Privacy Policy

Last Updated: October 10, 2026

1. Introduction

This Privacy Policy explains how Asthra LLC, doing business as VākJournal ("VākJournal," "we," "our," or "us"), collects, uses, discloses, retains, and protects information when you use the VākJournal mobile application, website, features, content, subscriptions, and related services (collectively, the "Service").

Please read this Privacy Policy carefully. If you do not agree with this Privacy Policy, do not access or use the Service.

This Privacy Policy should be read together with our Terms of Service.

2. Information We Collect

We collect information you provide directly, information generated when you use the Service, and information collected automatically through the app and our service providers.

Account and Profile Information

We may collect:

• Phone number for phone-based authentication, or Apple sign-in information when you use Sign in with Apple
• First name or display name, if provided, including a name supplied through Sign in with Apple
• Email address, if provided
• Profile picture, if provided
• Account settings, including your voice, color theme, and conversation preferences
• Notification preferences

Journal and Voice Content

We may collect or process:

• Voice audio during a journal session to generate a transcript
• Transcriptions generated from voice audio
• Journal conversation content
• AI assistant responses
• Journal entries and reflections
• Growth moments and insights
• Weekly insight summaries
• Mood-related reflections or patterns, if generated through the Service
• Action items, if created through the Service
• Conversation context and personalization preferences

We do not persistently store voice audio recordings after transcription is completed. We store the transcript and related journal content, but not the underlying audio recording.

Your journal content may include personal, sensitive, or third-party information that you choose to say or enter during a journal session.

Subscription Information

We may collect:

• Subscription status, such as active, trialing, expired, or canceled
• Plan type, such as monthly or annual
• Trial start and end dates
• Subscription expiration date
• Purchase and entitlement information provided through RevenueCat and the applicable app store

We do not collect, store, or have access to your payment card number, bank account number, or full payment credentials. Payment processing is handled by the applicable app store provider, such as Apple App Store or Google Play Store if the Service becomes available there. We receive subscription and entitlement information through RevenueCat, our subscription management provider.

Automatically Collected Information

We and our service providers may collect:

• Device type, operating system, app version, and device settings
• Pseudonymous user or device identifiers
• Session information
• Feature interactions
• App usage events
• Subscription entitlement events
• Crash reports, diagnostics, error logs, and performance data
• Approximate technical information such as IP address or network metadata, where collected by our infrastructure or service providers

We do not intentionally send full journal transcripts, voice recordings, or audio file URLs to analytics or crash-reporting providers.

3. How We Use Your Information

We use the information we collect to:

• Create, authenticate, and manage your account
• Provide, operate, maintain, secure, and troubleshoot the Service
• Process voice audio during journal sessions and generate transcriptions
• Generate AI-powered summaries, reflections, themes, growth moments, and related insights
• Create personalized conversation context based on your journal entries, reflections, growth moments, preferences, and prior use of the Service
• Save, display, export, and delete your journal content and related data
• Manage subscriptions, trial periods, entitlements, account status, and access to paid features
• Send technical notices, authentication messages, account alerts, service messages, and support communications
• Send reminders or notifications if you enable them
• Respond to your questions, requests, feedback, and support inquiries
• Detect, prevent, investigate, and respond to fraud, abuse, security incidents, service misuse, and unlawful activity
• Analyze app usage patterns, onboarding flows, feature interactions, crashes, diagnostics, and performance using pseudonymous identifiers where appropriate
• Improve app reliability, usability, onboarding, personalization, and product experience
• Comply with legal obligations, enforce our Terms, and protect our rights, users, and Service

4. Data Security

We implement industry-standard security measures to protect your data:

• Encryption in transit: All data transmitted between your device and our servers is encrypted using TLS/SSL
• Encryption at rest: All data stored on our servers is encrypted using industry-standard encryption
• Secure authentication using phone verification or Sign in with Apple
• Periodic security reviews, monitoring, and updates
• Secure cloud storage with access controls and monitoring

5. Data Sharing and Disclosure

We do not sell your personal data. We do not use your identifiable journal content for advertising.

We disclose information to service providers and third parties only as described in this Privacy Policy, including to operate, secure, analyze, troubleshoot, and improve the Service; process subscriptions; provide AI-powered features; comply with legal obligations; prevent fraud or abuse; and protect our rights, users, and Service.

Service Providers

We use service providers to help operate the Service. These providers may process information on our behalf for purposes such as hosting, authentication, database storage, voice processing, AI processing, analytics, crash reporting, subscription management, security, support, and app operations.

Service providers are authorized to process information only for the purposes described in this Privacy Policy and their agreements with us.

AI and Voice Processing Services

A journal session is a live conversation with an AI companion. We use the following providers to hold the conversation and create your entries and insights.

OpenAI processes the conversation text and generates replies. After a session, it creates entry titles, summaries, and themes. It also supports growth moments, weekly insights, and search. We send OpenAI:

• What you say, as text, and what the companion says back
• Your first name, or the display name you set, so the companion can greet you
• Context from earlier entries and your conversation preferences
• Your on-screen prompt, the current date, and your time zone
• Saved transcripts and related journal text for entries, insights, and search

Daily carries live audio between your device and our server. It transcribes your speech during the session. Daily receives your voice and technical session information, including a session identifier.

