What we hold, and what we don't

Unfould is operated by Michael Olubode, who is the controller of the information described here. For anything in this policy, write to privacy@unfould.com.

Four things, and nothing else:

• Your account.An email address and a display name, or the identifier Apple or Google gives us if you sign in that way. If you use Sign in with Apple’s private relay, we never see your real address.
• Your journal. Entry text, titles, dates, photographs, and voice recordings — whatever you put in — along with the reflections and patterns written from them.
• Your subscription status. Whether you are on a trial, subscribed, or lapsed. Not your card — see below.
• Diagnostics. Product events and crash reports, so we can tell when the app is broken. These record what you did — an entry was created, the paywall was opened, an unlock failed — never what you wrote.

We do not collect contacts, location, advertising identifiers, or your activity in other apps. Reminders are scheduled on your device, so there is no push token and no server that knows when you write.

The journal on your device is the real one. Everything is written to local storage first and works with no connection at all.

If you are signed in, entries are also copied to your account so you can read them on another device and get them back if you lose your phone. That copy is held on Supabase, on servers in Oregon, in the United States, and is protected by rules that allow only your own account to read it. Photographs and recordings sit in private storage, reachable only through short-lived links issued to you.

This is the part worth reading closely. Four features send the text of your entries somewhere beyond your own account:

• Reflections. On supported hardware Unfould uses Apple Intelligence and the writing never leaves your phone. Where that model is unavailable, or the entry is long, the text is sent to OpenAI instead. The app makes that choice automatically, at the moment you ask for a reflection. Nothing is sent for a reflection you did not ask for.
• Journal Memory. So a question can land in context, entries are turned into a numeric representation by OpenAI as they back up. This one runs on its own, in the background, rather than when you press something.
• Patterns. Reading across your past entries is the whole feature, so composing a pattern can send them to the same providers as a reflection.
• Search. Searching by meaning rather than exact words sends what you typed in the search box, and nothing else.

OpenAI processes this only to return a result to us. Under their API terms they do not use it to train their models, and we do not either.

Being straight with you: this version of Unfould has no switch to turn cloud processing off. The routing is automatic and Journal Memory is on. What you can do today is clear the remembered context whenever you like, from You → Journal Memory, which deletes it from our side. A setting to choose the provider is something we intend to add, and we would rather say so here than imply you already have one.

Dictation is handled by Apple’sspeech recognition, the same one behind the microphone on your keyboard. Depending on your device and language, Apple may process that audio on its own servers. It is governed by Apple’s privacy policy rather than ours, and no recording of it is kept.

A voice memo is different — it keeps your actual voice as a file, on your device and in your private storage. We do not transcribe voice memos, and they are not sent to any third party.

Locking an entry hides it behind Face ID, Touch ID, or a passcode on your device. It is kept out of search, out of exports, and shows only its title and date until you unlock it.

Being straight about the limit: a locked entry is not separately encrypted.The lock keeps other people out of your phone. It is not designed to withstand someone extracting the device’s storage, and it does not hide the entry from us any more than an unlocked one does.

Nobody, except the companies that make the app work. Each is bound to process what it receives only to do its job, and each gets only what that job needs:

• Supabase — your account, your entries, and your photographs and recordings.
• OpenAI — entry text, for the four features named above.
• Apple — sign-in, dictation, on-device reflections, and payment.
• Google — sign-in, if you choose it.
• RevenueCat — your subscription status, keyed to your account identifier. No email address, and no journal.
• PostHog — diagnostics, with your account identifier, email, and display name attached. Hosted in the United States.
• Resend — sending you a password reset code, and nothing else.

We do not sell your data, share it with advertisers, or use your entries to train any model. If we are ever compelled to hand something over by law, we will tell you unless we are legally forbidden from doing so.

Subscriptions are sold and billed by Apple. Your card details go to Apple and never reach us — what we receive, by way of RevenueCat, is whether your subscription is active. That is all it takes to unlock the paid features, so that is all we ask for.

Your journal stays until you delete it. A deleted entry is removed from your device immediately, and its photographs and recordings are deleted from storage. A small record that the entry was deleted is kept so your other devices know to remove their copy too.

Delete your account and everything goes — entries, reflections, photographs, recordings, Journal Memory, and the account itself. That is immediate, it is not a queue, and it cannot be undone. Export first if you want to keep anything.

Wherever you live, you can get a copy of your journal, correct it, or delete it — all three are in the app rather than behind a support request. You → Export your entries takes a copy; You → Delete account removes everything.

If you are in California, you have the right to know what we collect, to delete it, to correct it, and not to be discriminated against for asking. We do not sell or share personal information as those words are defined there, so there is nothing for you to opt out of. If you are in the UK or EU, you also have the right to object to processing, to restrict it, to take your data elsewhere, and to complain to your data protection authority.

Our lawful basis for handling your journal is the contract between us — we cannot provide a journal without storing what you write, and the reflection, pattern, and search features are part of what you signed up for. You may object to that processing at any time by writing to us.

Unfould is not for people under 13, and we do not knowingly hold their information. If you believe a child has created an account, write to us and we will remove it.

If this policy changes in a way that affects what happens to your writing, we will tell you in the app before it takes effect — not quietly, and not by updating a date at the top.