Journal Thing — Privacy Policy

Last updated: October 20, 2026

Journal Thing keeps your journal on your device unless you turn on sync. We never sell your data, show ads, or track you across other companies' apps or websites. We use limited app-usage analytics, through PostHog and Google Analytics for Firebase, and crash reports, such as session duration, feature use, and error details, to improve the app. Those reports exclude what you write in your journal. You can turn both off any time with one switch in Settings → Security.

This policy applies to the Journal Thing apps for iOS, macOS, watchOS, Android, and Wear OS and to the Journal Thing web journal at journalthing.com/app, published by Things Things Things LLC ("we", "us", "our"), the controller responsible for the processing described here. Our business address is 1401 Dean St Apt 1, Brooklyn, NY 11216, United States. Contact us at hello@journalthing.com. Sections below say which platform they describe when the two differ. It is specific to the apps — the Things Things Things website privacy policy covers thingsthingsthings.studio separately.

What we collect

Your journal content is local by default. Sync and dictation send data only when you use them. We also collect limited app-usage analytics:

• Sync. Journal Thing Sync is our only sync service. It is optional and part of Premium, keeping iPhone, iPad, Mac, Android, and the web journal in step through a Journal Thing account, where we store a protected copy. The details are below.
• Purchase management. We and our purchase providers use purchase status and identifiers to confirm Premium. On Android, this processing starts when you open the app, before a purchase or sync sign-in. See "Purchases" below.
• Feedback you send. The in-app feedback form sends us your message, an optional email address, and an optional screenshot. See "Feedback and support" below.
• Voice dictation. Audio is processed to return a transcript, with app-integrity and rate-limit data used to protect the service. See "Voice dictation" below.
• App-usage analytics. We collect a small allowlisted set of product-usage events to understand how the app is used and improve it. The events go to PostHog and to Google Analytics for Firebase, which estimates an approximate location (country and region) from your network address. Journal content is expressly excluded.
• Crash reports. If the app crashes or hits an internal error, a diagnostic report (stack trace, app version, OS version, device model) is sent so we can fix it. Journal content is expressly excluded, and the same Settings switch that controls analytics turns crash reporting off too.

What stays on your device

Everything you create in the app is written to local storage on your iPhone, iPad, Mac, or Android device, and stays there:

• journal entries, titles, and timestamps;
• moods, tags, todos, and daily intentions;
• your name, if you choose to enter one during setup;
• app settings such as theme, font, text size, and reminder times;
• backup files you create, until you delete or share them.

On iPhone, iPad and Android, deleting the app removes its local storage. On Mac, moving the app to Trash does not remove its journal data; local data must be removed separately. Exported backups can remain wherever you saved them. The Apple Watch app and home-screen widgets use journal data from your devices. Wear OS keeps a phone-provided snapshot, unsent entries waiting for the phone, and recoverable dictation drafts. Its local data is excluded from Android cloud backup and device transfer. Watch dictation uses the optional cloud service described below; Wear OS asks for cloud-dictation consent separately. Journal content is never included in analytics. We receive content through optional hosted sync, dictation processing, or feedback you choose to send, as described below.

Earlier iCloud copies

Journal Thing no longer offers iCloud sync. An iCloud copy created by an earlier version is left untouched, and your local journal stays on your device. You can remove an earlier iCloud copy through your Apple Account's iCloud storage controls in iOS Settings. Apple's handling of that copy is governed by Apple's Privacy Policy.

Journal Thing Sync — iPhone, iPad, Mac, Android, and web (optional, off by default)

Journal Thing Sync keeps one journal current across iPhone, iPad, Mac, Android, and the web journal at journalthing.com/app. When you sign in:

