Privacy Policy

The short version

• Your journal is stored on our servers so it can be transcribed, organized, and synced between your devices. It is encrypted in transit and at rest, and we access it only to provide and support the service.
• With your AI Processing permission, the providers named below process recordings, text, and custom dictionary words for transcripts, titles, tags, search, and summaries. You can decline or turn this off in Settings. Journaliso does not train AI models on your journal. Provider data-use and retention terms are described below.
• We don't sell your data and there are no ads in the app. Optional usage analytics and crash diagnostics are off by default. If you enable them in Settings, they help us improve the app without collecting what you write or say. You can turn sharing off any time.
• You can export everything and delete your account from inside the app, any time.

What we collect

• Account. When you sign in with Apple we receive a user identifier, your name if you chose to share it, and your email address (or the private relay address Apple creates for you).
• Journal content. Your audio recordings, transcripts, text entries, titles, and tags, plus the search index and summaries the app builds from them.
• Preferences and dictionary. Your app settings and any custom dictionary words you add. Dictionary words can be sent with recordings to improve transcription.
• Permission records. Your AI Processing choice, the disclosure version, and the times you grant or withdraw permission. These records let us apply your choice across your account.
• Purchases. Your account identifier, trial and subscription status, and purchase and transaction information needed to match a subscription to your account. Payment happens through Apple; we never see your card details.
• Service usage. How many recording hours you've used this month (for the fair-use limit) and basic technical logs — including your IP address — needed to keep the service running and to protect it from abuse.
• Walk distance. If Track Walk Distance is on (it is by default, and you can turn it off in Settings), the app reads step-based distance from your iPhone's motion sensors during a recording and saves the total distance with that entry.
• Usage analytics. Only if you enable Share Usage Analytics in Settings: events such as "recorded an entry" or "opened the paywall", with the platform and app version. Never entry text, transcripts, titles, tags, audio, or search terms. These events use an opaque account identifier, not your name or email. We disable IP-based location enrichment for app events and discard client IP addresses from stored analytics and crash events. Sharing is off by default, is not required to use Journaliso, and can be turned off in the same setting.
• Crash diagnostics. If Share Usage Analytics is on, crash reports include app version, device/OS details, and code stack traces linked to the same opaque identifier. Exception messages and arbitrary context are removed before sending; journal content, recordings, and search terms are never included.

We do not collect your contacts, photos, or browsing activity.

Where your journal lives

Journal data is stored with Convex, our database and file-storage provider, on servers in the United States. It is encrypted in transit and at rest.

We access your content only as needed to provide and maintain the service — transcription, search, syncing across your devices, and helping you with a problem you report. We never use your journal for advertising or to train AI models, and we never sell it.

Like every company, we can be legally compelled to disclose data — for example by a valid court order. If that happens, we will disclose only what the order requires, and we will tell you before we do unless the law forbids it.

If a personal-data breach requires notification under applicable law, we will notify affected people and the relevant authorities as required.

Who processes your data, and why

• Convex — stores your journal (database and audio files).
• OpenAI — transcribes eligible recordings (mainly those under about 10 minutes), generates titles and tags, builds the search index, and can generate summaries and insights.
• Anthropic — generates summaries and insights.
• Google Cloud Speech-to-Text and Cloud Storage — transcribe recordings of about 10 minutes or longer, and serve as backup for shorter ones. Batch transcription uses a temporary audio copy in Cloud Storage; custom dictionary words may accompany the transcription request.
• Apple — sign-in and payments.
• RevenueCat — matches your Apple purchase to your account. It receives your app account identifier, purchase and subscription information, and technical SDK information, never journal content.
• Resend — delivers the service emails described below.
• PostHog (United States) — optional product analytics and crash diagnostics: the usage events and filtered crash reports described above, only when sharing is enabled. It never receives journal content.

Each provider handles data under its own terms, and we send each one the data needed for its role. API processing for Journaliso is separate from using a consumer account with Claude or ChatGPT. Providers can retain data for service operation, security, and legal obligations; deleting data in Journaliso does not instantly erase all provider copies.

Journaliso does not enroll its Google Speech-to-Text projects in Google's optional data-logging program for model improvement. Under Google's terms for projects outside that program, audio and transcripts are used to provide the service. Temporary storage and request metadata are separate from model training; this is not a promise of zero retention.

Earlier versions used AssemblyAI for long recordings and fallback transcription. Its terms may permit model improvement unless an account opt-out or another exclusion applies. We did not verify that exclusion for earlier submissions. Replacing a provider does not retroactively change how it handled data already submitted.

Your AI Processing choice

Before AI processing, the app asks you to allow the named AI providers to receive the content needed for these features. Journal entries can include sensitive personal information. OpenAI and Google receive recordings and dictionary hints for transcription; OpenAI receives text and transcripts for titles, tags and semantic search; Anthropic or OpenAI receive text and transcripts for summaries and insights.

