Privacy Policy - Inner Journal, Personal Diary

Last updated: 19 October 2026

This Privacy Policy explains what data the Inner Journal, Personal Diary mobile application ("the App", "we", "us") and its companion website collect, why we collect it, how we use it, and the rights you have over it. It is written for users in the European Union / EEA / UK (GDPR / UK GDPR), but we apply the same standards to all users.

Data Controller: CarryStudios - contact: contact@journalpersonaldiary.com

1. What We Store Locally on Your Device

By default, all your diary entries, photos, voice memos, mood data, tags, places you add to days and settings are stored exclusively on your device in a local SQLite database. They never leave your device unless you explicitly sign in and opt into Cloud Sync, App-Settings Backup, or Google Drive Backup (see sections 3, 4 and 5).

We do not require you to create an account to use the App.

2. What We Process Without an Account

Even without signing in, the App processes a small amount of data necessary for it to function correctly:

The App does not show ads and does not sell or share your data with advertising networks.

Companion website

The website processes the following. The Firebase sign-in, account, feedback and AI chat app connection data it shares with the App is covered by the rest of this policy.

The QR code and download links on the website check your browser's user agent to send phones to the right store. Nothing from that check is stored.

Website advertising measurement

The companion website has a separate Advertising measurement cookie preference. If you accept or save this preference as enabled, the website uses the OpenAI Ads Measurement Pixel to send a link-clicked conversion when you click an App Store or Google Play download link. This helps us measure the performance of our ads; it does not tell us whether you installed the App. We rely on your consent for this optional website measurement.

The conversion payload contains the event name, not your diary entries, photos, account details or purchase value. OpenAI also receives the browser request associated with the pixel. See OpenAI's privacy policy for its handling of information.

The advertising toggle starts on, but the pixel waits until you accept or save your choice. Analytics and advertising are separate preferences. You can stop new store-link conversion calls by turning advertising off in Cookie Preferences and choosing Save, or by declining optional cookies. Earlier analytics consent alone does not enable advertising measurement.

3. Optional Account (Sign-In)

Creating an account is free and only requires Google Sign-In, Sign in with Apple or email/password. Sign-in by itself enables:

• App-Settings Backup (free, opt-in per device - see section 4).
• Free Cloud Sync for up to 2 diaries that you choose to enroll (see section 5).
• The ability to subscribe to Plus, which removes that limit (see section 5).

Sign-in alone does not upload any diary entries, photos or voice memos to our servers. What a signed-in account does send to our backend outside Cloud Sync is listed in section 3.1.

When you sign in we receive from your authentication provider:

• Your email address (with Sign in with Apple, this can be a private relay address from Apple).
• Your display name (if any).
• Your profile photo URL (if any).
• Your Google or Apple account ID (Google Sign-In or Sign in with Apple only).

These identifiers are stored in Firebase Authentication and are necessary to identify your account and any associated cloud data. Lawful basis: performance of a contract (Art. 6(1)(b) GDPR).

3.1 Account Data Outside Cloud Sync

Without Cloud Sync for any diary, a signed-in account involves our backend only through Authentication, App-Settings Backup (section 4), the subscription audit record (section 5.6), the items in section 2 and the items below. Apart from the website account copy and badges, each item is sent only when you make the choice or use the feature it belongs to. We can also see these records in our internal admin tools to operate and support the service (legitimate interest, Art. 6(1)(f) GDPR).

4. Optional App-Settings Backup (free)

Once signed in, you may opt in per device to back up your app settings - colours, theme, font, language, notification preferences, intro / onboarding flags, day-block layout and similar UI preferences - to a single document in our database, scoped to your account.

• This feature is free and is not gated by the Plus subscription.
• It does not upload any diary content (no entries, no photos, no voice memos, no mood, no tags).
• The setting is enabled per device. Auto-push fires when the App goes to background and your settings have changed; auto-pull fires on sign-in and when the App returns to foreground if the cloud document is newer.
• Disabling sync on a device, signing out, or deleting your account stops the device from pushing or pulling further updates. The cloud document is removed when you delete your account (section 7).

