DRAFT: needs review by a qualified lawyer before publishing. Fill every
[OWNER-FILL: ...](list indocs/legal/README.md).
Kolday Privacy Policy
Effective date: 22 October 2026
Kolday ("the app", "we") is a voice journal for iPhone, provided by Yinon Perets. This policy explains what the app does with your data. It describes the app as it works today; if that changes, we update this page (see "Changes").
1. Short version
- Your recordings stay on your iPhone, except: optional audio backup, cloud transcription on Kolday Pro (the audio goes through our server to OpenAI, only if you accepted the AI consent; we don't store it, section 4), transcription by OpenAI when your iPhone can't transcribe a recording (only if you accepted the AI consent and saved your own OpenAI key; the audio goes straight from your iPhone to OpenAI with your key, not through our server), and Apple's speech recognition servers if iOS lacks the on-device language model (section 4).
- AI analysis is optional. Nothing is analyzed and nothing from your journal is uploaded to our servers until you accept the AI consent screen.
- You choose where entries are analyzed (Settings > AI analysis > Analysis engine): on your iPhone (Apple's on-device model; the text is not sent to an AI provider for the analysis), with your own API key (straight to the provider you pick), or on our server (Anthropic).
- Whichever engine you pick, once you accept the AI consent and while you are signed in, your transcripts and their analyses sync to your account on our server (Supabase), and the weekly, monthly and yearly summaries in Insights are made by Anthropic through our server from each entry's date, mood, topics and short summary (not the transcripts).
- Marking an entry "sensitive" locks it on your iPhone and keeps it out of "Ask your journal", but it is still synced like any other entry, and its date, mood, topics and short summary are still included in the Insights summaries (section 4).
- The Free plan shows non-personalized banner ads (Google AdMob; none in Pro); your journal is never shared with advertisers. No tracking prompt, no analytics or crash-reporting SDKs, and we do not sell your data.
- Send summary: only when you tap it, an entry's AI summary (and, if you choose, its links, places, events and open tasks) goes through the iPhone share sheet to the app you pick. Never the transcript or the audio, and we don't receive or keep it (section 2).
- You can delete your account and all server data from inside the app.
2. What stays only on your iPhone
These are never sent to us or to any processor:
- Recordings (audio files), unless you turn on audio backup, you are on Kolday Pro and accepted the AI consent (cloud transcription: the audio goes through our server to OpenAI and is not stored by us, section 4), the Whisper fallback with your own OpenAI key in section 4 applies (then the audio goes from your iPhone to OpenAI, not to us), or iOS uses Apple's speech recognition servers (section 4).
- The local journal database, including entries recorded before you accepted the AI consent.
- Task checkboxes ("Extracted tasks" ticks), the "sensitive" mark on entries, and the app lock setting. The mark itself stays on your iPhone; a sensitive entry's transcript and analysis still sync, and its mood, topics and summary still go into the Insights summaries (section 1).
- Your own API keys for Anthropic or OpenAI, if you add them (stored in the iOS Keychain; they are sent only to that provider, never to us), and your analysis engine setting.
- Your AI consent choice (stored in the iOS Keychain).
- Your "Names and words" list (Settings > AI analysis): names and words you add so transcription spells them right. It is kept only on your iPhone and never synced, but it is sent together with the audio, as a spelling hint, whenever a recording is transcribed in the cloud (Kolday Pro through our server, or your own OpenAI key); neither we nor our server keep it.
- Your tasks list (Open tasks on Home and the Tasks screen): the tasks the AI analysis extracted from your entries (section 3), with what you did with each one (done, moved to tomorrow, not relevant), a reminder time if you set one, and the "done this week" count. It is kept only in the app's database on your iPhone and is never synced or sent anywhere new. Entries you marked sensitive are never shown in it or in any notification.
- Task reminders and the Morning tasks digest (off by default): local notifications scheduled by iOS on your iPhone. A task reminder shows that task's text; the digest shows only how many tasks are open, plus the first task's text only if you switch that on. Nothing about them is sent to us or to Apple's push service.
- Saved "Ask your journal" conversations (Pro): kept only in the app's database on your iPhone; deleted with Delete all conversations or Delete account.
