Privacy policy

• Your account: the email address you sign up with, or the one Google or Apple gives us.
• Your journal: entries, photos, voice notes and files you attach, the date and time of each entry, and, if you allow it, the place you wrote it.
• Evie's side: your chats with her, her notes about you (people, places, goals), her letters, and summaries she writes so she can answer about a period of your life.
• Settings: her name, reminder times, your plan, and the devices you sync with.
• Problem reports: what you type into "Report a problem", plus the page, app version and device. Nothing from your journal is included unless it is in a screenshot you add.

Your journal is stored on your device and synced through our database, hosted on Supabase, walled off so that only your account can reach it. Attachments are stored the same way. Our server code runs on Vercel.

On a phone, the local copy is encrypted at rest. In a browser, it is stored unencrypted on that device, so sign out on shared computers. Oncepenned is not end-to-end encrypted, because Evie could not read your journal if it were.

The free journal is never sent to any AI company. Writing, photos, voice notes, sync, import and export work without one.

If you add Evie (the subscription), your entries and chats are sent to Anthropic and OpenAI so she can read, search, transcribe and reply. They are processed under those companies' API terms, which do not allow training on your data. That is the only place your journal goes. Entries you mark private are kept out of everything she reads.

We do not sell your data, show ads, or share your journal with anyone else. We will hand data over only when the law requires it.

• Export your whole journal, in Settings, as an archive or in a single format.
• Read, correct or delete what Evie has noted about you, in Settings, and stop her noting anything.
• Delete your account, in Settings. Your journal, attachments, chats and Evie's notes are deleted from our database and from your device. Backups are cleared within 30 days.
• Remove the journal from one device by signing out, which wipes the local copy.

Camera and photos, to attach pictures. Microphone, to record voice notes. Location, only while the app is open and only if you turn it on, to remember where you wrote. Face ID, to unlock the journal on your device; your face never leaves it. Notifications, for the reminders you set.

Oncepenned is for people aged 13 and over. We do not knowingly keep an account for anyone younger; if you know of one, tell us and we will delete it.

If this page changes in a way that matters, the app tells you before the change applies.

Questions or requests about your data: use "Report a problem" in Settings, or email SUPPORT_EMAIL_TO_SET. Oncepenned is made by DEVELOPER_LEGAL_NAME_TO_SET.