• you sign in with Google or Apple, which creates a Journal Thing account. We receive and store the email address of that account (or Apple's private relay address, if you hide your email) and an account identifier. Our authentication provider, Supabase, can also retain the display or full name in your Google or Apple profile to manage the account. This is separate from the name you type during local app setup. We never receive your Google or Apple password. If you sign in with Google, the app loads your Google profile photo from Google's image servers to show it in the side menu; the request carries no cookies or account credentials.
• your entries, titles, moods, tags, daily focus, five-minute exercises, custom mood packs, and their timestamps are copied to a database that we operate (hosted for us by Supabase, in the United States). The copy is encrypted in transit and protected with the hosting provider's encryption at rest.
• dated mood ratings are personal wellbeing information. We use them only to show and sync your mood history, not for medical assessment or advertising. Sync records also carry a random installation identifier to keep changes from your devices in order.
• photos you attach to entries are uploaded, as the compressed image the app stores, to private storage in your account (also hosted for us by Supabase) so they appear on your other devices. Only your own signed-in devices can read them.
• if an entry carries optional place details — a place name, address, or coordinates, for example on an entry imported from another journaling app — those details sync with the entry. Journal Thing never asks for your device's location and has no location permission; the only coordinates it can hold are ones already attached to an entry.
• hosted sync is part of Journal Thing Premium. When you sign in, the app checks whether your account has an active Premium purchase (see "Purchases" below); if it does not, syncing pauses and your journal stays on the device and in your account.
• that copy is not end-to-end encrypted. Access is restricted to your own account, but the content is not scrambled in a way that would make it unreadable to us as the operator. We do not read it, and we do not use it for anything but syncing your devices — but we are not in a position to claim we cannot.
• sync stays off until you choose it, and your journal always remains on the device as well, so it keeps working offline.

Turning sync off does not delete the copy on our server. Disconnecting signs this device out and stops syncing; the journal already in your account stays there. To erase it, use Settings → Your Data → Journal Thing Sync → "Delete sync account" on iPhone or iPad, Settings → Sync → "Delete sync account" on Mac, Settings → Your Data → Sync & Backup → "Delete sync account" on Android, or Settings → Security → Delete Account in the web journal. Each permanently deletes your account and the journal and photos stored in it, and signs this device out. The journal on your device is not touched. You can also email hello@journalthing.com from the address you signed in with, or follow the steps at journalthing.com/delete-account.

The web journal

journalthing.com/app is the same journal in a browser, available once you sign in to Journal Thing Sync. It keeps your display preferences, recent searches, and the reply address you type into its feedback form in your browser's local storage. It uses the same limited analytics and crash reporting as the apps, with the same opt-out switch in its Settings, and its feedback form works like the in-app one. When analytics is on, Google Analytics sets first-party cookies named _ga and _ga_<container ID>, which hold a random client ID, and Firebase keeps a random installation ID in your browser's IndexedDB storage. They are set only after analytics is allowed, and they are not used for advertising. Turning analytics off stops these events; clearing the site's data in your browser removes the cookies and stored ID. Older journalthing.com email-and-password accounts are separate from Journal Thing Sync accounts. The current web journal's Delete Account action deletes the signed-in Sync account; it does not delete a separate legacy account. For a legacy account, email hello@journalthing.com from its registered address so we can verify and handle the request.

Test and reviewer service

Builds labeled sandbox use a separate test service with separate accounts, journal records, photos and purchase-verification state. Production accounts and purchases do not grant access to that service. Its sync is still optional and copies journal data to the service when enabled; use an empty test profile and synthetic entries. The processing and privacy controls described in this policy also apply to the test service. Deleting a test account does not delete a separate production account.

Voice dictation (optional)

On Mac, dictation runs on your device. The app downloads a Whisper speech model from Hugging Face when you request it, then transcribes recordings locally. The model download requires an internet connection; the download provider receives the network information needed to deliver it. Your Mac dictation audio is not sent to our transcription relay or OpenAI. Local recordings and unfinished dictation drafts may remain on this Mac while transcription is pending. You can remove the downloaded model in Settings → Dictate.