- The daily reminder (if you turn it on in Settings): a local notification scheduled by iOS on your iPhone at the time you pick. Nothing about it is sent to us or to Apple's push service.
- Face ID / Touch ID: handled by iOS. The app only receives "success" or "failure", never biometric data.
- Apple Reminders: when you tap "Add to Apple Reminders", the app writes the open tasks you chose into your Reminders. It never reads your reminders and sends nothing about them to us.
- Email drafts and calendar events (Actions): the AI may suggest, from your transcript, an email you said you want to send or an event with a date you mentioned. These suggestions are part of the AI analysis (section 3). Acting on one happens only on your iPhone and only when you tap: "Open draft in Mail" opens a draft in your own mail app (nothing is sent until you send it there), and "Add to calendar" opens Apple's own New Event screen (nothing is added until you tap Add there). The same goes for a text message you said you want to send ("Open message" opens Apple's Messages app with the text, and the number only if you said it; nothing is sent until you tap Send there), something you asked to note down ("Save to Notes" opens the iPhone share sheet, "Copy" copies the text) and a place you said you are going to ("Navigate" opens Waze, Google Maps or Apple Maps, whichever you pick, with only the place name; that app's own privacy policy then applies). The app does not read your mail, messages, contacts, notes or calendar, and nothing about them is sent to us.
- Links (Actions): if you explicitly say you want to cancel, stop or delete a subscription, service or account, or to buy a specific product, the AI (on our server, with your own key, or Apple's on-device model) may suggest the service name or a short product phrase. These suggestions are part of the AI analysis (section 3). The AI never produces web addresses; the app builds the links itself: for a service in its built-in list, a link to that service's own account or membership page; for any other service, a Google search for cancelling it; for a product, search links to online stores that depend on your device's region setting (for example Google Shopping, Amazon, AliExpress, and in Israel also Zap and KSP). The region comes from your iPhone's region setting, is read on the device and is not sent to us; the app does not ask for or use your location. They appear under "Links" in the entry's Actions tab, and nothing opens until you tap one. Then the link opens in your browser or the service's app, and only the service name or the short product phrase goes into the web address, never your transcript, account or other data. That website's or app's own privacy policy then applies. We earn no commission and are not affiliated with these services or stores.
- Subscriptions tracker: the subscriptions you add yourself (on the Subscriptions screen, or with "Track and remind me" on a cancel suggestion): the name, an optional amount and currency, monthly or yearly, and the next charge date, plus whether you marked one cancelled. They are kept only in the app's database on your iPhone and are never synced, never sent to us, to Supabase or to any AI provider. Reminders 3 days before and on the day of each renewal are local notifications scheduled by iOS on your iPhone (no push). There is no bank connection: the app reads no bank, card or payment data. When you start from a cancel suggestion, only the service name from that entry fills in the form. The tracker is a personal reminder tool, not financial advice. It is deleted with Delete account (section 7) and when you uninstall the app.
Text and images you share through the iOS share sheet (Send summary, Share insight, Copy as list, Export) go only where you send them.
Send summary. The Share button on an analyzed entry (and the share action on Home) opens a preview of the exact message: the entry's AI summary and, by your choice, its links, places and events (on by default) and its open tasks (off by default), followed by "Sent from Kolday". It never includes the transcript, the audio, or the email drafts, text messages and notes the AI suggested. Nothing is sent until you tap Send and pick an app in the iPhone share sheet (for example WhatsApp, Messages or Mail); the message then goes only to that app, under that app's own privacy policy and terms. It does not pass through our server, and we don't receive or keep it. For an entry marked sensitive, the app asks for Face ID or your passcode first.
