What we hold, and what we don't

Unfould is operated by [LEGAL ENTITY NAME], [REGISTERED ADDRESS]. For anything in this policy, write to privacy@unfould.com.

Three things, and nothing else:

• Your account.An email address, or the identifier Apple or Google gives us if you sign in that way. If you use Sign in with Apple’s private relay, we never see your real address.
• Your journal. Entry text, titles, dates, moods, photographs, and voice recordings — whatever you put in.
• Diagnostics. Crash reports and basic usage events, so we can tell when the app is broken. These record what happened, never what you wrote.

We do not collect contacts, location, advertising identifiers, or your activity in other apps.

The journal on your device is the real one. Everything is written to local storage first and works with no connection at all.

If you are signed in, entries are also copied to your account so you can read them on another device and get them back if you lose your phone. That copy is held on Supabase, on servers in the United States, and is protected by rules that allow only your own account to read it. Photographs and recordings sit in private storage, reachable only through short-lived links issued to you.

A reflection is written by a language model. Where that happens is up to you:

• On your device. On supported hardware the model runs locally and your writing never leaves the phone.
• In the cloud. If you allow it, the text of the entry is sent to OpenAI to compose the reflection. OpenAI processes it to return a response and, under their API terms, does not use it to train their models.

You can turn this off entirely, and you can clear what Unfould remembers about your past entries whenever you like. Nothing is sent anywhere for a reflection you did not ask for.

Locking an entry hides it behind Face ID, Touch ID, or a passcode on your device. It is kept out of search, out of exports, and shows only its title and date until you unlock it.

Being straight with you about the limit: a locked entry is not separately encrypted.The lock keeps other people out of your phone. It is not designed to withstand someone extracting the device’s storage, and it does not hide the entry from us any more than an unlocked one does.

Nobody, except the services that make the app work — Supabase for storage and accounts, OpenAI for cloud reflections, and Sentry for crash reports. Each gets only what its job needs.

We do not sell your data, share it with advertisers, or use your entries to train any model. If we are ever compelled to hand something over by law, we will tell you unless we are legally forbidden from doing so.

Your journal stays until you delete it. A deleted entry is removed from your device immediately, and its photographs and recordings are deleted from storage. A small record that the entry was deleted is kept so your other devices know to remove their copy too.

Delete your account and everything goes — entries, photographs, recordings, and the account itself. That is immediate and cannot be undone. Export first if you want to keep anything.

Wherever you live, you can get a copy of your journal, correct it, or delete it — all three are in the app rather than behind a support request. If you are in the UK or EU, you also have the right to object to processing, to restrict it, and to complain to your data protection authority.

Our lawful basis for handling your journal is the contract between us — we cannot provide a journal without storing what you write. Cloud reflections rest on your consent, which you can withdraw at any time.

Unfould is not for people under 13, and we do not knowingly hold their information. If you believe a child has created an account, write to us and we will remove it.

If this policy changes in a way that affects what happens to your writing, we will tell you in the app before it takes effect — not quietly, and not by updating a date at the top.