Lawful basis: performance of a contract (Art. 6(1)(b) GDPR) - you opt in and we sync.

5. Optional Cloud Sync (Firebase) and Plus Subscription

Cloud Sync of your diary content is free for up to 2 diaries that you choose to enroll. When you enroll a diary, its entries, photos and voice memos are uploaded to the cloud and kept in sync across your devices. An active Plus subscription (Monthly, Yearly or Lifetime tier) removes the 2-diary limit, so all your diaries sync, and additionally syncs Planner habits and tasks, purchase history and any thought-points records from earlier versions of the App. No diary content is uploaded without sign-in, and without an active Plus subscription nothing is uploaded for a diary you have not enrolled. Un-enrolling a diary deletes its cloud copy; the copy on your devices is kept. Without an enrolled diary or an active subscription, only Authentication, the items in sections 2 and 3.1, App-Settings Backup (section 4) and the subscription audit record (section 5.6) involve our backend.

Cloud Sync is fully optional. You can use the entire App without ever signing in, and you can sign in without subscribing.

5.1 What We Upload (Cloud Sync)

While you are signed in, the App synchronises the following to Cloud Firestore, scoped to your account - for your enrolled diaries, or for all your diaries while a Plus subscription is active:

• Diaries: cover, title, settings, ordering metadata.
• Diary days: text body, date, mood, tags, voice-memo references, ordering metadata, the day's weather, and the place you add to a day (its coordinates and place name).
• Photos: references to photo blobs (the bytes themselves are stored in Cloud Storage - see 5.2), plus the photo's location, the place name looked up for it and its capture time when it has them.
• Planner habits, goals and tasks (Plus only): title, notes, a goal's motivation and target date, schedule and reminder times, completion history and links to a diary or day.
• Purchase history (Plus only): feature IDs, purchase dates, prices for one-time in-app purchases.
• Thought-points records (Plus only): points earned and spent in earlier versions of the App. Thought points are switched off and no new records are created; existing records still sync until you delete your account.
• Sync bookkeeping: per-device identifiers, last-sync timestamps, the status of any sync currently running, and markers recording deletions.
• Recently deleted items: when you delete a synced diary, entry or photo, a copy is kept in a cloud trash for 7 days so it can be restored, then deleted automatically.

Conflict resolution is last-write-wins on a per-row update timestamp.

5.2 Where It Is Stored

• Text and metadata: Cloud Firestore.
• Photos and audio (voice memos): Cloud Storage for Firebase, scoped to your account.
• Our Cloud Functions and Cloud Firestore data are hosted in the European Union (Frankfurt, Germany). Some sub-services (Authentication, Cloud Storage, Analytics, App Check) and our sub-processors may process data on Google's global infrastructure, including in the United States. We rely on Google's Standard Contractual Clauses and the EU–US Data Privacy Framework where applicable to legitimise international transfers.

5.3 Optional End-to-End Encryption

You may enable client-side end-to-end encryption for the most sensitive parts of Cloud Sync from Settings → Account.

• What's encrypted on your device before upload: the text body of every diary day entry, the place name of a day's location, the title and notes of Planner habits and tasks, the title and motivation of Planner goals, and the bytes of every uploaded photo and voice memo.
• What stays cleartext: diary structural metadata (dates, mood, tags, ordering), a day's weather and the coordinates of its location, a photo's location, place name and capture time, Planner schedule, goal target dates and completion metadata, purchase history and sync bookkeeping. These stay readable by us by design: the structural metadata is needed for server-side cleanup, retention and entitlement checks, and the location, capture time and weather fields are not part of end-to-end encryption. Among location data, only a day's place name is encrypted; a photo's place name is not.
• Cipher and key derivation: industry-standard AES-256-GCM, with the encryption key derived from your passphrase using PBKDF2-HMAC-SHA-256.
• Key storage on device: the derived key is cached in your device's secure key store after your first successful unlock, so you only enter the passphrase once per device per account.
• We never receive your passphrase or your derived key. A non-secret salt is stored on our servers so any of your devices can derive the same key from your passphrase, but the salt alone is useless without the passphrase, which never leaves your device. If you forget the passphrase, the only recovery path is to wipe the encrypted cloud copy and re-upload from a device that can still decrypt it.

