Privacy Policy

1. The controller

InnerNote AI Co. Ltd is the controller responsible for InnerNote and innernote.ai under UK data protection law. It is a company registered in England and Wales, number 12750353, with its registered office at 11a Empire Parade, Empire Way, Wembley, HA9 0RQ. Privacy questions can be sent to sophie@innernote.ai. Please report security concerns to sophie@innernote.ai.

2. What the app stores locally

Journal entries, drafts, P.S. notes, the earlier versions of corrected pages, bookmarks, search indexes, locally extracted signals, InnerSelf readings, witness replies, writing preferences, reminder choices, course progress, session ratings, the first name you type, and downloaded course audio are stored on your device. The signal clerk is deterministic and local, and InnerSelf measures your pages on the device. Once you allow it, InnerSelf also sends the sentences of your latest pages to be read, as section 6 explains; nothing else it holds leaves the device.

You do not need an account to use InnerNote, and an account never holds your journal (section 3). We do not hold your journal, sell it, use it for advertising, or use it to train a model. The only journal text that leaves the device is a page you ask the witness to read and, once you allow it, the sentences InnerSelf sends for a reading, both handled as section 6 explains. A page you type on the web reaches our server sealed so that only your phone can open it, as section 8 explains. InnerNote's systems cannot read the encrypted journal database because they never receive the database or its key.

The journal's encryption key is made on your iPhone and kept in its Keychain as an item that is never synchronised to iCloud Keychain. Your iPhone's backups include the journal database, still encrypted, and whether the key goes with them depends on how you move. Apple's direct device-to-device Quick Start transfer, and restoring an encrypted backup made with Finder, Apple Devices, or iTunes on a Mac or PC, carry both the encrypted journal and its key to the new iPhone, where the journal opens with every page. Because the key travels with them, anyone who can restore that encrypted backup, which needs its password, or complete Quick Start with your iPhone and its passcode, can open your journal on another iPhone. InnerNote cannot access, read, or recover the backup or the key.

iCloud Backup also includes the encrypted journal, but Apple protects the Keychain in an iCloud Backup with a key tied to the hardware of the iPhone that made it, so the journal's key returns only when that backup is restored to the same iPhone. Restored to a different iPhone, an iCloud Backup brings the journal without its key, and the journal cannot be opened there; InnerNote cannot recover a key that did not transfer. For the same reason, Apple cannot open your journal from an iCloud Backup. A computer backup made without encryption works the same way. A move depends on your Apple settings and on Apple's process completing, so it is not guaranteed.

3. Your account, if you choose one

Signing in is optional. When you first open the app, and later from Settings, you can sign in with Apple, with Google, or with your email address and a 6-digit code. Signing in with Apple, Google or an email code using the same email address opens the same account. An account holds your sign-in and your email address, nothing more. Your pages, P.S. notes, readings, ratings and the rest of your journal never go to it, and they stay on your phone whether or not you sign in. Signing in does not back up your journal or bring it to another phone.

For an account, our server keeps: how you signed in (Apple, Google or email); the identifier Apple or Google gives us for you, stored only as a one-way hash; your email address, which with Apple may be a private relay address Apple makes for you, or none; whether you chose to receive occasional emails from InnerNote; when the account was made; and the sessions that keep you signed in. A session is a random key held in this iPhone's Keychain for this iPhone only, and on our server only as a hash. When you open your account on innernote.ai from the app, our server also makes a one-time key that signs you in there, stored only as a hash, which works once and for one minute. No name, page, rating, reading or other journal content ever reaches these records.

With Apple or Google, Apple or Google confirms who you are and gives the app a signed token, which our server checks against their published keys. Each handles its own sign-in data under its own privacy policy. With email, our server sends a 6-digit code to the address you enter through our email provider, Resend, which receives the address and the message in order to deliver it. The code is stored only as a hash and stops working after 10 minutes or 5 wrong tries, and only a few codes can be sent to one address, or from one internet connection, in an hour.

