Privacy Policy

Introduction

We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, and safeguard your information when you use our service.

Information We Collect

We collect the following types of information to provide and improve Journling:

1. Account Information — Your name, email address, and other details you provide when creating an account.
2. Journal Content — Your Chinese or mixed-language diary text and the English or Spanish drafts, explanations, and learning records generated from it.
3. Usage Data — Information about how you interact with the service, including features accessed, frequency of use, and interaction patterns.
4. Device Information and Cookies — Device, browser, and preference data used for security, localization, and compatibility.

If anonymous English generation is available, we also use a same-browser identifier and a task-specific claim credential in Secure, HttpOnly cookies. Your browser stores your local draft and a small recovery record containing a task ID, a random submission key, a draft fingerprint, and content-free timing/count markers. We use the visitor's IP address in memory to create a rotating keyed hash for abuse limits; the application does not store the raw IP address in the anonymous-generation task table.

First-Party Product Analytics

Journling uses a Secure, HttpOnly first-party product analytics cookie to count visits and understand the path from a first visit through generation, account creation, and payment. The random cookie value remains in the browser; the analytics tables store a hashed browser identifier. A browser profile is a measurement boundary, not an exact person: multiple people can share a browser, one person can use several browsers or devices, and clearing site data creates a new profile. This analytics collection does not collect diary text or page paths.

How We Use Your Information

We use the data we collect to:

• Provide, maintain, and improve the service.
• Process your journal and expression-learning requests.
• Send diary text to our configured AI provider only to generate the requested output; we do not use routine AI run metadata to store complete diary text.
• Send technical notices, security alerts, and support messages.
• Respond to your questions, feedback, and support requests.
• Detect, prevent, and address misuse and security incidents.

Anonymous Generation and Retention

For an anonymous generation, Journling stores the source and complete generated result encrypted at rest in a temporary PostgreSQL task. The limited preview endpoint returns only status information and the first sentence of a longer natural-English result, or a partial sentence when the result has only one sentence. The full result, constructive version, and expression candidates are not returned until a verified account claims the task in the same browser.

An anonymous task is eligible to be claimed for 7 days after creation. Once that time passes, an unclaimed task cannot be completed or claimed. Its encrypted source and result are cleared by cleanup performed when task endpoints run and by a daily scheduled cleanup job. Unvisited expired content normally clears within about 8 days of creation, plus scheduling delay; failed scheduled runs may delay clearing further. Eligibility still ends at 7 days. A successful claim clears both ciphertext fields immediately and saves the source and generated result as an account-owned diary entry. That diary remains in the account until it is deleted through an applicable service process or the user asks us to delete it.

Claim cookies last up to 7 days and remain available after a successful claim to recover an interrupted response. Clearing temporary content does not immediately delete task status and abuse-limit records. Local drafts are separate from that deadline and remain in your browser until you clear them or remove the site's browser data.

Data Sharing

We do not sell your personal information. We may share data only in these limited cases:

• With service providers who help us operate the service, under confidentiality agreements.
• To comply with legal obligations or respond to lawful requests from public authorities.
• To protect our rights, property, or safety, or that of our users.

The configured AI provider processes the journal text needed to produce a result and may retain it under that provider's own terms, privacy policy, and data-control settings. The provider in use is a deployment choice and may change.

Data Security

We implement industry-standard security measures including encryption in transit, access controls, and regular reviews. No method of transmission over the Internet is 100% secure, but we work continuously to protect your information.

Your Rights

You may ask to access, update, export, or delete your personal information by contacting us at the email address below.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by updating the date at the top of this page and, where appropriate, sending a notice through the service.

Contact Us

If you have questions or want to exercise your privacy rights, email support@journling.app.