Once a mode (standard or encrypted) is chosen for an account, switching modes requires wiping and re-uploading all cloud content.

5.4 Important Confidentiality Notice (Standard Mode)

If you do not enable end-to-end encryption (5.3), Cloud Sync runs in standard mode. In standard mode:

• All Cloud Sync data is encrypted in transit (TLS) and at rest by Google.
• However, the App developer (the data controller) has technical access to your standard-mode data through the Firebase administration console for the purpose of operating, debugging and supporting the service.
• We do not read your diary content, share it, or use it for any purpose other than running the sync service. Access is restricted, logged, and limited to staff who need it to operate the service.

If this level of confidentiality is not acceptable to you, enable end-to-end encryption (5.3) or do not enable Cloud Sync at all. With encryption on, the developer can still see metadata (dates, mood, tags, weather, location coordinates, photo place names and photo capture times) but not the body text, a day's place name or media.

5.5 Lawful Basis and Sensitive Data

Performance of a contract (Art. 6(1)(b) GDPR): you enroll diaries or subscribe and ask us to sync your data, and we sync it. You can withdraw at any time by un-enrolling a diary, signing out, cancelling your subscription, or deleting the account from Settings → Account.

Diary entries can contain special-category data under Art. 9 GDPR (e.g. health, religion, political views, sexuality). By signing in to Cloud Sync you give your explicit consent to upload such content for the sole purpose of synchronising it across your devices. You can withdraw this consent at any time by signing out, which stops new uploads. To remove already-synced data see section 7 (Account Deletion).

5.6 Subscription State Mirror

For audit, customer support and refund handling, RevenueCat sends server-to-server webhooks that we mirror into a small entitlement record under your account, with a record of the paid features you have unlocked and a per-event audit log alongside it. These records contain entitlement state, anonymised event identifiers and timestamps, and no diary content. Audit events are automatically purged after 90 days; the entitlement record itself is removed when you delete your account (section 7).

5.7 AI Chat App Connections

Connecting an AI chat app (for example Claude or ChatGPT) to your cloud-synced journal is optional. Nothing is shared until you sign in on our website and approve the app on our consent screen. Only connect apps you trust.

What a connected app can access

• Free accounts: the app can read and search entries in the diaries you have enrolled in Cloud Sync.
• Journal Plus: the app can read and search all your synced diaries, and read your Planner tasks, habits and goals. If you also approve write access, it can create entries, append text to existing entries and create one-off tasks. It cannot delete anything or replace text that is already there. If Plus ends, the connection falls back to free access.
• Entry data the app can read: diary names, entry text, the text of the prompt an entry answers, date, mood, tags, rating, favourite status and basic weather (condition and temperatures). Photos, voice memos, coordinates and location labels are never shared through a connection.
• End-to-end encrypted accounts (5.3): entry text, prompt text, diary names, Planner titles and notes, and goal motivations are left out. Search and writing are unavailable. The app can still read the metadata that is stored without encryption, such as identifiers, dates, moods, tags, ratings, favourites, weather, and Planner dates, schedules and completion status. We never ask for your passphrase or decrypt your journal on our servers.
• Sensitive information: journal content can include sensitive information, such as details about your health. Approving access can send that information to the provider of the app you choose.

