Privacy Policy
Last updated: 15 August 2026
This app is a private journal, and what you write in it is yours. This policy explains what we collect, why, who else is involved in running the service, and the choices you have. Your use of the app is also governed by our Terms of Service.
In short
- Your entries are encrypted with a key unique to your account: a stolen database or backup is unreadable.
- Your entries are never used to train any AI model.
- We don't sell your data, don't show ads, and put no one but Apple in the payment path.
- The app has no analytics tracker and stores nothing on your device to measure you.
- Delete means delete: deleting your account permanently destroys the key to your data.
- You sign in with Apple, so there's no password to lose.
1. Who we are
The service is provided by The Amsterdam Tech Company ("we", "us"), the data controller for the personal data described here.
| Controller | The Amsterdam Tech Company |
| Address | Korte Lijnbaanssteeg 1, Office 4468, 1012 SL Amsterdam, Netherlands |
| Chamber of Commerce (KVK) | 97338605 |
| VAT | NL004697898B30 |
| Contact for privacy matters | info@amsterdamtechcompany.com |
| Supervisory authority | Autoriteit Persoonsgegevens (the Dutch Data Protection Authority) |
To reach us about anything in this policy, including to exercise any of your rights in §8, email info@amsterdamtechcompany.com.
2. What we collect, why, and our legal basis
We collect only what the service needs. Here is everything, why we hold it, and the legal ground under the GDPR for holding it.
| What | Why | Legal basis |
|---|---|---|
| Your journal entries and what the app builds from them: its understanding of you, and your reflections and chats | To provide the journal and produce your reflections, nudges and chats | Your explicit consent (Art. 9(2)(a), see §4) for this sensitive content, as part of the service you subscribed to (Art. 6(1)(b) contract) |
| Account identifier (an opaque, random id we mint), your Apple sign-in identifier, and an email if Apple gives us one (often a private relay address) | To create your account, sign you in, and reach you about the service | Contract (Art. 6(1)(b)) |
| Display name, if you set one | To personalise what you read | Contract (Art. 6(1)(b)) |
| Subscription and entitlement state, and a usage ledger recording each AI request's cost, token counts and timing, never any of your content | To manage your subscription, apply fair-use limits, and keep accounting records | Contract (Art. 6(1)(b)) and our legal obligation to keep accounting records (Art. 6(1)(c)) |
| Product analytics: a small, fixed set of content-free events (for example, that an entry was created, or that a reflection was produced), tied to your opaque account id | To understand how the product is used so we can run and improve it | Our legitimate interest (Art. 6(1)(f)), see §7 |
| Security signals: transient IP addresses while applying rate limits, spend caps, and a one-way fingerprint used to prevent abuse | To protect your account and our service from abuse and runaway cost | Our legitimate interest (Art. 6(1)(f)) |
| Error diagnostics: technical fault metadata (an error type and where in our code it happened), with your content and request details stripped out before they leave our servers | To find and fix faults | Our legitimate interest (Art. 6(1)(f)) |
| Quality feedback, if you choose to write it: a rating and an optional note on a reflection | To evaluate and improve the AI's quality | Your consent (writing a note to us is the consent) |
| Reports, if you choose to file one: the reason, your optional note, and (when you report a specific AI response or part of your story) a copy of that exchange or that part, which is readable to us so we can review it | To keep the service safe and act on harmful or inappropriate AI output | Your consent (choosing to report is the consent) and our legitimate interest in the safety of the service (Art. 6(1)(f)) |
We do not collect: advertising identifiers, your contacts, your location, a device fingerprint, or any behavioural profile beyond the content-free analytics in §7.
3. Sign-in and payment
You sign in with Sign in with Apple. There is no password for us to store or for anyone to breach. Apple tells us an opaque identifier and, if you allow it, an email address (which may be a private relay).
You subscribe through Apple's in-app purchase. Apple is the merchant of record and handles all payment details: we never see your card. There is no other payment processor. For sign-in and payment, Apple acts as its own independent controller under its own privacy policy.
4. Your journal, and how we treat sensitive information
A journal can hold some of the most personal things you write, so the law treats it as sensitive information. We process your entries only with your explicit consent, which we ask for when you start using the app: to store them, and to produce your reflections, nudges and chats.
You can withdraw your consent at any time by deleting your account, which erases your entries (§5). Withdrawing does not affect anything we lawfully did beforehand. Your entries are protected the whole time we hold them (§5).
5. How your journal is protected
- Encrypted at rest with a key unique to your account. Every entry, and everything the app derives from it, is encrypted with its own per-account AES-256-GCM data key. That key is itself wrapped by a master key held in a hardware security module in the EU that the key never leaves. If our database or a backup were stolen, it would be unreadable.
- The whole chain is encrypted: not only your entry text, but the understanding the app builds from it, the quotes it keeps, and your conversations.
- Encrypted in transit (TLS 1.2 or greater) and on encrypted disks.
- Readable only when the AI is working for you, or when you choose to report a response to us. Your entries are decrypted on our servers only while the AI is actively producing your reflections; the rest of the time they stay encrypted. The one exception you control: if you report a specific AI response or part of your story, we keep a readable copy of that exchange so we can review it. Like any app where an AI works on your writing, it is not end-to-end encrypted.
