Skip to content
Reflect DayReflect Day
Download

Privacy policy

Last updated: June 9, 2026

1. Introduction

Welcome to Reflect Day ("the App"). This Privacy Policy explains what data the App handles, where that data goes, and what we can and cannot see. The short version: the App has no backend server, we run no analytics, and your journal entries never reach us. This policy covers the Reflect Day web application (including when installed as a Progressive Web App) and the experimental terminal client.

2. How Your Data Is Stored

  • Local storage: Your entries are stored in your browser's local database (IndexedDB) on your device.
  • Your own cloud storage: If you sign in with Google, your entries sync to a private application-data folder in your own Google Drive. The data is stored in your personal account, not on our servers — we have none.
  • Optional on-device encryption: You can set a password to encrypt entry text on your device. This protects entry text only — tags, dates, location, weather, and the copy in your Google Drive are stored unencrypted. The password is never stored; if you lose it, encrypted text cannot be recovered.
  • No server storage: We do not operate any server that stores your journal entries or account data.

3. Google Account Data

When you sign in with Google, the App requests the following permissions (OAuth scopes):

  • Basic profile (openid, email, profile): your name, email address, and profile picture, used only to show who is signed in. This information is held in memory for the current session and is never written to disk by the web app, never stored on any server of ours, and never shared with anyone.
  • Google Drive application data (drive.appdata): access to a dedicated, app-specific folder in your own Google Drive where your entries and settings are synced. This scope does not allow the App to see any other files in your Drive.

Sign-in tokens are kept only in memory and are discarded when you close the app, which is why you sign in again each time. (The terminal client, by design, stores its sign-in credentials on your device encrypted — see section 8.)

Reflect Day's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

4. Third-Party Services and APIs

The App contacts third-party services only for the features below, and only when you use them:

  • Google Drive: If you enable sync, your data is stored in your personal Google Drive account. Google's privacy policy applies to data stored there. Note that entries are stored in your Drive in plain text — they are not end-to-end encrypted to the cloud.
  • AI (Google Gemini): AI features stay off until you add your own Gemini API key. When you use them, the relevant journal text is sent directly from your device to Google for processing, under Google's terms. Which key you use decides what Google may do with that text: on Google's free tier, Google uses what you send to improve and train its models, and its reviewers may read it; keys with billing enabled on their Google Cloud project are excluded from that. If you enable semantic search, your entry text is sent to Google to build the search index. Your API key is stored in your app settings (synced to your own Google Drive application-data folder), not with us.
  • Location names (OpenStreetMap): When you add a location to an entry, your coordinates are sent to OpenStreetMap's Nominatim API to look up a place name.
  • Weather (Open-Meteo): When you add weather to an entry, your coordinates are rounded to about a kilometre and then sent to the Open-Meteo API. The weather is the same at that accuracy, so Open-Meteo never learns the exact spot you wrote from.

None of these services receive your journal text, except Google Gemini when you deliberately use an AI feature. Each service processes requests under its own privacy policy.

5. Information We Do Not Collect

We do not collect, store, or have access to:

  • Your journal entries or any content you create within the App
  • Your name, email address, or contact details (unless you email us directly)
  • API keys that you configure for AI services
  • Your location, browsing history, or activities outside the App

The App contains no analytics, no advertising, no tracking cookies, and no error-reporting telemetry. We have no way to see how you use the App.

6. Hosting

The App is delivered as static files (HTML, CSS, JavaScript, images) by our hosting provider, Vercel. Like any web host, Vercel may log basic technical information about requests for those files — such as IP address, browser type, and time of access — to operate and secure its service. Those logs are processed under Vercel's privacy policy. Your journal data is never part of these requests: entries sync directly between your device and your own Google Drive and do not pass through the hosting infrastructure.

7. Location and Weather Data

When you use location or weather features in the web app:

  • The App asks for permission to use your device's geolocation services
  • Your coordinates are sent to OpenStreetMap (for place names) and, rounded to about a kilometre first, to Open-Meteo (for weather)
  • The resulting location and weather information is stored as part of your journal entry, on your device and in your own Google Drive
  • We never receive or store your location
  • You can revoke the App's location permission in your browser or device settings at any time

8. The Terminal Client (CLI)

The experimental terminal client follows the same no-backend design, with two differences:

  • Credentials on disk: So it can work in a terminal session, the CLI stores your Google sign-in credentials and any not-yet-synced entries on your device, encrypted with AES-256-GCM using a key derived from a password you choose.
  • Approximate location autofill: If you enable location autofill, the CLI estimates your city-level location from your network connection using keyless services (get.geojs.io, freeipapi.com) and fetches weather from Open-Meteo. These services receive your IP address and validated coordinates only — never any journal content.

9. Your Data, Your Control

  • You can use the App's export features to take a complete copy of your data at any time
  • You can delete entries in the App, and you can remove the App's access to your Google account at myaccount.google.com/permissions
  • Deleting the App's data from your Google Drive and your device removes all copies — there is no server-side copy to request deletion of
  • Because we hold no personal data about you, data-subject requests (access, correction, deletion, portability) are fulfilled directly by you through these features; if anything is unclear, contact us and we will help

10. Data Security Recommendations

To keep your journal private, we recommend:

  • Using a strong, unique password and two-factor authentication on your Google account — anyone with access to your Google account can read the synced entries
  • Turning on the App's optional on-device encryption if others use your device
  • Regularly exporting a backup of your journal data
  • Keeping your browser and device updated with the latest security patches
  • Being cautious about who has physical access to your device

11. Children's Privacy

The App is not intended for children under 13 years of age, and we do not knowingly collect personal information from anyone — children included. Because the App has no server-side accounts or data collection, there is no information about any user, of any age, held by us.

12. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will post the new Privacy Policy on this page and update the "Last Updated" date. You are advised to review this Privacy Policy periodically for any changes.

13. Contact Us

If you have any questions about this Privacy Policy or our practices regarding your personal information, please contact us at hi@reflect.day.