On iPhone, iPad, Apple Watch, Android, Wear OS, and the web, voice dictation uses our optional cloud service. While you dictate, your audio is sent over an encrypted connection to our transcription relay, hosted by Cloudflare, and forwarded to OpenAI's speech-to-text service, which returns the text in real time. About that audio:

• we do not store the audio or the resulting text — our relay holds neither once your transcription request completes;
• native-app requests include an app-integrity proof and are subject to rate limits. On Apple devices, the service retains a hashed App Attest installation key and its public verification material so it can recognize valid app installations and prevent replay or abuse. This is not an advertising identifier and is not used for analytics;
• on Android, Google Play Integrity verifies the app and installation. Our relay keeps hashed rate-limit identifiers derived from a service label and the request's network address, plus an attempt count and time window, to prevent abuse of dictation and feedback. We do not use those identifiers for analytics or infer your location from them;
• web dictation requires a signed-in Journal Thing Sync account. The relay uses that account's identifier for an hourly request counter to limit abuse. This counter is separate from product analytics;
• OpenAI processes these requests as a service provider. Its standard API policy excludes customer data from model training unless optional data sharing is enabled. We use its audio-transcriptions endpoint; OpenAI's published default retention table lists no abuse-monitoring or application-state retention for that endpoint. These defaults do not override an account's optional sharing choices; optional sharing of inputs and outputs is turned off for our OpenAI organization. See OpenAI's endpoint data controls and optional data-sharing settings;
• the microphone is used only while you are actively dictating — the app never listens otherwise, and typing never touches the dictation service.

Cloudflare also processes network metadata, such as IP addresses, request times, and URLs, to deliver and secure our service. We have not enabled stored Worker request logs or log exports. Cloudflare's operational metadata is separate from dictation content and follows its own privacy and retention practices; we do not promise that all network metadata disappears when a transcription request ends.

Limited app-usage analytics

Journal Thing sends PostHog and Google Analytics for Firebase a small, allowlisted set of product-usage events to help us understand whether features are useful and where the app needs work. These may include app launches, coarse session duration, feature interactions, app version, platform, OS version, and broad device type. We attach an app-scoped random installation ID so we can count sessions without using your name, email, account ID, or an advertising identifier, and we ask PostHog not to derive a location from your network address. Google Analytics does estimate an approximate location, as described below. Crash reporting uses its own random installation ID for session-health records, described under Crash reports.

Android events include app opening, onboarding completion, entry creation or deletion, setting or clearing a mood, adding, removing or tapping a tag, completed dictation, attaching a photo, performing a search, and opening Rewind. A journal summary sends only entry, tag and mood-day counts. Other properties can say whether a prompt was used, which built-in mood pack was used (all custom packs share one generic category), and the feature where an interaction happened. These events record occurrences, not the content involved.

These app-usage events never include journal entries, titles, prompt text, names, mood ratings, tag names, todos, daily intentions, search text, typed text, dates from your journal, locations, photos, audio, transcripts, or other content you create. We do not use autocapture, session replay, advertising profiles, or tracking across other companies' apps or websites.

Google Analytics for Firebase. The same allowlisted events, with the same properties, also go to Google Analytics for Firebase, operated by Google LLC (United States), which processes them for us as a service provider under the Google Analytics data processing terms. Firebase adds its own standard events for first open (first visit on the web), session start, and engagement time, together with app version, OS version, and device model. It identifies the installation with its own random app-instance ID; the web journal uses a random client ID and Firebase installation ID instead, described under "The web journal". Google receives your network IP address with each request and uses it to estimate an approximate location, such as country and region; Google Analytics does not log or store the IP address itself. We have turned off granular location and device data collection. We never send Google your name, email address, account ID, user properties, an advertising identifier, or Apple's identifier for vendor. We do not turn on Google signals or ad personalization: advertising storage, ad user data, and ad personalization consent are always denied. We do not record automatic screen views. Only the versions distributed through the App Store, Google Play, and journalthing.com send these events; development builds do not.

We use analytics only to improve and operate Journal Thing. The events are processed for us by PostHog, Inc. (United States) under contractual limits that prohibit selling the data or using it for its own advertising. PostHog stores these event records. Our current plan lists a 12-month query window. That window limits access to older events when enforced; it is not a promise that stored events are deleted after 12 months. We have not confirmed a fixed deadline for deletion of all stored copies. Google Analytics keeps event-level data for 2 months under our data-retention setting, and Google deletes data under its data processing terms; aggregated reports built from those events can remain after that. Turning analytics off stops future collection from that device; it does not delete events already sent.

You can turn this off. Settings → Security → "Share anonymous analytics" stops PostHog and Google Analytics usage events and Sentry crash reports and session-health records on that device. The switch does not stop RevenueCat purchase management or its purchase and subscription reporting, described below.