3. What we collect and why
| Data | When | Purpose |
|---|---|---|
| Email address | When you sign in with an email link (magic link), or with Apple (it may be Apple's private relay address) | Your account and sign-in |
| Account ID | When you sign in | Links your data to your account; also used as your customer ID with RevenueCat |
| Account settings: plan (free or Pro), audio backup on/off, a language field, creation date | When you sign in | App features and subscription status |
| Profile: display name, avatar choice (one of the app's built-in avatars, stored as an ID; no photo is uploaded), About-you text | Only if you set them, or, for the display name, the name Apple shares on your first sign-in with Apple (if your profile has no name yet; you can edit it) | Personalises the app (profile screen, Settings, a greeting on Home). Visible only to you: no other user can read it |
| Journal entries: date and time, local day, duration, transcript text, how it was transcribed (device or Whisper), status | Only after you accept the AI consent, while you are signed in, whatever the analysis engine | Sync, AI analysis, weekly/monthly/yearly summaries |
AI analyses: mood score and label, topics, ideas, summary, extracted tasks, suggested email drafts (recipient name or address only as you said it, subject, text) suggested calendar events (title, date and time, place, notes), suggested text messages (recipient name and phone number only as you said them, text), notes you asked to keep (title, text) and places you said you are going to (name, short label), suggested links (the name of a service you said you want to cancel, or a short phrase for a product you said you want to buy), a due date or time for an extracted task if you said one, the model or engine name (for example apple-on-device or openai:<model>) | When an entry is analyzed (on our server, on your iPhone or with your own key) | Shown to you in the app |
| Weekly, monthly and yearly summaries | When you open Insights and one is generated | Shown to you in the app |
| Usage counters: number of AI analyses and "Ask your journal" questions per month, and seconds of cloud transcription used per month (Kolday Pro) | Each server analysis, question or cloud transcription | Free-plan limits, Pro monthly caps and cost control |
| Audio backup (the recording file) | Only if you turn on "Back up recordings" | Keeps a copy of your recordings in private storage in your account |
| Purchase status | If you subscribe | Unlock Pro |
Sign in with Apple. If you sign in with Apple, Apple shares an identifier for your account and, if you choose, your name and your email address or a private relay address. Apple shares the name only on your first sign-in with Apple.
Our service providers' servers may also log technical request data such as IP address and time of the request. The app itself has no analytics.
3a. Shared folders (not offered)
Shared folders ("Sharing Thoughts") are not offered in this release of the app: there is no way to create, join or post to a shared folder, and the app sends no data for them. If we offer them later, we will update this policy first. Deleting your account still deletes any shared-folder data linked to it (section 7).
4. Who processes your data
| Processor | What it receives | Why |
|---|---|---|
| Supabase (hosting, database, authentication, file storage; region: EU, Frankfurt (eu-central-1)) | The data in section 3 | Stores your account and synced journal; runs our server functions |
| [OWNER-FILL: email delivery provider used by Supabase Auth, e.g. Resend or Postmark] | Your email address and the sign-in link | Sends the sign-in email |
| Anthropic (Claude) | The transcript text of an entry, for analysis, when our server analyzes it (the Server engine, or Auto when neither your iPhone nor your own key handles the entry). For weekly, monthly and yearly summaries, whatever analysis engine you pick: the date, mood, topics and summary of each analyzed entry in that period (including entries analyzed on your iPhone or with your own key, and entries you marked sensitive), not the transcripts. For "Ask your journal", when our server answers it (the Server engine, or Auto when you have no own key and your iPhone can't answer): your question, the last few messages of the conversation and excerpts of the entries our server finds to answer it (transcript up to 500 characters each, summary, topics, tasks, mood labels; about 24,000 characters at most per question); entries you marked sensitive are never included. Our server does not store the conversation | Generates the analysis, summaries and answers |
| OpenAI (cloud transcription, Kolday Pro) | The audio of a recording and your "Names and words" list (as a spelling hint), only if you are on Kolday Pro AND you accepted the AI consent AND you are signed in. It goes from your iPhone through our server (Supabase) to OpenAI's gpt-4o-transcribe model, under Kolday's OpenAI account. Our server holds the audio in memory only for that one request and does not store or log the audio or the list; the transcript that comes back is handled like any other transcript (section 3). Up to 300 minutes a month per Pro account, counted on our server from the size of the uploaded file. If cloud transcription is not possible (offline, the monthly limit reached, an error), your iPhone transcribes the recording itself. OpenAI's own retention: [OWNER-FILL: confirm OpenAI retention terms for audio sent under Kolday's API account] | Turns the recording into text |
