Privacy Policy

1. Information We Collect

Account & Profile Information

Multi-Modal Journal Content

Purchase Information

If you buy a subscription, a path pack, or register a journal, we store what you bought, when, and whether it is still active, together with the customer and subscription references our payment processor gives us.

We never receive your card details. Those go directly from you to Stripe, who process the payment. We could not see or store them even if we wanted to. See section 3 for what Stripe does with them.

Location Information (Optional)

We store only the city name you provide (e.g., "Vienna"), not precise GPS coordinates. This is completely optional and used exclusively to provide local weather information on your dashboard. You can update, change, or delete your location information anytime.

2. How We Use Your Information

• Provide Core Services: Process your journal entries, provide AI-powered insights, track your journaling progress
• Personalization: Customize prompts, recommendations, and insights based on your journaling patterns
• AI Analysis: Analyze your journal content to identify emotional patterns, themes, and growth opportunities
• Communication: Send important account notifications and optional journaling reminders
• Improvement: Analyze aggregated, anonymized data to improve our service

3. AI Processing & Third-Party Services

Some features cannot work without sending your content to a company that provides them. Below is every such company, what reaches it, and when. Nothing is sent to any of them unless you use the feature it powers.

Anthropic (Claude) — analysis of your entries

When you ask for an analysis, the text of that entry is sent to Anthropic for processing. If you photograph a handwritten page, the image is sent so the writing can be read. This happens only when you request an analysis — writing and storing entries never sends them anywhere.

• Anthropic does not use your entries to train their models
• Anthropic may retain content briefly for operational and safety purposes under their own terms before deleting it
• All transmission uses TLS 1.3 encryption

OpenAI (Whisper) — transcription of voice entries

When you record a voice entry and it is transcribed into text, the audio recording is sent to OpenAI and processed by their Whisper speech-recognition service. The transcription is returned to us and stored with your entry. This happens only for voice entries; typed, drawn and photographed entries are never sent to OpenAI.

• OpenAI does not use data submitted through their API to train their models
• Your recording is sent for transcription only, and is not used for voice identification or any other purpose
• All transmission uses TLS 1.3 encryption

Stripe — payments

All payments are processed by Stripe. Your card details go directly to Stripe and never reach our servers — we cannot see them, and we do not store them. We keep only the customer and subscription references Stripe gives us, so we know what you bought and whether it is still active. Stripe acts as an independent controller for payment data under its own privacy policy.

Firebase (Google) — accounts, storage and hosting

We use Firebase for authentication, database and file storage. Your entries live here. Firebase is where your data rests when it is not being actively processed by one of the services above.

We do not sell your data, and we do not share it with anyone other than the processors named here.

4. Data Security

We implement comprehensive security measures to protect your data:

• Encryption: All data is encrypted in transit (TLS 1.3) and at rest (AES-256)
• Secure Storage: Data stored on Firebase servers with enterprise-grade security
• Access Control: Strict authentication and authorization protocols
• Regular Audits: We regularly review and update our security practices

5. Your Rights & Choices

You have full control over your data:

• Access: View all data we have about you through the app's settings
• Export: Download all your journal entries and data in portable formats
• Correction: Update or correct any inaccurate information
• Deletion: Permanently delete your account and all associated data
• Opt-out: Disable AI analysis, notifications, or optional features anytime
• Data Portability: Receive your data in a structured, machine-readable format

6. Data Retention

We retain your data as follows:

• Active Accounts: Data is retained while your account is active
• Deleted Accounts: All personal data is permanently deleted within 30 days of account deletion
• Backups: Backup copies are deleted within 90 days
• Anonymized Data: Aggregated, anonymized analytics data may be retained indefinitely

7. Children's Privacy

Καιρός is designed for users 13 years and older. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us immediately at privacy@kairos-journal.com.

For users between 13-18, we provide additional protections including age-appropriate content, limited data sharing, and crisis resources.

8. International Data Transfers

Your data may be processed in countries outside your residence. We ensure appropriate safeguards are in place:

• EU-US Data Privacy Framework compliance
• Standard Contractual Clauses where required
• Equivalent data protection standards maintained globally

9. Changes to This Policy

We may update this Privacy Policy from time to time. For significant changes that affect your rights:

• We'll notify you by email at least 30 days before changes take effect
• We'll display a prominent notice in the app
• You can object to changes or delete your account before they take effect