Plain language first. No buried privacy promise.
What we collect
Your email address and account identifier, authentication-provider identity claims when you use provider sign-in, encrypted journal entries, separate versioned choices for optional AI processing, AI-generated quality scores and abstract vectors when enabled, the first name you explicitly choose, your birth year, an exact 18+ attestation, profile information and portrait you choose to share, consumable purchase and minute-ledger status, encrypted messages, safety reports, device push tokens, and an encrypted revocation credential for Apple sign-in accounts. A name returned by a sign-in provider may remain in authentication metadata, but it is never substituted for the first name you choose in the app.
How the journal works
Your sentence is encrypted on your device before storage. Unless you separately allow optional AI sentence processing, the archive receives ciphertext and basic entry metadata, never plaintext content, and private journaling remains fully usable. When allowed, plaintext travels over an encrypted connection for one request to an external AI processing service and is not logged or retained by our backend.
Device-bound key
Your journal key stays in secure storage on this device. A new or restored phone cannot decrypt old cloud ciphertext, so export a readable journal copy before changing devices if you want to keep one.
Journal export
The in-app control creates a readable dated copy with sentence text and locally available reflection details from this device. It does not fetch other server-held profile, purchase, matching, chat, or account records. Anyone you share the file with can read it.
Private recognition
Private recognition is off by default. Eligibility requires 21 complete ritual days spanning at least three weeks, with 10 sentences and at least 8 usable private analyses on each qualifying day. It also requires a current exact adult attestation, an adult profile, separate AI sentence-processing permission, and matching consent. Receiving proposals does not require a minute balance. Microphone use and mutual chat require a positive minute balance. Eligibility never guarantees an introduction. Your sentences, internal scores, and reasons are never shown to another person.
Optional AI processing
Sentence analysis, portrait transformation, and spoken conversation have separate versioned permissions. A chosen photo is sent to an external AI processing service only after portrait permission and an explicit transformation request. Live voice requires a deliberate microphone touch and a separate Inworld and OpenAI notice before first use. This device remembers the notice only for the same account, notice version, processing-permission version, and exact consent decision. Every start checks current permission again. A renewed or withdrawn choice, changed notice, or different account cannot reuse the acknowledgment. Audio streams through our API to Inworld for transcription and spoken responses. OpenAI processes the transcript and earlier private observations to make bounded, tentative character observations. The app does not save raw recordings or full transcripts. Private observations may also be processed by OpenAI for an after-conversation reflection available after 30 minutes, without charging voice minutes. These derived observations and reflections are access-controlled account data, not device-key-encrypted journal text. Spoken observations are currently excluded from matching. You can interrupt playback, stop the microphone, withdraw voice permission, or remove observations. Declining AI processing does not change your ownership of existing journal data.
Voice reliability
To investigate connection and reply failures, we keep content-free event counters, durations, and limited error categories with a random connection reference. This is pseudonymous operational data, not anonymous data: the reference can be linked to the protected session record. Fly holds operational logs; private GitHub Actions processes filtered diagnostic reports. It contains no spoken or generated words, recordings, raw provider errors, or credentials.
Other processors
Fly hosts the API. Supabase provides authentication, database, storage, and realtime infrastructure. Resend delivers account emails. RevenueCat processes consumable purchase events. Inworld processes live speech and generates Michael's AI voice. Apple, Google, OpenAI, Expo, APNs, and FCM may process sign-in, purchases, chosen AI inputs, or notifications when those features are used.
Your choices
You can decline or withdraw either AI-processing permission, export a readable copy of the journal available on this device, delete your account, withdraw matching consent, remove entries, block another person, or submit a safety report. Withdrawing matching consent closes pending recognition offers and deletes the private matching signals, vectors, scores, and attempt history tied to your account. Withdrawing sentence processing stops future external AI requests and turns matching off. If you explicitly report a chat message, only that selected decrypted message is shared with the safety team as your reporter statement. Because the service cannot decrypt the stored room, it cannot independently verify that submitted plaintext.
Account deletion
Once deletion is confirmed, your account and profile no longer exist. Your encrypted ritual archive, matching signals and history, matches, conversation ciphertext, character observations, minute balance and app ledger, push tokens, and app-held purchase status are removed with them. Removal of private profile media and the external RevenueCat record may remain queued in a restricted cleanup system until deletion succeeds. Store purchase records follow the store's own retention rules. If you used Apple sign-in, the app also asks Apple to disconnect. An encrypted revocation credential may remain only while a restricted retry is pending. Safety reports, any message you deliberately shared with a report, and related enforcement audit records may remain in a restricted review system for no more than 24 months from the date each record is created. They are used only for safety review, appeals, and legal response, including after account deletion. These restricted records may keep an opaque account reference needed to understand the report, but they do not keep your account or profile active. An active account restriction ends when the account is deleted.
What we do not do
We do not sell personal data, run behavioral advertising, or track you across other companies’ apps and websites.
Contact
Privacy questions can be sent to support@transcending-boundaries.lol.