| OpenAI (Whisper, your own key) | The audio of a recording and your "Names and words" list, only if your iPhone could not transcribe it AND you saved your own OpenAI key in Settings > AI analysis AND you accepted the AI consent. It goes directly from your iPhone to OpenAI with your key, under your own OpenAI account and terms; it does not pass through our server and we do not receive or store it. Outside Kolday Pro cloud transcription (row above), without a saved OpenAI key no audio is sent to OpenAI | Turns the recording into text |
| RevenueCat and Apple | Your account ID and purchase/subscription status. Payment details are handled by Apple only; we never see them. When you delete your account, we also ask RevenueCat to delete your purchase records where possible; Apple keeps its own purchase records | Subscriptions |
| Apple (Sign in with Apple) | Only if you sign in with Apple: Apple handles the sign-in request under Apple's own privacy policy. We receive only what you choose to share (see section 3) | Sign-in |
| Google AdMob | Free plan only: an ad request from your iPhone, which includes your IP address and device and app information, and your choice in the consent form (EEA, UK, Switzerland). Never any journal content, account data or advertising identifier from us. Non-personalized ads only | Shows and measures the banner ad |
| Apple (speech recognition) | The app asks iOS to transcribe recordings on the device. If the needed on-device language model is not available, iOS may process the audio on Apple's servers under Apple's privacy policy | Transcription |
Your own API key (BYOK). Only if you add your own key in Settings, for entry analysis the transcript text of an entry goes directly from your iPhone to the provider you picked, with your key, not through our server: Anthropic (Claude) or OpenAI (ChatGPT models). This never happens automatically: without a key you saved, nothing is sent to OpenAI for analysis. The key stays in the iOS Keychain and is never sent to us. The resulting analysis is saved to your account like any other analysis. Your use of that provider under your own key is subject to your agreement with it (for example, whether it may use API content to improve its products depends on your plan there). For "Ask your journal" with your own key (the "My own key" engine, or Auto when a key is saved), your question, the last few messages of the conversation and excerpts of the entries on your iPhone found to answer it (the same kinds of excerpts as on our server, about 24,000 characters at most per question; entries you marked sensitive are never included) go the same way, directly to that provider. The weekly, monthly and yearly summaries always use our server (Anthropic), whatever engine you pick. If you saved an OpenAI key, the same key is also used for the Whisper transcription fallback (see the OpenAI (Whisper) row above), whether or not you are signed in.
On your iPhone. With the "On this iPhone" engine (or Auto, when your iPhone supports it), Apple's on-device model (Apple Intelligence) analyzes the transcript on your iPhone; the transcript is not sent to Apple, to us or to any AI provider for that analysis. This does not change what syncs: the transcript and the resulting analysis are saved to your account like any other entry (section 3), and the analysis is part of the weekly, monthly and yearly summaries made by Anthropic. Apple's model currently supports English but not Hebrew, so with Auto a Hebrew entry goes to your own key or our server instead; with "On this iPhone" it is not analyzed. "Ask your journal" can also answer on your iPhone (the "On this iPhone" engine, or Auto when you have no own key and your iPhone can), from a few of your entries; then the question and the entries used to answer it are not sent to us or to any AI provider. Questions or entries in Hebrew are never answered on the device.
Processors' own retention follows their terms: [OWNER-FILL: confirm the API data-retention settings and terms for Anthropic and OpenAI and state them here].
5. Consent and how to withdraw it
Before anything is analyzed or uploaded, the app shows an AI consent screen that says where the text is analyzed for each analysis engine (on the iPhone and to no AI provider for on-device analysis; straight to the provider you pick for your own key; Anthropic through our server otherwise), that your transcripts and analyses sync to your account on our server (Supabase) whatever the engine, that the weekly, monthly and yearly summaries always use Anthropic through our server, that "Ask your journal" follows the same engine (your question and excerpts of your entries are answered on the iPhone and sent to no AI provider on-device, go straight to your provider with your own key, or to Anthropic through our server otherwise), that on Kolday Pro the recording's audio and your "Names and words" list go through our server to OpenAI for transcription, under Kolday's OpenAI account, and Kolday doesn't keep them, and that, if your iPhone can't transcribe a recording and you saved your own OpenAI key, the recording's audio goes straight from your iPhone to OpenAI's Whisper with your key, under your own OpenAI account, and Kolday doesn't receive or keep it. "Ask your journal" is available only after you accept. If you choose "Not now", entries stay on your iPhone with their transcript only: no analysis, no cloud transcription (Kolday Pro or your own OpenAI key), no sync of transcripts.