If you tick "Send me occasional emails from InnerNote.", we keep that choice with your account and may now and then write to you about InnerNote. You can change it at any time in Settings. Otherwise, the only emails we send to an account are the sign-in codes you ask for.

If you don't sign in, the app may ask once, "Where can we reach you?", and you can skip it. An address you save there is kept on our server against a one-way hash of the app's pseudonymous identifier (section 4), not with any account, so that we can write to you rarely about InnerNote, such as when it launches. We never share it. Delete all data asks our server to delete it, and you can also ask us to by email. An address you give at innernote.ai/write to be emailed the App Store link while a page waits there for your phone is used to send that one email and is not kept: our server keeps only a one-way, keyed hash of it for a day or two, to limit how many such emails one address can receive, with nothing of the page.

Sign out, in Settings, ends your session on this iPhone and deletes it from our server; if our server can't be reached then, the app asks again the next time it opens, and a session unused for 90 days ends by itself. Delete account deletes your account from our server: your sign-in, the hashed Apple or Google identifier, your email address, your emails choice, your sessions and any email codes. If you signed in with Apple, our server also asks Apple to revoke InnerNote's Sign in with Apple. A subscription bought on innernote.ai is set to end at the close of the period you have paid for; one bought through Apple or Google stays with them and is cancelled there. The app and the website say all of this before anything is deleted. Your pages are not touched: they stay on your phone. To erase them, use Delete all data (section 12).

4. Payments and app integrity

You can pay in three ways, and whoever takes the payment handles your payment details under its own privacy policy. In the iPhone app, Apple takes it through the App Store. In the Android app, Google takes it through Google Play billing. On innernote.ai, Stripe takes it for us, with Stripe Tax working out any VAT from the billing address you give at checkout. InnerNote AI Co. Ltd never receives your card or bank details. For a subscription bought on innernote.ai, our server keeps, with your account, the Stripe customer and subscription identifiers, the subscription's status, whether it ends at the close of its period, and when these changed; never a card or an address.

RevenueCat keeps track of whether your subscription is active, whichever way it was bought. It receives a pseudonymous app-user identifier (and, if you sign in, a pseudonymous identifier made for your account, so that a subscription reaches you on every phone) with purchase, entitlement, or renewal metadata from Apple, Google or Stripe. It is not given journal content.

Before a server-backed feature is used (the witness, InnerSelf's reader, course audio, or your account), the app proves it is a genuine InnerNote installation. On iPhone, Apple App Attest may contact Apple to verify it. InnerNote's server receives an installation key identifier, attestation or assertion material, a one-time challenge, app build information, and the pseudonymous RevenueCat app-user identifier. It stores hashed key and app-user lookups, the attested public key, receipt, counter, and revocation state to prevent replay. On Android, the app asks Google Play Integrity for a token bound to the request, and our server asks Google to decode it, which tells us whether the app and the device are genuine. This integrity material contains no journal, P.S., signal, or export content.

If someone sent you to InnerNote and you enter their code at "Who sent you?", we record that code against the random id your subscription uses (or your account's, if you sign in), so we can pay the person who sent you a share of your subscription. Nothing else is recorded: not your name, your email address, your device or anything you write, and there is no tracking code, fingerprinting or third-party attribution. On an affiliate's short link (innernote.ai/r/…), nothing is stored unless you tap "Remember that … sent me"; then, and only then, this browser keeps the code for 30 days in a first-party cookie and its own storage, so that signing in on innernote.ai later records it. A code can be changed for seven days after it is first entered. We keep the record for as long as the accounts for those payments must be kept.

5. Crash reporting

Crash reporting with Sentry is on in the app, so that we can find and fix what makes it fail. Sentry receives technical crash data needed to diagnose a failure, such as a scrubbed stack trace, app version, device model, and operating-system information. It is set to store no IP address and to scrub data on its own servers, and it holds the data in its EU region. InnerNote disables breadcrumbs, screenshots, view hierarchy, logs, tracing, request capture, and default personal information.

Journal entries, drafts, P.S. notes, local signals, names, email addresses, and attachments are removed from JavaScript crash payloads and must never be attached to an event. Native crash reports can contain low-level diagnostic information, but the app does not put journal content into crash-reporting scope.

