content — everything you create in Journaly: journal entries, letters to your future self, mood check-ins, goals, planner items, gratitude notes, dream entries, guided-exercise responses, and your conversations with the companion.
- Optional profile details — for example a date of birth, and (only if you switch on the optional astrology feature) birth details used to show star-sign and moon-phase prompts. These are always optional.
- Support and feedback — messages you send us, and anything you choose to include in them.
Information we collect automatically
- Device and app data — device type, operating system, app version, language, and similar technical details.
- Usage data — which features you use and how the app performs, including crash and diagnostic logs, used to keep the app working and improve it.
- Identifiers — app-generated identifiers needed to run the service. We do not use cross-app tracking identifiers for advertising.
Information from third parties
- Purchases — when you subscribe, Apple processes your payment. We receive confirmation of your subscription status and transaction identifiers from Apple, but not your full card number.
- Sign-in providers — if you use Apple or Google sign-in, we receive the limited profile information you approve.
2. How and why we use your information
Under the GDPR we must have a legal basis for each use. The table below sets out what we do and why.
| What we do | Legal basis (GDPR / UK GDPR) |
|---|---|
| Create and manage your account and provide the app's core features | Performance of a contract with you |
| Store your entries and let the companion reflect on them, remember context and surface insights | Performance of a contract; and, for content that may be sensitive, your consent |
| Process subscriptions and keep records of purchases | Performance of a contract; legal obligation |
| Keep the app secure, prevent abuse and debug problems | Our legitimate interests in a safe, working service |
| Improve and develop features, using aggregated or de-identified data where possible | Our legitimate interests; or consent where required |
| Send you service messages, and (if you opt in) product updates | Legitimate interests; consent for marketing |
| Comply with the law and enforce our terms | Legal obligation; legitimate interests |
We do not sell your personal information, and we do not show advertising targeted using the private things you write.
3. Your entries and the AI companion
Journaly's companion is powered by artificial-intelligence models. To generate its replies and reflections, the relevant parts of your content are processed by these models, including trusted third-party AI providers who host them on our behalf.
- These providers process your content only to return a response to you, under contracts that require them to keep it confidential and prohibit them from using it for their own purposes.
- We do not use your private entries to train foundation models, and we do not permit our providers to do so, unless you give us separate, explicit consent.
- The companion does not make automated decisions that produce legal or similarly significant effects about you. Any patterns or "insights" it offers are suggestions for your own reflection, which you can accept or ignore, and (for the optional astrology feature) are only surfaced when you ask or opt in.
4. Sensitive information
Because you can write about anything, your entries may reveal sensitive details, for example about your health, mental wellbeing, beliefs or relationships. We do not require you to share any of this, and we do not use it to infer categories about you for marketing. Where the law treats such content as special-category or sensitive personal information, we rely on your explicit consent to store and process it so the app can work for you, and you can withdraw that consent by deleting the content or your account.
5. How we share information
We share personal information only in these limited ways:
- Service providers (processors) — vendors who help us run the app, such as cloud hosting and storage, the AI providers described above, crash and analytics tooling, and email delivery. They may process your information only on our instructions and must protect it.
- Payments — Apple, which processes your subscription under its own privacy policy.
- Legal and safety — where we are required by law, to respond to lawful requests, or to protect the rights, safety and security of our users, the public or Journaly.
- Business transfers — if Journaly is involved in a merger, acquisition or sale of assets, information may transfer as part of that transaction; we will notify you and this policy will continue to apply.
We never sell your personal information, and we do not share the content of your journal for anyone else's own purposes.
6. How long we keep information
We keep your information for as long as your account is active so your journal remains available to you. When you delete individual entries, they are removed from your account. When you delete your account, we delete or de-identify your personal information within a reasonable period (target: within [30–90] days), except where we must retain limited records to meet legal, tax, accounting or security obligations, or to resolve disputes. Backup copies are purged on our standard backup cycle.
7. How we protect information
We use technical and organisational measures appropriate to the sensitivity of your content, including encryption in transit and at rest, access controls that limit who can see your data to what is necessary, and monitoring for abuse. No method of storage or transmission is perfectly secure, but protecting your reflections is a core design goal and we work continuously to keep them safe.
8. International transfers
We and our providers may process your information in countries other than your own, including the United States. Where we transfer personal information out of the UK, EEA or other regions with data-export rules, we use appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK Addendum) or another lawful transfer mechanism. You can ask us for a copy of the safeguards we use.
9. Your rights and choices
Depending on where you live, you may have some or all of these rights:
- Access a copy of the personal information we hold about you.
- Correct information that is inaccurate or incomplete.
- Delete your information, including by deleting entries or your whole account.
- Export / portability — receive your entries in a portable format.
- Restrict or object to certain processing, including processing based on our legitimate interests.
- Withdraw consent at any time, without affecting processing already carried out.
- Opt out of marketing via the unsubscribe link or your settings.
- Complain to your local data-protection authority (in the UK, the ICO; in the EEA, your national regulator).
You can exercise most of these directly in the app (view, edit, export and delete), or by emailing privacy@journalyai.app. We will respond within the time the law requires, usually one month, and we will not discriminate against you for exercising your rights.
10. Deleting your account
You can permanently delete your account and its contents from within the app, in line with Apple's account-deletion requirement. Account deletion removes your entries, letters, goals, gratitude notes, moods, dream entries and companion history, along with the associated account record, subject to the limited legal retention described in section 6. You can also delete individual entries at any time without deleting your account. If you cannot access the app, email privacy@journalyai.app and we will help.
11. Notice for California residents (CCPA/CPRA)
In the past 12 months we have collected the categories of personal information described in section 1 (identifiers, account information, your user-generated content, commercial/subscription information, internet and device activity, and, only if you provide them, sensitive details). We collect it for the business purposes in section 2 and disclose it to the service providers in section 5.
- We do not "sell" or "share" personal information as those terms are defined under the CPRA, and we do not use or disclose sensitive personal information for purposes beyond those permitted.
- You have the right to know, access, correct, and delete your personal information, to opt out of sale/sharing (not applicable here as we do not sell or share), and to limit the use of sensitive personal information.
- You may exercise these rights as described in section 9. We will not discriminate against you for doing so. You may use an authorised agent, and we may verify your request.
12. Children
Journaly is not directed to children under the age of [13 / 16, per your market], and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact us and we will delete it.
13. Website, cookies and analytics
Our marketing website may use a small number of essential and, with your consent where required, analytics cookies to understand traffic and improve the site. You can control cookies through your browser and any consent banner we present. The app itself does not use advertising cookies.
14. Changes to this policy
We may update this policy from time to time. If we make material changes, we will update the date above and, where appropriate, notify you in the app or by email. Your continued use after an update means you accept the revised policy.
15. How to contact us
For any privacy question or to exercise your rights, contact us at privacy@journalyai.app or by post at [Legal entity name, postal address]. If you are in the EEA or UK and we are required to have a representative or Data Protection Officer, their contact details are [insert].