Privacy is part of the product’s design: an emotional practice cannot happen safely if you feel watched or monetised. Where processing depends on a choice you make—such as whether the mascot answers or whether AI runs on your device—we describe that distinction directly.
1. What We Collect
| Category | Examples | Purpose |
|---|---|---|
| Account data | Email, display name, selected mascot, role | Authentication and personalisation |
| Journal and Weave data | Embrace text, AI reflections, Weekly Weaves, follow-up conversations | Journaling and reflection features |
| Circle data | Circles, people recorded in them, colours, activity | Your relational map and circle features |
| Subscription data | Tier, billing state, Stripe references | Paid access and billing support |
| Product data | Streaks, progression, milestones, retention setting | Progress and chosen controls |
| Operational telemetry | Device capability, AI routing diagnostics, errors | Reliability on real devices |
| Private-beta application data | Name, email, group category and size, coordination needs, current process, participation readiness, acknowledgements, and optional beta-updates choice | Evaluating and administering private-beta participation |
We do not collect advertising identifiers, contacts from your phone, browsing history outside the App, biometric data, or data from other apps on your device.
Location information
We do not use your device’s location or ask for location permission. Separately, the App includes free-text fields where a postal code can be entered for your own profile or for a person recorded in a circle. Information entered there is stored with your account.
Information about other people
Your circles may contain information about people who do not use the service. Private notes you keep about a person are not shown to another user and are excluded from online AI-provider context.
When someone accepts your invitation, the App may offer them people already in your circles as placement suggestions. Each suggestion can carry a person’s name, picture, mascot, accent colour, and how long they have been in one of your circles. It does not carry birthdays, postal codes, contact channels, social accounts, your relationship label, or your notes.
2. How We Use Your Data
We use data to create and maintain your account; store circles, Embraces, Ledger entries, and Weekly Weaves; generate AI-assisted reflections you request; manage subscription access and billing; evaluate private-beta applications; and support export, deletion, security, reliability, and abuse prevention.
Submitting a beta application permits application-related communication. The separate beta-updates checkbox is optional, unchecked by default, and records whether you asked to receive broader meaningful beta updates.
We do not use your data for advertising or profiling on behalf of third parties, and we do not sell it.
3. AI Processing
On-device AI
On the free tier, with your explicit choice and on a capable device, mascot replies can be generated by a model running inside your browser. In that mode your entry is not sent to Google or Anthropic for that reply.
On-device AI does not make the App offline. The model is downloaded over the network, and your account, circles, Ledger, encrypted entries, artwork, and other services continue to use network infrastructure. The AI prompt stays on your device; the App as a whole does not.
Online AI
Otherwise, the text required for the feature is intentionally sent through our backend to an AI provider. This occurs for online mascot replies, Weekly Weave generation, and follow-up questions. A user-facing public Library submission flow is not currently available.
Online AI features use Google Gemini or Anthropic Claude depending on the feature and plan. Mascot replies try Gemini first on the free tier and Claude first on paid tiers; if that provider is unavailable, the mascot-reply request may be retried at the other provider. Weekly Weaves and Weave follow-up conversations currently remain with their selected provider rather than switching providers.
For a mascot reply, we may send: your entry, your own recent entries to the same person, the mascot’s voice profile, the person’s display name, your relationship label, and the circle name, type, and tone.
For a Weekly Weave, we may also send: counts, moods, energies, and dates of your activity, plus whether a birthday is approaching expressed as a number of days rather than the birth date.
We deliberately exclude from online AI context:
- social accounts and handles;
- hometown or postal code;
- exact dates of birth;
- favourite colour and unused profile fields;
- private notes about people, including Keep note text and tags; and
- internal database identifiers, which are replaced with request-local labels.
If you name someone in text you wrote, that name remains part of the text sent for the requested feature. We do not rewrite your writing.
Provider API keys remain server-side. You can turn off “Let the Mascot Answer” on an Embrace; an entry saved with that option off is not sent to an AI provider.
The App does not currently offer a user-facing action to submit a routine pack for public Library publication. If that changes, this policy will be updated to explain the processing before public submissions are accepted.
We do not use your content to train AI models, and we do not permit it to train models operated by us. Provider handling is governed by the terms under which those services are used; we do not make an unsupported guarantee about a provider’s internal training or retention practices.