Who receives it

Whatever the app reads is sent to the company that runs it, such as Anthropic (privacy policy) or OpenAI (privacy policy). That company handles the data under its own terms and privacy policy, which decide how long it is kept and whether it is used to train models. It receives the data at your direction and is not our sub-processor. We cannot delete its copies: revoking a connection or deleting your account does not remove them, so contact the provider for that. We do not use journal content read through a connection to train our own models or for advertising, and we do not sell it.

What we keep

• Connections: a record of each app you approve, with its permissions and when it was approved, last used and revoked. We keep it until you delete your account, including after you revoke the app.
• Tokens: we store only one-way hashes. A daily cleanup deletes expired and revoked tokens. A refresh token that has already been exchanged for a new one is kept until it would have expired (at most 30 days), so that reuse of a stolen token can be detected and the connection blocked. Sign-in codes expire after 10 minutes and are deleted by the same cleanup.
• App registrations: the name and return addresses an app provides when it registers. Connection records refer to them, but they are stored separately from your account records, can be reused when an app connects again and are not deleted with your account.
• Usage records: daily call counts for 35 days and a log of each call for 90 days. A daily cleanup deletes older records, so deletion can happen up to a day after these periods end. The log holds your user ID, the connection, app name, tool name, outcome, daily limit, time and duration. It never contains the request, journal content or results.
• Short-lived cache: to answer follow-up requests quickly, our hosting provider Vercel keeps cached copies of entry data and diary names in the EU region where the connection service runs (Frankfurt, Germany). For encrypted accounts the cache leaves out the same text as above. A cached copy is no longer used after at most ten minutes. Changes that reach the service through sync or a connection, and revoking a connection, usually make it stop being used sooner. These times are when we stop using a copy, not deadlines for its physical deletion, which Vercel handles under its own storage practices.

Your controls

• Revoke one app or all apps on the Connected AI apps page of your website dashboard. We refuse the revoked app's later requests. A response already on its way cannot be recalled, and other apps you still have connected keep their access, including to freshly cached data.
• Signing out everywhere, resetting your password or having your account disabled also ends existing connections. The app must then be approved again.
• Deleting your account deletes your connection records, tokens, usage counts and call logs when the deletion is processed.

None of these steps deletes data an AI provider has already received.

6. Optional Google Drive Backup

Independently from Cloud Sync, you can take a manual backup of your local database to your own Google Drive. The App requests the drive.file scope, which lets it create / read / delete only files it has itself created in your Drive - it cannot see your other Drive content.

The backup is stored solely within your own Google Drive account. Nothing is sent to our servers when you use Drive Backup. Drive Backup is disabled while you are signed in to a cloud account, to avoid having two competing backup mechanisms running at once.

7. Your Rights Under GDPR

You have the right to:

• Access - request a copy of the personal data we hold about you. The App's local database export covers all device-side data; for cloud-side data contact us.
• Rectification - correct inaccurate data (you can edit any diary entry in-app).
• Erasure ("right to be forgotten") - delete your account via Settings → Account → Delete account, or ask us by email (see how to delete your account). Either way, the same server-side deletion wipes the database documents we hold for you (diary content, app settings, badges, subscription state and audit events, referral state, weather request counts and AI output ratings), your website account, your AI chat app connections and their usage records (5.7), the photo / audio files in Cloud Storage including the cloud trash, and all sync bookkeeping. It runs within seconds, a second pass about 2 hours later removes anything written in between, and no copy of the deleted data remains in our Firebase project after 7 days at most. The few records we keep, and for how long, are listed in section 9. Local data on the device must be deleted by uninstalling the App.
• Portability - export your diary as a backup file (Settings → Backup) at any time.
• Restriction and objection to processing - contact us.
• Withdraw consent at any time (un-enroll a diary, sign out, disable analytics, cancel your subscription).
• Lodge a complaint with your national data-protection authority.

Most rights can be exercised in-app. For anything else, email contact@journalpersonaldiary.com.