ElevenLabs turns the companion's text into speech. It receives the companion's words, which can include your name or details from the conversation. It does not receive your microphone audio through this voice-generation step.

VākJournal does not keep voice recordings after live processing. We keep transcripts and related journal content. Provider retention and logs follow the applicable provider policies and our service agreements; this is not a promise of zero provider retention.

We do not intentionally include your phone number, email address, profile picture, or internal account ID in OpenAI conversation prompts. Your spoken words can contain personal or sensitive information, including information about other people. That information becomes part of the transcript.

Your consent. Before your first journal session after sign-in, the app explains what it sends and asks you to agree. You can open “See all details” to read more. No signed-in journal session starts, and no speech from that session is sent, until you agree. Account authentication and app operations are separate from this consent. You can change your name in Account.

We do not use your identifiable journal content for advertising. We do not use your identifiable journal content to train third-party AI models.

OpenAI states that API data is not used to train its models unless the customer opts in. Its default abuse-monitoring logs may contain customer content and are retained for up to 30 days. Longer retention can apply for legal or safety reasons. Different approved data controls may also apply. See OpenAI's data controls.

Analytics and Error Tracking

We use analytics and error-tracking services, including PostHog and Sentry, to understand app usage, improve onboarding, diagnose bugs, monitor performance, and improve reliability.

We do not intentionally send full journal transcripts, voice recordings, or audio file URLs to analytics or crash-reporting providers.

We may send pseudonymous identifiers, app events, feature interactions, device information, app version, session information, crash logs, diagnostics, and performance data. We avoid sending raw phone numbers, email addresses, names, or journal content to analytics and crash-reporting providers.

Pseudonymous identifiers are not intended to directly identify you, but they may still be considered personal information under some privacy laws.

Legal, Safety, and Fraud Prevention

We may disclose information if we believe it is reasonably necessary to:

• comply with applicable law, legal process, or government requests;
• enforce our Terms of Service;
• detect, prevent, or investigate fraud, abuse, security incidents, or misuse of the Service;
• protect the rights, safety, and security of VākJournal, our users, or others; or
• respond to an emergency or prevent serious harm, where legally permitted or required.

Business Transfers

If VākJournal or Asthra LLC is involved in a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar transaction, your information may be disclosed or transferred as part of that transaction, subject to this Privacy Policy or a policy with materially similar protections.

6. Your Rights and Choices

Depending on where you live, you may have certain rights regarding your personal information. These rights may include the ability to:

• access the personal information we maintain about you;
• update or correct your account and profile information;
• delete your account and associated data;
• export your journal data in JSON format;
• opt out of certain notifications and communications;
• request that we restrict or limit certain processing of your personal information; and
• contact us with questions or requests about how your information is handled.

Account Deletion

You can delete your account in the app:

1. Go to Account → Data Management
2. Tap "Delete Account"
3. Confirm deletion

Account deletion cannot be undone. Before deleting your account, we recommend exporting your journal data if you want to keep a personal copy.

Data Export

You can export your data in JSON format:

1. Go to Account → Data Management
2. Tap "Export My Data"
3. Save the JSON file with your data

Notifications and Communications

You can manage reminder and notification preferences in your app settings or device settings. You may also opt out of non-essential communications where an opt-out mechanism is provided.

Privacy Requests

You may contact us at privacy@asthrasolutions.com to request access, correction, deletion, export, or other privacy-related assistance.

We will respond to privacy requests as required by applicable law. We may need to verify your identity before completing certain requests.

7. Data Retention and Deletion

Active Account Data Retention

We retain personal information for as long as your account is active or as long as reasonably necessary to provide, secure, maintain, and improve the Service; comply with legal obligations; resolve disputes; enforce our Terms; prevent fraud or abuse; and protect our rights, users, and Service.

Account Deletion

You can delete your account through Account → Data Management. Account deletion cannot be undone. Before deleting your account, we recommend exporting your journal data if you want to keep a personal copy.

Deleting your account does not cancel your Apple App Store or Google Play Store subscription. You must cancel your subscription separately through your device's subscription settings to stop future charges. We will remind you of this during the account deletion process.

Data Deleted or De-Identified After Account Deletion

When you delete your account, we delete or de-identify account data and associated journal data from active systems, including:

• Profile information, such as name, email address, phone number, and profile picture
• Journal entries, conversation transcripts, and related metadata
• AI-generated insights, summaries, themes, sentiment analysis, and growth moments
• Weekly insights and aggregated summaries
• Conversation context, personalization preferences, and AI memory
• Notification preferences and push tokens
• App session records and authentication links
• Cached local app data, where controlled by the app

Some deletion processes may occur immediately, while others may take additional time due to technical processing, object storage deletion, service-provider systems, logs, and backup rotation.

Voice Audio

We do not persistently store voice audio recordings after transcription or real-time processing is completed. Because voice audio is not stored as part of your account, there are no stored audio recordings to delete when you delete your account.

Transcripts generated from voice audio are treated as journal content and are deleted or de-identified as described in this section.