Regional consent controls. We are introducing explicit opt-in for optional analytics and crash reports in the European Economic Area, the United Kingdom, Gibraltar, Jersey, Guernsey and the Isle of Man. In versions with these controls, reporting stays off until you turn it on in Settings when you are in those places. Elsewhere it is on by default after country resolution, and you can turn it off. Session-health records are also opt-in for users in California: they stay off there until you turn reporting on in Settings, and they stay off if the app cannot tell which US state you are in. An existing opt-out is respected everywhere; an older default-on setting is not treated as consent. If country cannot be determined, reporting stays off unless you have explicitly enabled it.

To apply this default, updated versions request a country estimate, and a state or region where available, from our existing Cloudflare service, based on the network IP address, at launch and when returning to the app. The app keeps them only in memory and does not send them or the lookup response to PostHog, Google Analytics, or Sentry. Our service does not log or store the lookup. VPNs and proxies can affect this estimate.

Rollout notice. Older installed versions and the web journal before its consent update may still enable reporting by default. You can turn it off in Settings → Security → "Share anonymous analytics". Publishing this policy does not update an installed app.

Crash reports

If Journal Thing crashes or hits an internal error, a diagnostic report is sent to Sentry (Functional Software, Inc., United States), which processes it for us as a service provider. A report contains technical details such as stack symbols, app version, OS version, device model, the affected feature and operation, a fixed error category, HTTP status family, bounded retry count, and approved app-operation breadcrumbs — never journal entries, titles, tag names, search text, or other content you create, and never an advertising identifier. Updated versions also send Sentry session-health records: when the app started and ended, whether that session crashed, and the app version. In the iPhone, iPad, Mac and Android apps, these records are tied to the app's random installation ID, not to your name, email or account; the web journal's records carry no installation ID. Sentry does not store your IP address. We use these records to see how often each version crashes. Crash reports received during our current Sentry trial have a 90-day retention period in its live service. If the account moves to the free Developer plan, newly received reports have a 30-day period; earlier reports keep the period assigned when received. Sentry deletes individual events after their retention period. Backup copies follow a separate schedule: Sentry deletes them 90 days after each backup is created, so copies may remain after an event leaves the live service. See Sentry's plan retention periods and backup deletion practices. The Settings → Security analytics switch turns crash reporting off along with analytics; it does not erase reports already sent.

No sale of data, ads, or cross-app tracking

We do not sell or rent personal data. We do not show ads, use IDFA or Google signals, or combine Journal Thing data with data from other companies' apps, websites, or offline properties for advertising or ad measurement. We share data only with service providers—Supabase for Journal Thing Sync, Cloudflare for our web service and relay, OpenAI for transcription, RevenueCat for purchase management, PostHog and Google (Google Analytics for Firebase) for limited app-usage analytics, Sentry for crash reports, Resend for feedback and letter delivery, and Hostinger for our support mailbox—or when law requires it. Those providers must protect the data and may use it only to provide their service to us.

Device permissions

• Microphone — only if you use voice dictation, and only while you dictate (see "Voice dictation" above).
• Face ID / Touch ID — only if you turn on biometric unlock. Authentication is handled by your device’s operating system; the app is told only whether it succeeded. We never receive your biometric data.
• Camera and photos — only when you attach a photo to an entry. The camera is used only while you take a picture. To show your recent photos inside the app, iOS and Android ask for photo-library access when you open the photo sheet; you can allow selected photos only, and if you decline, the camera and the system photo picker still work. Photos are stored with your journal on the device. With Journal Thing Sync on, they are uploaded to your account's private storage as described above.
• Notifications — only if you enable reminders. All reminders are scheduled locally on your device. There is no push server of ours, and no notification content ever leaves your device.

Backups you create

Journal Thing can export a backup file of your journal, which you can optionally protect with a passphrase. Backup files are created on your device and go wherever you save or share them using the system's file picker or share sheet. If you choose a passphrase, only you have it — we cannot recover a backup whose passphrase has been lost.

