Privacy Policy

1. What we collect

Account data: email address and authentication identifiers (via Supabase; social sign-in — Google, Apple, Kakao, or X — shares your email and basic profile from that provider). Synced content: manuscripts, diary entries, notes, and settings — automatically synchronized when you sign in. Payment data: handled by Paddle for web purchases and Google Play for Android purchases; we do not receive your card number. AI usage is metered against your credit balance. Product usage: which screens and features you use and when (for example 'opened the app', 'saved an entry', 'changed thinking depth'), along with your app language and platform. This never includes the text you write — not your entries, manuscripts, or titles. We use it only to decide what to improve, and you can turn it off in Settings › Data.

App launch notifications: if you ask to be told when the mobile apps are released, we store the email address you enter, the platform you chose, and the site language — for that one announcement only. It is not added to any marketing list, and you can ask us to delete it at any time via the support address below. Signing up does not create an account.

2. Local-first: what stays on your device

Your writing is stored in your browser's local database (IndexedDB) on your device. Preferences (theme, language, skin) are stored in localStorage. BYOK API keys are saved on your device. When you use AI, your key and relevant content pass through our server to call your selected AI provider; the key is not saved to our database.

3. AI processing

When you invoke an AI feature, the relevant content is sent to the AI provider you selected (e.g., Anthropic, OpenAI, Google) to generate a response, subject to that provider's privacy terms. We do not use your content to train models, and we do not sell your data.

4. Cookies and localStorage

We use localStorage and essential cookies for sign-in sessions and preferences. We do not run third-party advertising trackers on the landing page or in the app.

5. Sharing and processors

We share data only with processors needed to run the service — subprocessors: Cloudflare (hosting/edge), Supabase (database and authentication), Paddle (web payments, as merchant of record), Google Play (Android purchases), and the AI providers you invoke (content is sent only when you run an AI feature). If you connect an external sync destination you choose (WebDAV, Google Drive, Dropbox, OneDrive), your content is stored with that provider under your own account and their terms. We do not sell personal data.

6. Retention, deletion, export

Retention: synced content is retained while your account is active; AI usage records are kept for credit accounting. Detailed product-usage records are deleted after 90 days; only anonymous daily totals (no account identifier) are kept beyond that, plus a minimal record of which days your account used the app, used solely to measure whether people keep coming back. Deletion: you can delete your account in Settings, or request help with deletion by contacting support@thegeul.com from your account email — your synced content, account data, and product-usage records are removed from our servers within 30 days, except where law requires retention (e.g., payment records kept by Paddle). Local copies on your devices remain under your control. Export is available anytime (Markdown ZIP, PDF, EPUB).

7. Security

Data in transit is encrypted (TLS). Synced data is protected by per-user access rules (row-level security). No method of storage is 100% secure; keep your account credentials safe.

8. Your rights · changes · contact

Depending on your jurisdiction, you may have rights to access, correct, delete, or port your data — contact us to exercise them. Governing law: the laws of the Republic of Korea. We will announce material changes to this policy in the service. Contact: support@thegeul.com.