Analytics, Logs, and Diagnostics

We may retain pseudonymous analytics data, app event data, crash reports, diagnostics, performance data, and security logs for product improvement, reliability, fraud prevention, security, and debugging.

We do not intentionally retain full journal transcripts, voice recordings, or audio file URLs in analytics or crash-reporting tools. Pseudonymous analytics and diagnostic data may not identify you directly, but it may still be considered personal information under some privacy laws.

Backups

Deleted data may remain in encrypted backups for a limited period before being permanently removed through normal backup rotation. Backup retention periods may vary but are generally expected to be between 30 and 90 days. Backups are used only for disaster recovery, security, and business-continuity purposes.

Legal, Security, and Compliance Retention

We may retain limited information longer if reasonably necessary to:

• comply with applicable law, legal process, tax, accounting, or regulatory obligations;
• detect, prevent, or investigate fraud, abuse, security incidents, or misuse of the Service;
• resolve disputes or enforce our Terms;
• protect the rights, safety, and security of VākJournal, our users, or others; or
• maintain records of privacy requests, deletion requests, consent, and account actions.

Data Deletion Timeline

8. Children's and Teen Privacy

The Service is intended only for users who are 18 years of age or older. We do not knowingly collect personal information from anyone under 18.

If we discover that a person under 18 has created an account or provided us with personal information, we will delete the account and associated information, subject to limited retention where required for security, fraud prevention, legal compliance, dispute resolution, or backup rotation.

If you believe someone under 18 has provided personal information to VākJournal, contact us at privacy@asthrasolutions.com.

9. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence, including the United States. These countries may have data protection laws that differ from those in your country. Where required by applicable law, we use appropriate safeguards for international transfers.

10. Third-Party Services and Data Processing

Services We Use

Supabase (Database & Authentication)

• Purpose: Store your data securely with encryption
• Data: All journal entries, profile information, and app data
• Location: Cloud infrastructure with global availability
• Privacy: Row-level security ensures users only access their own data

OpenAI (AI Conversation and Journal Processing)

• Purpose: Hold conversations and generate entries, reflections, and insights; support journal search
• Data: Conversation text, first or display name, earlier journal context, preferences, prompts, date and time zone
• Data after a session: Saved transcripts and related journal text
• Privacy: We do not intentionally include your phone number, email, profile picture, or account ID in conversation prompts
• Training: OpenAI states that API data is not used to train its models unless the customer opts in
• Details: OpenAI data controls

Daily (Live Audio and Transcription)

• Purpose: Carry live audio and turn speech into text
• Data: Voice audio and technical session information, including a session identifier
• Retention: VākJournal does not keep voice recordings after live processing; Daily's handling follows its policy and our service agreement
• Policy: Daily Privacy Policy

ElevenLabs (Companion Voice)

• Purpose: Turn the companion's text into speech
• Data: Companion replies, which can include your name and details from the conversation
• Retention: Provider handling follows its policy and our service agreement
• Policy: ElevenLabs Privacy Policy

PostHog (Analytics)

• Purpose: Product analytics and feature usage tracking
• Data: Pseudonymous identifiers, usage patterns, feature interactions, app events, device/app metadata
• Privacy: We avoid sending raw phone numbers, email addresses, names, journal transcripts, voice audio, or audio file URLs to PostHog
• Note: Pseudonymous identifiers are not intended to directly identify you, but they may still be considered personal information under some privacy laws

RevenueCat (Subscription Management)

• Purpose: Manage subscription entitlements, trial periods, and purchase validation
• Data: Pseudonymous app user ID, subscription status, plan type, purchase dates, and device identifiers such as Vendor ID on iOS where collected by the SDK
• Privacy: We do not intentionally send name, phone number, email address, journal transcripts, or voice audio to RevenueCat
• Policy: https://www.revenuecat.com/privacy

Sentry (Error Tracking)

• Purpose: Monitor app crashes and performance issues
• Data: Error logs, stack traces, device information, app version, diagnostics, and performance data
• Privacy: We avoid sending raw phone numbers, email addresses, names, journal transcripts, voice audio, or audio file URLs to Sentry

11. Changes to This Privacy Policy

We may update this privacy policy from time to time. We will notify you of any changes by posting the new privacy policy on this page and updating the "Last Updated" date. Major changes affecting data deletion or retention will be communicated via email or in-app notification.

Recent Updates:

• October 10, 2026: Clarified first-name sharing, signed-in session consent, Apple sign-in, and the roles of OpenAI, Daily, and ElevenLabs.
• March 14, 2026: Added subscription data collection, RevenueCat as third-party service, subscription billing warning on account deletion
• November 24, 2025: Added detailed account deletion process, data retention specifics, and data export functionality

12. Contact Us

If you have questions or concerns about this privacy policy or our data practices, please contact us at:

Email: privacy@asthrasolutions.com
Company: Asthra LLC

For privacy-related requests (data access, deletion, export):

• Use the in-app Account → Data Management section
• Or email privacy@asthrasolutions.com with your request

For general support:

• Email support@asthrasolutions.com

Version: 3.2
Effective Date: October 10, 2026
Previous Version: May 10, 2026