WhisprJournal Privacy Policy

SECTION 1

Information We Collect

1.1 Information You Provide

Account information: When you create an account, we collect your email address and a password (stored in encrypted form). We do not collect your full name unless you voluntarily provide it.

Voice entries: When you record a voice entry, the audio is processed on your device and converted to a text transcript. The audio file itself is never transmitted to or stored on our servers. Only the encrypted transcript and nervous system state classification are synced to your account.

Journal content: All journal entries are encrypted on your device using AES-256-GCM encryption before any data leaves your phone. The encryption key (Master Encryption Key) exists only in your device's memory while the App is active and is never transmitted to our servers or stored in plaintext anywhere.

1.2 Information Collected Automatically

Usage data: We may collect anonymous, aggregated usage data such as session frequency and feature usage to improve the App. This data cannot be linked to your identity.

Device information: We may collect device type, operating system version, and app version for diagnostic and compatibility purposes.

Crash reports: If the App crashes, diagnostic data may be collected to help us identify and fix bugs. This data does not include your journal content or voice recordings.

1.3 Information We Do Not Collect

We do not collect, store, or transmit your voice recordings. We do not store your journal entries in plaintext. We do not sell, rent, or share your personal data with third parties for advertising purposes. We do not use your emotional or health data for profiling, targeting, or any commercial purpose beyond providing the App's features to you.

SECTION 2

How We Use Your Information

We use the information we collect to: provide, maintain, and improve the App; authenticate your identity and secure your account; deliver AI-generated responses and nervous system regulation suggestions; send optional push notifications you have opted into; process subscription payments through our payment provider; and respond to support requests.

SECTION 3

Zero-Knowledge Encryption

WhisprJournal uses a zero-knowledge encryption architecture for journal entries. This means: your journal content is encrypted on your device before it is stored or synced. The encryption key is derived from your credentials and held in your device's memory only while the App is open. We do not have access to your encryption key. We cannot read, access, or decrypt your journal entries, even if legally compelled to do so, because we do not possess the key.

You are solely responsible for maintaining access to your account credentials. If you lose access to your account and cannot recover it, your encrypted journal data may be permanently inaccessible. We cannot recover it for you.

SECTION 4

Third-Party Services

We use the following third-party services to operate the App. Each has its own privacy policy governing their data practices:

Supabase (supabase.com): We use Supabase to store encrypted journal data, manage user authentication, and sync data across devices. Supabase stores only encrypted ciphertext of your journal entries.

OpenAI (openai.com): Voice transcripts are sent to OpenAI's Whisper API for transcription and to GPT-4o-mini for nervous system state analysis and reflection generation. OpenAI's data retention policies apply to data sent through their API. We do not send identifying information alongside your transcripts.

RevenueCat (revenuecat.com): We use RevenueCat to manage in-app subscriptions. RevenueCat may collect purchase history and subscription status. We do not share your journal content with RevenueCat.

ElevenLabs (elevenlabs.io): Pre-recorded audio guidance files in the App were produced using ElevenLabs text-to-speech technology. ElevenLabs does not receive any data from App users at runtime.

Google AdMob (admob.google.com): We display advertisements through Google AdMob to support the free tier of the App. AdMob may collect device identifiers and usage data for ad personalization, subject to your device's ad tracking settings. We restrict ad content categories to exclude alcohol, dating, gambling, and sensitive health topics.

SECTION 5

Data Retention

We retain your account data and encrypted journal entries for as long as your account is active. You may request deletion of your account and all associated data at any time by contacting us at the address below. Upon deletion, your encrypted data will be permanently removed from our servers within 30 days.

SECTION 6

Children's Privacy

WhisprJournal is not intended for use by children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us immediately and we will take steps to delete that information.

SECTION 7

Your Rights

Depending on your location, you may have the right to access, correct, or delete your personal information; object to or restrict certain processing; and request a copy of your data in a portable format. To exercise these rights, contact us at the email below.

SECTION 8

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the Effective Date.

SECTION 9

Contact Us