4. Encryption and the Vault
Stored vault content—Embrace text, mascot replies, current Weekly Weaves, Keep entries and their history, and repair-session content—is encrypted on your device before upload using XChaCha20-Poly1305. Ciphertext is bound to your account and the record it belongs to.
The content key is generated on your device and is not sent to us. Our database stores wrapped copies of that key in the same database as the ciphertext. Those copies are encrypted under keys derived from a Vault Passphrase you choose and a Recovery Phrase shown to you once. Protection comes from the secrets required to unwrap the key, not from storing the wrapped key somewhere else.
Before your vault is protected, sensitive persistence is blocked. A new vault begins in a temporary bootstrap state, but the App will not save an Embrace, Weekly Weave, Keep version, or repair-session content until you choose your own Vault Passphrase.
You may allow a trusted device to remember an unlock. That device stores a non-extractable wrapped key locally. It is a convenience, not a replacement for your passphrase, and trusted devices can be revoked.
We cannot decrypt stored vault content from the database because we do not hold your Vault Passphrase or Recovery Phrase. This does not mean plaintext never passes through our systems. It does so when you request online AI processing, when a Weave or follow-up answer is composed on our servers before your device encrypts it, and when your device decrypts content and sends it for export assembly.
For current writes, the whole Weekly Weave—including patterns, suggested actions, archetype, active circle names, and aggregate statistics—is held inside the encrypted payload. Weekly Weaves generated before vault encryption existed may retain derived fields in ordinary database columns.
If you lose both your Vault Passphrase and Recovery Phrase, no one—including us—can recover the stored content.
Not everything is vault ciphertext. Circle and contact records—including names, notes, birthdays, and similar fields—are relational database records protected by row-level access controls. Account, billing, subscription, and support records are also ordinary database records. Anonymous public-funnel content uses separate server-readable encryption because it has no account vault.
5. Retention
Profile → Settings offers four journal-text retention preferences: 30 days, 90 days, 1 year (the default), and Forever.
Automatic removal is not running yet. Until it is switched on, your setting records the window you selected rather than describing deletion that is already happening. Text older than that window may still be stored.
The prepared retention process is designed to remove an expired journal entry’s encrypted content and matching version history while leaving structural information such as mood, energy, emotion token, and date. Entries marked Kept and accounts set to Forever are exempt.
Weekly Weaves are stored separately and are not covered by the journal-text retention process. A Weave can contain information derived from an entry whose text is later removed. Delete the Weave separately if you want it removed.
A fixed retention period for private-beta applications has not yet been set. Contact privacy@dunbarrios.com if you want a beta application removed.
6. Sharing and What “Solo” Means
- We do not sell, rent, or trade personal data, journal entries, or relational maps.
- There is no public feed, follower system, broadcast mechanism, or public profile discovery. Journal entries are not published.
- The App does contain account relationships: invitations, mutual connections, circle governance, and structured repair sessions. You initiate these features deliberately.
- Journal entries and private notes about people are not shared with another user through those features.
- An accepted invitation can create placement suggestions containing names, pictures, mascots, colours, and account age as described above.
- Connected people can see one another’s display names. Governance participants can see role holders and votes. Repair-session content is shared with the other participant by design and is encrypted for those participants.
Library artifacts can currently be kept private, shared within an eligible circle, or shared through an unlisted link. The App does not currently offer a user-facing public submission action.
Authorised staff may access ordinary account records where necessary for support, billing, security, abuse prevention, export, and account operations. We are not ad-supported; subscriptions fund the service.
7. Service Providers
| Provider | What they receive | Purpose |
|---|---|---|
| Anthropic | Requested feature text, instructions, and limited context | Preferred paid-plan processing; mascot-reply fallback where applicable |
| The same request categories where applicable | Preferred free-plan processing; mascot-reply fallback where applicable | |
| Google Analytics | Page views, interactions, campaign parameters, approximate location, and browser and device information | Understanding use of the marketing site and whether non-personal campaigns lead to beta interest |
| Supabase | Encrypted vault content and ordinary account, circle, billing, support, operational, and private-beta application records | Database, authentication, functions, storage |
| Stripe | Email and subscription information | Payment processing |
| Vercel | Application requests and standard request logs | Hosting |
| Cloudflare Turnstile | Bot-protection challenge information | Preventing automated abuse |
| Resend | Recipient email for specified public interest and expedition forms | Sending requested confirmations |
The marketing site uses Google Analytics 4 to measure visits and limited interactions, including the private-beta link. Google Analytics uses first-party cookies to distinguish users and sessions. We may attach non-personal campaign labels—such as source, medium, campaign, and creative variant—to these events. We do not send names, email addresses, journal content, or other free-form user text to Google Analytics. Google Signals and advertising personalisation are disabled.