You can choose Not Now or turn off AI Processing in Settings. Manual text, manual tags, reading, playback of saved recordings, export and deletion remain available. Text you save can still sync to Journaliso's servers without AI. The app holds new recordings on your device while permission is unavailable; allowing AI resumes those waiting local recordings. Existing server entries are not automatically reprocessed merely because you allow AI; you can choose to resume a held entry.

Turning AI Processing off stops new AI requests after the server confirms the change and prevents old work from updating your journal. If you are offline, the app stops local processing and shows that account-wide withdrawal is still pending. Requests already sent cannot be recalled; providers may finish them and retain data under their own terms. Withdrawing permission does not delete earlier transcripts or other journal content. You can delete those separately. Connecting an external assistant and optional analytics are separate choices.

Connecting Claude or ChatGPT

This is off until you turn it on. If you connect an AI assistant, you approve read-only access in your browser with Sign in with Apple. After that, Claude or ChatGPT can read your entries, transcripts, tags, and summaries when you use them — and what they read is then handled under Anthropic's or OpenAI's own policies for their products. Entries in Recently Deleted are hidden from connected assistants. Deleting an entry in Journaliso doesn't remove what an assistant already read in an earlier conversation; manage that in Claude or ChatGPT. They can never add, change, or delete anything. You can revoke access any time in Settings, under Connect AI.

How long we keep things

• Entries, transcripts, titles, and tags: kept until you delete them or delete your account. Deleted entries stay in Recently Deleted in Settings for 30 days, where you can recover them or delete them sooner; then they're permanently removed, along with their recordings.
• Temporary uploads: incomplete uploads and uploaded files that never attach to an entry are scheduled for deletion after 48 hours. Recordings saved in entries follow the rule below.
• Google transcription staging: temporary audio copies are scheduled for cleanup after processing or cancellation. Failed cleanup is retried; deletion is not instantaneous. Google's service records and retention rules are separate from this temporary copy.
• Audio recordings: kept while you have a trial or subscription. If it ends, we may delete audio files starting 90 days later. If we ever do, we will email you first, and you can export all audio as a zip from Settings at any point. Transcripts are never deleted this way.
• AI connector tokens: we store one-way hashes of the tokens that keep your assistant connected. New access tokens expire after 7 days; older connections may have a 90-day access token. Refresh tokens expire after a year and are replaced when used, allowing an active connection to continue. Used or revoked refresh-token hashes remain until their expiry to detect reuse; expired token records are scheduled for daily cleanup. Revoking access stops the connection immediately, and account deletion removes these records.
• AI permission: the current choice and its grant/withdrawal timestamps are kept with your account until account deletion. We do not collect an identity document or date of birth as part of this permission.
• After account deletion: we purge your journal and account records from our active database and audio storage, including Recently Deleted. We retain a one-way hash of your Apple identifier and the deletion date to prevent repeated free trials. The hash is not your journal, but can recognize the same Apple identifier if you register again. Limited security, fraud-prevention, transaction, and legal records may remain. Rate-limit records are swept after their retention window. Provider systems and backups follow their own retention and deletion processes; account deletion does not automatically erase payment records or copies held in connected assistant conversations.
• On your device: signing out keeps local drafts and cached recordings for that account's next sign-in. Confirmed account deletion clears that account's local cache on the device used for deletion, plus known files from older versions that did not label an account owner. Those older files may include another person's unsynced drafts on a shared device and cannot be recovered after deletion. Separately labelled caches for other accounts remain. Offline devices and any copies you exported are not remotely erased.

Emails

We use email for service notices — for example, a warning before recordings would be deleted. We do not currently send marketing newsletters or third-party offers, and we do not share your email address with anyone else for their marketing.

Your controls and rights

• Export your whole journal (JSON or Markdown) and every recording (zip) from Settings, free, whether or not you subscribe.
• Delete individual entries, or your entire account, from Settings.
• Recover deleted entries from Recently Deleted in Settings within 30 days.
• Turn AI Processing on or off in Settings. This is separate from the Share Usage Analytics setting.
• Revoke AI assistant access from Settings, under Connect AI.
• For anything else — a copy of your data, a question, a complaint — email chat@davidkinani.com. We handle access, deletion, correction, and portability requests no matter where you live, subject to identity verification and applicable legal exceptions. Depending on your location, you may also have rights to restrict or object to processing, withdraw consent without affecting earlier lawful processing, and complain to a data-protection authority.

Children

Journaliso is not directed at children under 13. You must also meet any higher minimum age required where you live. If you believe a child has provided personal data contrary to these requirements, contact us so we can investigate and remove it.

Changes to this policy

If this policy changes in a way that matters, we'll say so in the app or by email before the change takes effect, and this page will always show the date it was last updated.

Contact

David Kinani · chat@davidkinani.com