6. The witness

The witness is optional and runs only when you ask it to read a page. It never reads a page by itself. Before your first request, the app explains what is sent, and nothing is sent until you tap Send. When you ask, the app sends the text of that one page, and nothing else from your journal, over an encrypted connection to InnerNote's server, which passes it, also encrypted, to our AI provider, Anthropic. No name, email address, account, other entry, signal, reading, or course information goes with it. A very long page is shortened to its latest words, at most 12,000 characters.

So that InnerNote's server can confirm the request comes from the app and check your free days or subscription, the request also carries App Attest data and the pseudonymous app-user identifier described above. These are not passed to Anthropic. InnerNote's server relays the page and the reply without storing or logging either, unless you choose to report a reply (see below). Against a one-way hash of that identifier it keeps only the date your seven free days began and a daily count of requests, as section 11 explains. A reply is then stored on your device with the page. After your seven free days without a subscription, asking opens the note that replies are part of the subscription, and nothing is sent. A page you ask about at innernote.ai/write is handled the same way (section 8).

InnerSelf's reader works the same way, and only once you allow it, in a one-time note on the InnerSelf tab; until then, or if you keep it on your phone, InnerSelf sends nothing and its readings use its own words. Once allowed, a reading (every five sealed pages) may send the sentences it chose about at most three topics: at most six from when each topic began in your pages and six from your latest pages, each at most 280 characters, never from a page InnerSelf never quotes. From page 10, a reading also sends every sentence of your last 20 sealed pages, at most 6,000 words (the oldest pages are left out first) and never from a page InnerSelf never quotes, each with its page's place among those pages and the day it was written, with the patterns your earlier readings found, so that the AI can say in one short sentence what repeats in how you write. They go over an encrypted connection to InnerNote's server, which passes them, also encrypted, to Anthropic to say in one line what you are saying about each topic and whether it has changed, and what repeats. The topic's name and the months or days the sentences were written go with them; no name of yours, email address, account, other entry, reading, or course information does. The server holds them for that one request, never stores or logs them, and checks every line that comes back before your phone sees it, and your phone keeps a pattern only when at least three of your sentences, on three pages, show it; the lines are then kept with the reading on your device. A reading that could not be read is tried once more, the next time you open the app. You can turn this off at any time in Settings → InnerSelf, with the switch InnerSelf reads with AI; from then on InnerSelf sends nothing, and its readings use its own words.

Under a witness reply, and under a line of an InnerSelf reading the AI wrote, Report lets you tell us it was harmful or upsetting, inaccurate, or something else, with a note if you like. Only when you send a report does our server receive and keep the words of that one reply or line (at most 1,000 characters), the reason you chose, your note (at most 500 characters), which of the two it was, and when, against a one-way hash of the app's pseudonymous identifier (section 4); never your page, your name, your email address or your account. This is the one time our server keeps the words of a reply. We read reports only to make the witness and InnerSelf safer and more accurate, and each report is deleted after 90 days.

Anthropic reads the page under its Commercial Terms of Service (anthropic.com/legal/commercial-terms) and its Data Processing Addendum, which do not allow it to train its models on what we send or on what it writes back. Under its retention policy for API customers (privacy.claude.com/en/articles/7996866), Anthropic keeps what we send, and what it returns, for up to 30 days and then deletes them. If its automated safety systems flag a request as a possible breach of its Usage Policy, it may keep it for up to 2 years, and longer where the law requires. That is Anthropic's retention, not a copy kept by InnerNote.

7. Support, reminders and device services

If you choose Write to us (tap the line at the foot of Settings), iOS opens a mail draft addressed to support. InnerNote adds only the app version and iOS version. It never adds journal text, an export, or another attachment. Your message and email address are then handled by your mail provider and by InnerNote AI Co. Ltd for the purpose of answering you. Please do not send journal passages unless you deliberately want us to read them.

