Cloud sync privacy
Last updated:
DRAFT — This policy needs the owner’s legal review before release. Hosting, contact and retention values below are not final.
Data we collect
Cloud sync collects your Google account ID and email, device identifiers, platform, device name and sync times, your synced diary records and photos, and subscription status. Diary records may contain sensitive health data. Google authentication tokens are not retained.
Purpose and consent
We use cloud data only to sync between your own devices and provide your account controls. Cloud processing relies on your explicit consent, including consent for sensitive health data under LGPD/GDPR. Consent is optional and versioned. You can keep using the app offline and withdraw cloud consent by deleting your cloud data.
Storage and protection
Cloud data is hosted on a Hetzner VPS. Region: [HOSTING REGION - owner to confirm]. TLS protects data in transit. Per-user AES-GCM encryption protects synced records and photos at rest. Account access is restricted to the owner. The service processes synced data; this is not end-to-end encryption. No system can guarantee absolute security.
Your rights
Export a ZIP with JSON records and synced photos at any time, even without Premium. Deleting cloud data withdraws cloud consent and keeps your account; new uploads require consent again. Deleting the account removes its cloud data, devices, tokens, entitlements and account details. Both operations leave local diaries intact. Account deletion does not cancel store subscriptions.
Retention and deletion
DRAFT RETENTION VALUE — Active cloud copies are deleted during the requested operation. Proposed backup purge: within 30 days; owner must confirm before release. Proposed technical audit retention: 90 days; owner must confirm. Account deletion retains only audit records with opaque internal IDs and fixed action labels, without email, Google account ID or IP address. No automatic purge on Premium expiry is implemented.
Diagnostics
The app's Send diagnostics switch controls what the app sends; server telemetry is technical only and contains no diary content.
Ads and store services
The cloud portal has no ads. The mobile app may use Google AdMob and device advertising identifiers; those services have their own privacy terms. Subscriptions are billed and managed by Google Play, Apple or Microsoft. Cloud sync is optional and does not replace the app’s offline features.
Therapist sharing
Therapist sharing is not available. Any future sharing feature will require separate explicit consent.
Contact
For privacy requests, access, corrections or questions: [PRIVACY CONTACT - owner to confirm].