You can turn AI off anytime in Settings > AI analysis > Turn off. From then on, transcripts are not analyzed or synced and audio is not sent for transcription. Data already on our servers stays until you delete your account. When the consent text changes, the app asks you again.
Audio backup has its own switch (Settings > Preferences > Back up recordings). Turning it off stops new uploads; recordings already backed up are kept until you delete your account.
6. How long we keep data
We keep server data while your account exists. There is no automatic deletion of entries. You can delete a single entry in the app (on the entry, Delete recording, or touch and hold it in the Journal). It is deleted from your iPhone at once, and from your account (the entry, its analysis and any backed-up audio) as soon as your iPhone is online and signed in. A weekly, monthly or yearly summary already created from that entry is not regenerated; it is deleted with your account. To remove other specific data, contact us (section 10) or delete your account.
7. Deleting your account
In Settings > Delete account (when signed in). This deletes, on our servers: your backed-up audio files, your account and email, your profile (display name, avatar choice and About-you text), your entries, analyses, summaries, usage counters and account settings, and any shared-folder data linked to your account (section 3a; the feature is not offered in this release). On your iPhone it also deletes your recordings, the local journal, your Subscriptions list and its reminders, your tasks list, its reminders and the Morning tasks digest, the consent choice and your saved API keys, and signs you out.
Deleting your account does not cancel an App Store subscription. Manage it in iPhone Settings > Apple ID > Subscriptions. Copies held by processors (for example server logs) follow their own retention terms.
Without an account, uninstalling the app removes the data stored on your iPhone.
8. Security
- Each user's rows and files are separated by database access rules (row-level security); private file storage allows access only to your own folder.
- Connections use encryption in transit (HTTPS).
- AI provider keys of the service are kept on the server, never in the app.
- Your sign-in session and your own API keys are stored in the iOS Keychain.
- The optional app lock (Face ID / passcode) protects the app on your iPhone. It is a local feature; it does not encrypt server data.
No system is perfectly secure. If we learn of a breach affecting your data, we will notify you as required by law.
9. Your rights
You can:
- Access and export: see your data in the app; anyone can export all entries with transcripts and analyses as text (Settings > Privacy & security > Your data), on every plan. You can also ask us for a copy of your server data (section 10).
- Correct or delete: edit or clear your profile in Settings > Profile, delete single entries or your whole account in the app, or ask us to delete specific data.
- Withdraw consent: Settings > AI analysis > Turn off.
- Complain to your local data protection authority.
Depending on where you live (for example the EU, UK or Israel), you may have further rights. We answer requests within 30 days.
10. Contact
Yinon Perets, Yesod HaMa'ala 31, Tel Aviv, Israel Email: koldayaijournal@gmail.com
11. Children
Kolday is not intended for children under 16, and we do not knowingly collect data from them. If you believe a child under 16 has an account, contact us and we will delete it.
12. Ads, tracking and sale
Ads (Free plan only). The Free plan shows a banner ad on the Home screen, served by Google AdMob. Kolday Pro shows no ads. Ads are never shown on the recording screen or inside an entry. We ask Google for non-personalized ads only: they are not based on your activity in other apps or sites, and Kolday does not show the iOS tracking prompt or use the advertising identifier (IDFA) to track you. Google may still process your IP address and device and app information to deliver and measure the ad, limit how often it appears and prevent fraud, under Google's own privacy policy. In the EEA, the UK and Switzerland, Google's consent form may appear before the first ad.
What ads never receive. Your recordings, transcripts, entries, analyses, mood, name and email are never sent to Google or to any advertiser. The ad is requested by the app on your iPhone; we do not send journal data to an ad network and do not choose ads based on it.
No analytics, no sale. The app contains no analytics or crash-reporting SDKs. We do not sell or rent your data, and we do not use your content for advertising.
13. Changes
We may update this policy when the app changes. The effective date at the top shows the latest version. If a change affects what is sent to AI providers, the app asks for your consent again.