Privacy Policy

1Summary

We collect account information and the Content you choose to save so we can provide account access, synchronization, restoration where available, security, support, backups/exports, and subscription-related features.

We do not sell your Content. We do not use your Content for advertising. We do not use your Content to train AI models unless you separately and clearly opt in to a feature that says it will do so.

You can request access, export, correction, or deletion through the app or by contacting us.

2Who Controls Your Data

For privacy-law purposes, the controller of your personal data is Efecade Tecnologia LTDA, CNPJ 67.285.185/0001-07, Avenida Afonso Pena, 190, Loja 219, Centro, Uberlândia, MG, 38400-130, Brazil, privacy@promptjournal.app, https://promptjournal.app.

3Data We Collect

Account data may include email address, nickname or display name, account ID, password authentication data, authentication tokens, reset tokens, session records, account creation date, account settings, legal acceptance records, and subscription entitlement status. We do not intend to store your plaintext password.

Content and workspace data includes information you choose to create, import, save, organize, back up, restore, or synchronize through the Service, such as entries, snippets, notes, templates, saved text, related materials, project names, collection names, folders, tags, titles, labels, favorites, timestamps, ordering, version information, sync state, deleted-item state, conflict-resolution data, backup/import metadata, and restoration-related data where available.

Your Content may include personal data if you choose to include it. Please do not store sensitive personal data, regulated records, secrets, passwords, private keys, payment card numbers, government identification numbers, health information, or other high-risk information unless you understand the risk and have the legal right to do so.

Device, app, and technical data may include device type, operating system, app version, language, time zone, platform, device or installation identifiers, IP address in server logs and security logs if collected by our systems or providers, approximate region derived from IP address, request timestamps, sync events, error reports, crash reports, diagnostics, performance data, security events, abuse-prevention signals, and authentication events.

Payment and subscription data may include store transaction ID, subscription product ID, subscription status, renewal, cancellation, expiration, refund, billing-status signals, and country/region or storefront information. We do not receive or store your full payment card number when payment is handled by an app store or third-party payment provider.

Communications and support data may include your email address, message content, attachments you provide, support history, troubleshooting information, feedback, and survey responses.

Account deletion request data may include account ID, user ID, email snapshot, request source, request status, requested time, confirmed time, due date, completed time, app version, platform, locale, completion notes, and retention reason where needed.

If we use optional analytics, beta telemetry, or marketing emails, we will describe them in the app or on our website and provide any consent or opt-out controls required by law.

4How We Collect Data

We collect data directly from you when you create an account, accept legal terms, save Content, change settings, subscribe, export or back up data, request account deletion, or contact support; automatically from the app, device, browser, and servers when you use the Service; from app stores and payment providers when they send subscription or entitlement information; and from service providers that help us operate, secure, and support the Service.

5Why We Use Data

We use data for account creation and authentication; synchronization and storage; backup and export; legal acceptance records; service operation; security and abuse prevention; customer support; subscription management; account deletion; legal compliance; service communications; and optional communications where permitted or consented.

6Legal Bases Where Required

Where privacy law requires a legal basis, we rely on contract to create your account, provide the app, synchronize Content, manage subscriptions, provide support, enable backup/export features, process legal acceptance, and deliver requested features; legitimate interests to secure the Service, prevent abuse, debug issues, maintain reliability, process account deletion requests, understand basic service performance, and protect legal rights; consent for optional analytics, optional marketing, optional beta telemetry, optional integrations, or other processing where consent is required; and legal obligation to comply with applicable law, tax/accounting requirements, court orders, app-store obligations, and valid legal requests.

7How We Share Data

We may share data with service providers that host, store, transmit, secure, analyze, support, and operate the Service; app stores and payment providers; legal and safety recipients where reasonably necessary; parties involved in a business transfer subject to appropriate protections; and others at your direction.

8What We Do Not Do

We do not sell your Content. We do not use your Content for advertising. We do not use your Content to train AI models unless you separately and clearly opt in to a feature that says it will do so. We do not intentionally collect precise location, contacts, photos, microphone data, camera data, or health data unless a future feature clearly asks for it and you grant permission. We do not knowingly sell or share personal data of users under 16.