We do not use data brokers, advertising networks, advertising pixels, or third-party advertising cookies.
Operational telemetry. We record scrubbed diagnostics about device capability, model download, AI route, and errors. Prompts, entry text, AI replies, and information about people in your circles are removed from telemetry rather than truncated; error messages are kept short.
8. Payments
Stripe handles payments and subscription management. We do not store card details. Stripe may retain customer and transaction records for legal, accounting, fraud-prevention, and compliance purposes after an App account is deleted.
9. Storage on Your Device and Staying Signed In
The App stores your authentication session in first-party browser local storage. It persists after you close the browser so you can return without signing in again. Signing out clears the authentication session from that device.
The App may also store a trusted-device key, your vault-protection state, short-lived drafts, and interface preferences on your device. These are functional storage, not advertising tracking.
On the marketing site, Google Analytics may set first-party cookies used to distinguish users and sessions. Entry through a configured campaign link also stores non-personal campaign attribution in session storage for the current browser tab so it can accompany the beta-interest journey.
10. Your Controls and Export
In Settings you can change your profile, select a retention preference, protect or re-protect your vault, manage trusted devices, export data, and permanently delete your account.
Export creates .txt, .md, and .csv files covering your profile, mascots, circles and the people in them, Embraces and Ledger history, Keep entries, Weekly Weaves, support conversations, growth portraits, and repair sessions.
Your device decrypts vault content and sends the resulting plaintext through our backend for export assembly. The vault key remains on your device. The per-version history behind Keep entries is currently excluded from export.
11. Deleting Your Account
Deletion is immediate and irreversible. It attempts to cancel an active subscription and removes credentials, encrypted journal and Ledger entries, Keep history, circles and the people in them, Weekly Weaves, progression, support conversations, repair sessions, and wrapped encryption keys from the live service.
Check billing separately. Deletion does not wait for Stripe cancellation to succeed. If you have a paid plan, cancel through the billing portal before deleting or confirm afterwards through Stripe’s own communications that billing has stopped.
| Record | What happens | Reason |
|---|---|---|
| Aggregate metrics | Retained as non-identifying counts | Transparency and service health |
| Stripe records | Retained under Stripe’s policies | Accounting, fraud prevention, compliance |
| Webhook and donation records | Retained with account links removed where applicable | Billing operations and idempotency |
| Operational telemetry | Retained with account links removed where applicable | Performance diagnostics |
| Provider logs and backups | Age out on provider schedules | Security and platform operations |
Export before deleting. There is no undo.
12. Your Rights by Jurisdiction
Wherever you live, you can use the App to export, correct, and permanently delete account data.
EU/EEA. You may lodge a complaint with your local Data Protection Authority. Our stated legal bases for processing are performance of contract and legitimate interest.
California. We do not sell personal information or share it for cross-context behavioural advertising. Contact privacy@dunbarrios.com for disclosure requests.
Washington State. Emotional journaling data may qualify as consumer health data under the Washington My Health My Data Act.
13. Security
We use measures appropriate to the service, including client-side encryption of vault content, infrastructure-provider encryption at rest, row-level database access controls, server-side secret management, HTTPS in transit, multi-factor authentication, input sanitisation, rate limiting, and bot protection on sign-in and public forms.
No system can promise absolute security. If we become aware of a breach affecting your data, we will notify affected users and regulators without undue delay and within the timeframes applicable law requires.
14. Children
The App is not directed at anyone under 16, and you must be 16 or older to create an account. Signup does not currently perform age verification. If we learn that a user is under 16, we will delete their account and content, subject to the limited residual retention described above.
15. Changes to This Policy and Consent
If this policy changes, we will publish the updated text and date here. The App contains a versioned privacy-consent mechanism, but it is not currently enforced. This page does not claim that you have accepted this version through that mechanism.
16. Contact
Privacy: privacy@dunbarrios.com
In-app: Support channel in Settings
Support: DunbarrioSolo support FAQ