Cancelling your subscription stops new content from being uploaded, except for up to 2 enrolled diaries, but does not by itself delete data already in the cloud - use "Delete account" for full erasure, or "Replace cloud with this device" to overwrite it.

8. Third-Party Services and Sub-Processors

We have a Data Processing Addendum in place with Google for Firebase services and with RevenueCat for subscription management. Vercel's and Resend's Data Processing Addendums, which include the EU Standard Contractual Clauses, apply to our use of their services. If we change or add a sub-processor in a way that materially affects how your data is handled, we will update this list and surface the change in the App.

9. Data Retention

• Local data: stays on your device until you delete an entry or uninstall the App.
• Cloud-synced diary data and other account data: kept while your account exists. When you delete the account it is deleted immediately and removed from our Firebase project within 7 days at most. The deletion runs within seconds, and a second pass about 2 hours later removes anything written in between. We keep no Firestore backups, so deleted documents can no longer be read after about an hour. Deleted Cloud Storage files can be restored by us for 7 days, then they are removed permanently.
• Recently deleted items (Cloud Sync): kept in the cloud trash for 7 days, then deleted automatically.
• App-settings backup document: kept while your account exists; removed on account deletion.
• Badges: kept while your account exists; removed on account deletion.
• Sync bookkeeping (per-device last-sync timestamps): kept for up to 60 days after last sync, then automatically purged by a server-side cleanup function.
• Subscription audit events: automatically purged after 90 days. The summary entitlement record is preserved while the account exists and removed on account deletion.
• AI chat app connections: connection records until account deletion; tokens, usage counts, call logs and cached copies as described in section 5.7.
• Purchase records: retained in our Firebase project as long as needed to honour your Plus entitlements, and deleted with your account.
• RevenueCat purchase records: when you delete your account, we also delete your purchase record at RevenueCat, our subscription provider, unless the same purchases are also linked to another account you still use. Apple and Google keep their own records of your store purchases. Questions about these records: contact@journalpersonaldiary.com.
• Feedback messages you sent while signed in are kept after account deletion, with your email address and display name, so we can follow up on what you reported. Their attachments are deleted with your account. Email contact@journalpersonaldiary.com to have the messages deleted.
• Invite anti-abuse record: after account deletion, a record keyed to your device's random app-install identifier, with your account removed, is kept for 12 months and then deleted automatically (legitimate interest, Art. 6(1)(f) GDPR, see section 3.1).
• Deletion record: your user ID and the deletion time, kept for 7 days after account deletion so the second deletion pass can run, then deleted automatically.
• Crash reports (Sentry): retained according to Sentry's standard retention.
• Email delivery logs (Resend): kept by Resend for 30 days.
• Analytics events: retained according to your Firebase Analytics retention setting (default is 14 months).

10. Security

• All network traffic between the App and our backend uses HTTPS / TLS.
• Cloud Firestore and Cloud Storage data is encrypted at rest by Google.
• Optional client-side end-to-end encryption (section 5.3) further protects diary body text and media bytes against access by us or our sub-processors.
• The mobile client sends App Check tokens (Play Integrity on Android, App Attest on iOS) with every backend call to block abusive or tampered clients.
• Access to the Firebase project is restricted, password-protected and uses two-factor authentication.

No system is perfectly secure. If you discover a vulnerability please email contact@journalpersonaldiary.com.

11. Children

The App is not directed at children under the age of 13 (or the equivalent minimum age in your jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided personal data, please contact us so we can delete it.

12. Limited Use Disclosure (Google API Services)

Inner Journal, Personal Diary's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. https://developers.google.com/terms/api-services-user-data-policy

13. Changes to this Policy

We may update this Privacy Policy from time to time. Material changes will be highlighted in the App and the "Last updated" date above will reflect the change. Continuing to use the App after a change constitutes acceptance of the updated policy.

14. Contact Us

For any questions, requests or to exercise your rights:

Email: contact@journalpersonaldiary.com

See also our Terms and Conditions and how to delete your account.