The optional daily reminder, and the note that a new InnerSelf reading is ready (switched in Settings → Reminders → Notifications, under Readings & weekly summary), are scheduled locally through iOS, only at your reminder time and only with your permission. Neither contains journal content. There is no push-notification account or notification marketing in this version. Device authentication is handled by iOS; InnerNote receives the result, not your Face ID or passcode data.

8. innernote.ai, Write on the web and cookies

If you link a computer at innernote.ai/write (Settings → Write on the web), each page you type there is sealed in your browser to your phone's own public key before anything is sent, so that only your phone can open it. Our server holds the sealed page, which it cannot read, until your phone collects it, and then deletes it; a sealed page not collected within 30 days is deleted. For this, the server also keeps the link code for ten minutes, and your phone's public key with the name your phone gives itself (such as "iPhone 15") until you unlink it. A page you keep in the browser before a phone is linked stays in that browser alone, sent nowhere, until your phone collects it or 30 days pass. If you ask for a reply from that page, its words go through our server to Anthropic exactly as section 6 describes, and nothing of them is stored or logged; the reply is sealed to your phone with the page.

On innernote.ai/account you can sign in, as section 3 describes, to subscribe or to manage a subscription bought there. Before a sign-in code is sent, Cloudflare Turnstile checks that the request comes from a person, and Cloudflare receives technical information about your browser for that check.

innernote.ai uses only cookies that are strictly necessary: a session cookie that keeps you signed in at innernote.ai/account for up to 30 days, a security cookie that protects your account against forged requests, and what Cloudflare Turnstile stores in your browser to tell a person from an automated request. There are no advertising, tracking or analytics cookies, and the site's other pages and innernote.ai/write set none. The affiliate programme is not open; if it opens, any referral tracking will ask for your consent first.

9. Why data is handled

We rely on these lawful bases under UK data protection law. Contract: to provide the app and innernote.ai you asked to use, keep your journal on your device and let you export or erase it, run your account and Write on the web, take payment and check your subscription, and give you a reply or a reading when you ask for one. Consent: occasional emails, and a contact address saved without an account; you can withdraw it at any time in Settings or by email.

Explicit consent (UK GDPR Article 9(2)(a)): a page you send for a reply, or the sentences InnerSelf sends, may describe your health, so they are sent only after you agree to it in the app (the one-time note before your first reply, and Allow on the InnerSelf tab), and only as section 6 describes. You can withdraw it at any time: a reply is sent only when you ask for one, and you can turn off InnerSelf reads with AI in Settings → InnerSelf.

Legitimate interests: keeping InnerNote secure and reliable, with strict minimisation. This covers the app integrity checks, the limits that stop misuse and control cost, Turnstile, crash reports, and answering a support message you send. Legal obligation: keeping the payment and tax records the law requires.

10. Sharing and international processing

We do not sell personal data. Journal content leaves the device only when you ask the witness to read a page or, once you allow it, when InnerSelf sends the sentences it reads for a reading; Anthropic then processes them as section 6 explains. Each provider we use does only its part: Anthropic, our AI provider, for replies and InnerSelf readings; Apple for Sign in with Apple, App Store purchases and App Attest; Google for Sign in with Google, Google Play billing and Play Integrity; Stripe for payments on innernote.ai, with Stripe Tax; RevenueCat for subscription status; Railway, which hosts InnerNote's server; Cloudflare, which hosts innernote.ai and the course audio and runs Turnstile; Resend, which delivers sign-in codes and our emails; and Sentry, for minimised crash reports.

Some of these providers, Anthropic among them, are based in the United States or process data there. Where personal data goes outside the United Kingdom, it is protected by appropriate safeguards, such as the UK Extension to the EU-US Data Privacy Framework where the provider is certified under it, or the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, as each provider's data processing terms set out.

We may disclose limited information if law requires it or to protect legal rights, but we cannot disclose journal content we do not possess.