- Never in logs, never to any analytics service. Your journal content is never written to our logs and is never sent to any analytics provider.
Delete means delete
When you delete your account, we destroy the key to your content. Your entries, the understanding built from them, your quotes and your conversations become permanently unrecoverable, including in our backups. This is immediate and irreversible.
A few deliberate, limited things survive deletion, none of which contain your journal content:
- the content-free usage/accounting ledger (cost, tokens, timing), which we are legally required to keep as an accounting record;
- any feedback notes you chose to write to us; and
- a one-way fingerprint of your sign-in credential, used only to prevent abuse: it cannot be turned back into your identity.
We also delete your product-analytics records, and any reports you filed, when you delete your account (see §7).
6. Who else is involved, where your data goes, and for how long
The companies that help us run the service
We use a small number of carefully chosen providers. Each processes data only on our instructions and under a data-processing agreement, and each is bound to protect it.
| Provider | What they handle | Where |
|---|---|---|
| Apple | Your sign-in identity and all payment data (as its own controller) | Global |
| Anthropic | Your journal content, to produce the understanding, nudges and reflections. Retained for at most 30 days, then deleted; never used to train any model. | United States / global |
| DigitalOcean | Hosting, holds only your encrypted data | Amsterdam, EU |
| Cloudflare | Encrypted backups only, an encrypted archive it cannot read | EU-location storage (US-owned company) |
| Google Cloud | Custody of the master key only, never any content | EU (europe-west4) |
| PostHog | Content-free product analytics under your opaque id (§7) | EU (Frankfurt) |
| Sentry | Error diagnostics: technical metadata only, no content | EU (Germany) |
Each provider's name above links to its own privacy policy.
International transfers
Your data is hosted in the EU. Several of our providers are US-based companies: Anthropic processes your entries in the US or globally, under the EU Standard Contractual Clauses; our other providers host your data within the EU, under the EU–US Data Privacy Framework and Standard Contractual Clauses.
You can request a copy of the safeguards that apply to these transfers, the Standard Contractual Clauses, by emailing us at info@amsterdamtechcompany.com.
How long we keep things
| Data | Retention |
|---|---|
| Your entries, the understanding, conversations and corrections | Until you delete them or your account, no automatic expiry |
| Account identity: your account id, Apple sign-in identifier, email and display name | For the life of your account; destroyed when you delete it |
| Subscription and entitlement state | For the life of your account; destroyed when you delete it |
| Usage/accounting ledger | Kept as required by Dutch accounting law (7 years), then deleted; contains no content |
| Feedback notes you wrote | Kept while useful for quality work; you consented by writing them |
| Reports you filed | Kept while needed to review safety; deleted when you delete your account |
| Product analytics | 1 year |
| Encrypted backups | A short rolling window (about 30 days), after which the old backup is discarded |
| Error diagnostics | Kept by our monitoring provider for a limited diagnostic period, then deleted |
| Security fingerprint (abuse prevention) | Kept only as long as needed to prevent abuse |
7. Product analytics
We keep a small, content-free record of how the app is used (for example, that an entry was created or a reflection was produced) so we can understand and improve the product. It is tied to your account id, never your name, email, or anything you wrote, and it is collected on our servers: the app has no analytics tracker and stores nothing on your device to measure you.
We rely on our legitimate interest (Art. 6(1)(f)) for this, and have assessed that it does not override your rights. You can object at any time: email us and we will stop collecting analytics tied to your account and delete your analytics record; we also delete it when you delete your account.
We don't sell data, run ads, build advertising profiles, or make automated decisions about you.
8. Your rights
Under the GDPR you have the right to:
- Access: get a copy of the personal data we hold about you.
- Portability: receive that data in a structured, machine-readable form.
- Rectification: correct anything inaccurate. You can edit or delete your entries directly in the app at any time, and use the app's built-in corrections to fix how the service has understood you.
- Erasure: delete your account and data. You can do this yourself in the app (see §5), or ask us to.
- Restriction: ask us to limit how we process your data.
- Object: object to processing based on our legitimate interests, including the analytics in §7.
- Withdraw consent: where we rely on your consent (your journal content, §4; feedback notes), withdraw it at any time, without affecting what we lawfully did beforehand.
How to exercise them. For access or portability, email info@amsterdamtechcompany.com; we will verify that the request is really yours and reply within one month. For erasure, the fastest route is to delete your account in the app; you can also email us. For the analytics objection, see §7.
Complaints. If you believe we have mishandled your data, you can lodge a complaint with the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), the Dutch supervisory authority, or with the data protection authority in your own EU country. We would appreciate the chance to put it right first. Please do contact us.
9. Automated decisions and profiling
The app produces reflections and nudges from what you write: the service doing what you asked, not decisions made about you. We do not carry out automated decision-making with legal or similarly significant effects (Article 22 of the GDPR), and we do not profile you for advertising.
10. Children
The app is not directed at children and is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has used the app, contact us and we will delete the account.
11. Changes to this policy
If we change this policy, we will update the date at the top and, for anything that materially affects you, tell you in the app. Continuing to use the service after a change means the updated policy applies.
12. Contact
Questions, requests, or concerns about your privacy:
The Amsterdam Tech Company
Korte Lijnbaanssteeg 1, Office number 4468, 1012 SL Amsterdam, Netherlands.