Android's automatic journal snapshots are device-only. Android cloud backup and device transfer exclude the journal databases, their SQLite sidecars, recovery copies and local snapshots. To keep a copy outside the device, export a backup to a location you control or enable hosted sync. Uninstalling, clearing app storage or losing the device can remove local copies. If a newer journal database must be preserved for recovery, the app explains how to export it; that recovery ZIP is unencrypted and is intended for support-assisted recovery, not normal backup import.

Purchases

• iPhone, iPad, and Mac. Journal Thing Premium is sold through Apple's In-App Purchase system. Apple processes the payment and tells the app only whether a purchase is active. We never receive your name, email, or payment details. If you sign in to Journal Thing Sync, the app sends Apple's signed record of your purchase to our server so we can confirm Premium for your account; we keep a hashed transaction reference, the product, its status, and its expiry with the account. We also keep an encrypted copy of the original transaction identifier and product ID so we can check current purchase status with Apple when the app is closed. This does not include your payment details. Apple's handling of that transaction is governed by Apple's Privacy Policy.
• Android. Journal Thing Premium is sold through Google Play Billing. Google processes the payment; we never receive your card, bank, or other payment details, and Google's handling of the transaction is governed by Google's Privacy Policy. Premium features work on the device without an account. If you sign in to Journal Thing Sync, the app associates its purchase identity with your sync account so our server can confirm Premium through RevenueCat. We also support direct verification: the app sends the Play purchase token and product ID to our server to check with Google. We keep a hashed transaction reference, the product, its status, and its expiry with your account. For direct checks with Google, separate encrypted storage holds the purchase token and product ID so we can check status when the app is closed. Deleting your account removes those stored proofs and account links; the retention section below explains the unlinked purchase references we may retain. Google can also notify our server of purchase changes so we can check renewals, refunds and replacement subscriptions even when the app is closed or you have not signed in to sync. We keep hashed purchase-family references to maintain account ownership, and hashed notification receipts to avoid processing the same message twice. Google Cloud Pub/Sub delivers those notifications for us. Its delivery queue temporarily holds the original message, including the purchase token, until our server acknowledges it or the seven-day retention window ends. We do not enable retention of acknowledged messages.
• Purchase management (RevenueCat). We use RevenueCat, Inc. (United States) as a service provider to validate purchases with Apple and Google and to keep Premium status current across your devices. RevenueCat also provides purchase and subscription reports that help us understand how Premium is used. On Android, RevenueCat initializes when you open the app, before a purchase or sync sign-in. It uses a generated installation identifier or the purchase identity already stored on that device to maintain Premium status. The app supplies store purchase records and product identifiers when available. Optional Journal Thing Sync sign-in also gives RevenueCat your sync account identifier so a purchase made before signing in follows the account. Signing out of Journal Thing Sync does not clear RevenueCat's purchase identity on that device, so Premium can remain available after sign-out. RevenueCat never receives your name, email, card, or other payment details. Each time the app contacts RevenueCat, RevenueCat records an approximate country derived from your network IP address; this runs whether or not analytics sharing is on, because purchases depend on it. Apple and Google send RevenueCat notifications about renewals, refunds, and billing problems, and RevenueCat tells our server the resulting Premium status; our server keeps the same hashed transaction reference, product, status, and expiry described above and records that RevenueCat holds data for your account. When you delete your sync account we instruct RevenueCat to delete its records for that account, and the deletion does not complete until that instruction succeeds. If another device still signed in to the deleted account re-creates that record, our server deletes it again, normally within two hours. RevenueCat's backups follow its own practices; its published terms do not state how long they keep deleted records. Purchase records that were never linked to a sync account stay with RevenueCat under the installation identifier and are governed by RevenueCat's Privacy Policy.

Feedback and support

The in-app feedback form sends us the message you type, the email address you choose to enter (optional, so we can reply), and — only if you turn on the per-message toggle, which is off by default — a screenshot of the screen you were on (iPhone and iPad) or an image you choose (Mac). On Mac, you select a screenshot yourself, cover any private details, and confirm your review before attaching it. Screenshots can show your journal, so please check them before sending. On iPhone, iPad, and Mac, diagnostic details, including app version, OS version, device model, and language, are included only when you enable the separate diagnostics toggle for that message; it is off by default. Other platforms include basic technical context to help us reproduce problems. Feedback sent in the app reaches our support inbox through our email delivery provider (Resend, United States). On Mac, reports with screenshots and reports sent without a signed-in Journal Thing account open a draft in your email app instead. You review and send that draft through your chosen email provider. On our current plan, Resend retains email and delivery logs for 30 days; its backups persist for seven days. See Resend's retention practices. Our support mailbox is hosted by Hostinger. We keep the inbox copy only as long as needed to respond and fix the issue; the Resend delivery window does not automatically delete that copy. Messages deleted into Hostinger's Trash may remain there for up to 30 days before permanent deletion, as described in Hostinger's deleted-email guidance. Email to hello@journalthing.com is handled with the same support-retention criteria.