11. Retention

Local app data remains until you delete it, delete the app, or the device removes it. Apple-managed or computer backups are controlled through Apple's tools and may retain an older encrypted snapshot until you replace or delete that backup. InnerNote cannot see or read that snapshot. An account is kept until you delete it; a session until you sign out, delete the account, or leave it unused for 90 days; an email code works for 10 minutes; a one-time key that opens your account on innernote.ai from the app works once, for one minute. A contact address saved without an account is kept until Delete all data or until you ask us to delete it. A sealed page from innernote.ai/write is kept until your phone collects it, or for 30 days at most; the link code for ten minutes; your phone's public key and name until you unlink it. A session on innernote.ai lasts up to 30 days. The record of a subscription bought on innernote.ai is kept with your account and deleted with it; Stripe keeps payment and tax records for as long as the law requires. Expired and consumed App Attest challenges are pruned; registered-key and counter records remain to prevent replay until the integrity service is retired or the records are deliberately removed for security or legal administration. A support email is retained only as long as reasonably needed to answer the request, keep a necessary business record, or meet a legal obligation. Sentry and RevenueCat retention follows the settings we choose and their service terms. InnerNote's server retains no witness or InnerSelf content, except the words of a reply you choose to report, kept for 90 days. Against a hashed identifier it keeps only the date your seven free days began, so that they do not restart, and a daily count of witness requests (to prevent misuse and limit cost, kept for two days); Anthropic keeps what is sent and what it returns for up to 30 days, or longer only in the cases section 6 sets out.

12. Export, erasure, and your rights

Settings includes Export your journal, which creates a copy of your journal, as a PDF or as plain text, as it is held on this device: sealed and open pages with their dates and stamps, the earlier versions of corrected pages, P.S. notes, your InnerWork session ratings and your InnerSelf readings. This gives you a practical way to exercise data portability under UK GDPR Article 20 for the journal held by the app. Delete all data, once you confirm it with Delete everything, permanently erases InnerNote's data and encryption keys from the current device: every page with its earlier versions and P.S. notes, InnerSelf readings, InnerWork progress, ratings and downloaded audio, settings and reminders, your first name, the sign-in session and any contact address kept on this iPhone, and the keys that encrypt the journal. It does not restart your seven free days: the date they began stays in this iPhone's Keychain beside the app's pseudonymous identifier, the one our server keys them by. It also asks our server to end this iPhone's sign-in session and to delete a contact address you saved. It supports the right to erasure under Article 17. You do not need to contact us to use either control.

Delete all data cannot access or delete an existing Apple-managed or computer backup. An older encrypted snapshot may remain until you replace or delete that backup using Apple's tools. InnerNote cannot read it. Delete all data works on this iPhone: it does not delete your account on our server, and it does not cancel a subscription, which you manage with Apple, with Google or at innernote.ai/account.

Delete account, in Settings, deletes your account from our server as section 3 describes, and leaves your pages on your phone. Use both, Delete account and Delete all data, to remove everything.

You may also ask about access, correction, restriction, objection, portability, or erasure for information InnerNote AI Co. Ltd actually holds, such as your account, a contact address, or a support email, by writing to sophie@innernote.ai. You may complain to the UK Information Commissioner's Office or your local supervisory authority. Some rights depend on the circumstances and lawful basis.

13. Security

InnerNote encrypts the journal database with SQLCipher, keeps its current encryption key in the iOS Keychain using the migratory WHEN_UNLOCKED accessibility class, applies iOS file protection to sensitive local files, offers a Face ID or passcode lock, and places an opaque cover over the app when it leaves the foreground. WHEN_UNLOCKED does not enable iCloud Keychain synchronisation. The app talks to InnerNote's server only over encrypted connections, and the server keeps sessions and email codes only as hashes. No security measure can remove every risk, especially on a compromised or unlocked device.

Please send vulnerability reports to sophie@innernote.ai and do not include journal content. Our responsible disclosure guidance is published with the project security notice.

14. Children and changes

InnerNote is not designed for children and we do not knowingly operate accounts for them. If you believe a child has sent personal information to support, contact us so we can address it.

We will update this policy when the app or its data flows change. Any further feature that processes journal content outside the device will need a clear in-app explanation and an updated policy before release.