9International Transfers

We and our service providers may process data in countries other than your country of residence. Where required, we use appropriate safeguards for international transfers, such as contractual protections, standard contractual clauses, adequacy mechanisms, or other lawful transfer mechanisms.

10Retention

We retain data only as long as reasonably necessary for the purposes described in this Privacy Policy, unless a longer period is required or permitted by law.

Typical retention periods: account data is retained while your account is active; Content and workspace data is retained while stored in your account, until you delete it or delete your account; deleted Content may remain in backups for a limited period; backups are retained for up to 90 days before being overwritten or deleted unless needed for security, legal, or disaster-recovery reasons; security logs are retained for up to 365 days unless needed to investigate abuse, fraud, or security incidents; legal acceptance records are retained as long as necessary to document your agreement, operate the account, resolve disputes, and comply with legal obligations; support messages are retained for up to 24 months; subscription and transaction records are retained as required by app stores, tax, accounting, dispute, and legal obligations; account deletion request records are retained as long as necessary to process and document the request, resolve disputes, prevent abuse, and comply with legal obligations.

When account deletion is requested and confirmed, we delete or de-identify associated personal data from active systems within 30 days, unless retention is required or permitted for legal, security, fraud-prevention, tax, accounting, backup, dispute-resolution, or compliance reasons.

11Security

We use reasonable technical and organizational measures designed to protect data, such as encryption in transit, access controls, authentication controls, logging, backup procedures, and service-provider safeguards. No system is perfectly secure. We cannot guarantee that data will never be accessed, lost, corrupted, or disclosed.

You are responsible for using a strong password, securing your devices, protecting your email account, and keeping independent copies of important Content. Unless we expressly state otherwise for a specific feature, the Service is not end-to-end encrypted. We use reasonable security measures such as encryption in transit and access controls, but no system is perfectly secure.

12Your Rights and Choices

Depending on your location, you may have rights to access, correct, delete, export, restrict, object, withdraw consent, opt out of marketing communications, appeal, complain to a data protection authority, opt out of sale or sharing where applicable, and limit use of sensitive personal data where applicable.

You can exercise rights through app settings, the account deletion page at https://promptjournal.app/delete-account, the export or backup function, or privacy@promptjournal.app. We may need to verify your identity before fulfilling a request.

13Request Account Deletion

You can request account deletion in the app by opening the app menu, expanding Legal, and choosing Request account deletion. You can also request deletion at https://promptjournal.app/delete-account.

Requesting account deletion starts a deletion process for your account and server-synchronized library data. Deletion may take up to 30 days after the request is confirmed. While the request is pending, we may mark your account as deletion requested, revoke sessions, log you out, and disable normal sync/account access.

Before requesting deletion, export or back up any Content you want to keep. If your subscription is billed through Apple, Google, or another third-party store, deleting your account does not automatically cancel billing. You must cancel through the store that manages the subscription.

14California Privacy Notice

This section applies to California residents to the extent the California Consumer Privacy Act, as amended, applies to us. We may collect identifiers, customer records information, commercial information, internet or electronic activity information, user-generated content and related metadata, approximate location derived from IP address, legal acceptance records, account deletion request records, and inferences needed for security, account integrity, and service operation.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising. We do not knowingly sell or share personal information of users under 16.

15Children

The Service is not directed to children under 13, and we do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided personal data, contact us at privacy@promptjournal.app.

16Automated Decision-Making

We do not use automated decision-making that produces legal or similarly significant effects about you. We may use automated systems to detect security risks, abuse, fraud, spam, unauthorized access, service errors, or policy violations.

17Changes to This Privacy Policy

We may update this Privacy Policy. If changes are material, we will provide notice through the app, website, email, or another reasonable method. If a change requires consent under applicable law, we will request consent before applying the change.

18Contact

For privacy requests or questions, contact Efecade Tecnologia LTDA, CNPJ 67.285.185/0001-07, Avenida Afonso Pena, 190, Loja 219, Centro, Uberlândia, MG, 38400-130, Brazil, privacy@promptjournal.app, https://promptjournal.app.