When you delete your Journal Thing Sync account, messages from, to, or about that account's email address are permanently deleted from every folder of our support mailbox, Trash included, within 14 days. Mail that arrives after the deletion is new correspondence. Deleting the account does not remove Resend's copy of feedback you sent; that copy follows Resend's schedule above, up to 37 days in all.

The Journal Thing letter (optional)

If you sign up for the letter on journalthing.com, we store your email address, whether it is waiting for confirmation, confirmed, or unsubscribed, and the times of those changes. The list is kept in our Cloudflare database. To limit abuse, a one-way hash of your connection's IP address is kept for about a day; the address itself is not stored. We use your email only to send the letter, about once a month when something new ships. Nothing is sent until you confirm from the first email, and an unconfirmed sign-up is deleted seven days after its last confirmation email. The letter is sent through our email delivery provider (Resend, United States), which keeps your address in our contact list there and keeps its delivery logs on the schedule above. Every letter has an unsubscribe link that takes effect at once. After you unsubscribe we keep the address marked as unsubscribed so we do not write to it again; to have it deleted entirely, email hello@journalthing.com. The letter is separate from the app: signing up creates no Journal Thing account, and deleting a sync account does not remove a letter sign-up.

Apple's role

• Device backups. If you have iCloud Backup or encrypted local backups turned on in iOS, your device backup may include Journal Thing's data — as it does for other apps. That backup is controlled by Apple and your iOS settings, not by us, and we have no access to it.

Children's privacy

Journal Thing is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided personal information through Journal Thing Sync, analytics, or support, contact us and we will investigate and delete it where required.

Your rights

Rights such as access, correction, deletion, and portability normally apply to data a company holds about you. Unless you sign in to Journal Thing Sync, we do not hold a copy of your journal: entries live on your device. You can export them before removing the on-device copy. On Mac, moving the app to Trash does not remove its journal data; its local data must be removed separately. Earlier iCloud copies and exported backups also remain until you remove them separately.

If you signed in to Journal Thing Sync on any platform, we do hold a copy, and those rights apply to it. You can delete your sync account and its server-held journal with "Delete sync account" (Settings → Your Data on iPhone, iPad and Android; Settings → Sync on Mac) or, in the web journal, Settings → Security → Delete Account. This action removes the account; it does not keep the account while permanently erasing selected journal records. For a copy of your data or another privacy request, email hello@journalthing.com from the address you signed in with. Contact us about requests that the app does not support directly.

PostHog and Google Analytics app-usage analytics, and Sentry session-health records, are associated with random installation or client IDs rather than your name or account. Because we deliberately do not keep a lookup from your identity to those random IDs, an email address alone may not let us locate event-level analytics or session-health records for an individual installation.

Depending on your location and the applicable law, you may also have rights to restrict processing, object to processing, and receive a portable copy of personal data. Where processing relies on consent, you may withdraw it without affecting the lawfulness of earlier processing. Contact us to exercise these rights; some rights have legal limits or exceptions. People in the European Economic Area can complain to their local data-protection authority, and people in the United Kingdom can complain to the Information Commissioner's Office.

Retention and deletion

• on-device journal data is stored in the app. Removing an entry on Android hides it from your journal. Its content and related tag data remain in local storage and, if synced, in server deletion records. Removing an entry does not permanently erase these copies. Deleting your sync account removes its server copy but leaves your local journal. Uninstalling the app on iPhone, iPad or Android removes its local storage. On Mac, moving the app to Trash leaves its journal data in place; local data must be removed separately. Exported backups remain wherever you saved them;
• an earlier iCloud journal copy remains until you delete it through your Apple Account’s iCloud storage controls in iOS Settings;
• Journal Thing Sync data, including uploaded photos, and account details remain until you use "Delete sync account" or ask us to delete the account. They leave our live service when the deletion finishes, and deleted photo files cannot be restored. If a deletion stops partway, our server retries it every hour until it finishes;
• when you delete your account, your account details, synced journal, photos and purchase links are removed from our live service right away, and our own backups and leftover copies are cleared within 14 days. Some services we rely on keep limited copies on their own schedules, and we keep one kind of record to prevent purchase fraud:
  • Within 14 days: our own backups and leftovers. Our database provider, Supabase, keeps daily backups for seven days, so the last backup copy is gone about eight days after the deletion. A daily check removes purchase or sign-in records left behind by a failed cleanup step, normally within two days. If a Google or Apple sign-in does not finish, Supabase keeps a record of that attempt, including the tokens Google or Apple issued for it; a daily cleanup deletes these records once they are a day old. A re-created RevenueCat record is deleted again, normally within two hours, and support mail about the account is deleted within 14 days, as described above;
  • On each provider's own schedule. Cloudflare keeps an encrypted, restorable history of our purchase and sign-in database for up to 30 days, and we cannot shorten it. For up to 30 days after a deletion it still holds earlier versions of the deleted records: the account identifier, encrypted store purchase proofs, the encrypted Apple sign-in token (already revoked with Apple), and hashed rate-limit keys derived from the account identifier. Resend keeps feedback emails for up to 37 days (30 days, plus seven days in backups). Supabase keeps sign-in and access logs, which include the account identifier, email address, and IP address, under its own retention policy, which we do not control, and we cannot delete these logs. Its plan lists seven days for them, but on 27 September 2026 entries from August 2026 could still be read, so they can remain longer. RevenueCat deletes your purchase records when we ask during the deletion; its backups follow its own practices, and its published terms do not state how long they keep deleted records;
  • One exception. We keep hashed Google Play purchase-family references, with no link to your account, to prevent purchase fraud. They are described below;
  • Not linked to your account. PostHog and Google Analytics usage events and Sentry crash reports are not linked to your account and follow the periods described above. Your devices, exported backups and earlier iCloud copies are yours to control, and Apple and Google keep their own purchase records;
• a letter sign-up stays until you unsubscribe or ask us to delete it; an unconfirmed one is deleted seven days after its last confirmation email. Cloudflare's restorable database history can hold earlier versions for up to 30 days, and Resend keeps delivery logs as described above;
• our relay does not retain dictation audio or transcripts after the request; the audio-transcriptions endpoint's published retention rules are described above;
• PostHog and Google Analytics usage events and Sentry crash reports follow the provider retention and deletion practices described above. Turning reporting off stops future collection by those services; it does not erase reports already sent or stop RevenueCat purchase processing;
• app-integrity public keys and hashed installation credentials may be retained for as long as we operate the transcription service because they let us reject replayed or invalid requests. They are not used to analyze app usage or advertising.
• abuse-rate records become eligible for deletion after 24 hours and are pruned on authentication requests and daily scheduled maintenance. Purchase-notification receipts become eligible after 31 days and are pruned daily, including receipts for purchases without a sync account; account-linked receipts and purchase-ownership links are also removed when the account is deleted. To prevent old purchase proofs from restoring deleted ownership, we may retain hashed purchase-family references without the deleted account identifier. These references remain for as long as needed to prevent reuse of those proofs. These scheduled processes are not promises of deletion at an exact hour. Encrypted Apple and Google purchase proofs remain while needed to check the purchase selected for your account, including when a store service is temporarily unavailable. Our scheduled checks remove obsolete proofs once they confirm that a different purchase is selected. Deleting your account removes its stored proofs before the account deletion finishes. These records are separate from the notification queue and hashed receipts. Undelivered Google purchase notifications have the separate seven-day queue limit described above; deleting a sync account does not cancel a Play subscription or erase Google's own transaction records.

Changes to this policy

If this policy changes, we will revise the "Last updated" date above and describe any new data practice clearly before it ships.

Contact

Questions about this policy or about Journal Thing? Email hello@journalthing.com.