1. Information We Collect

We collect only what is necessary to provide the Service:

• Account information — your email address and optional phone number, provided at sign-up.
• Journal content — the behavioral journal entries, behaviors, and tags you create.
• Logging-activity metadata — dates and counts derived from when journal entries are saved. This metadata is already part of each journal entry; the usage dashboard does not add a separate tracking record.
• Usage data — standard web server logs (IP address, timestamps, HTTP status codes) retained for up to 7 days for security and debugging.

We do not collect payment information directly. If billing is introduced, it will be handled by a PCI-compliant third-party processor and this policy will be updated accordingly.

2. Children's Privacy

Behavior Insights is intended for users who are at least 18 years old and is not directed at children. We do not knowingly collect personal information from anyone under 18.

If we learn that an account belongs to someone under 18, we will disable further data collection from that account, retain only what is legally required, and take appropriate steps regarding deletion and notification under applicable law. If you believe a user under 18 has provided us information, contact brian.colfer@gmail.com.

3. How We Use Your Information

Your data is used exclusively to:

• Provide and operate the Behavior Insights Service.
• Measure aggregate usage and engagement counts so we can understand whether the Service is being used.
• Send transactional emails and essential administrative announcements about the operation of the Service, such as planned outages, security notices, and material account or service changes.
• Diagnose and fix technical issues.

Administrative announcements are limited to service-related communications. We do not use this category to send advertising or promotional marketing.

We do not sell, rent, or share your personal information with third parties for marketing purposes. We do not use your journal content to train machine-learning models without your explicit opt-in consent.

4. Data Storage and Security

Your data is stored on secured servers hosted by DigitalOcean (San Francisco region, United States). Access to the server is restricted by SSH key authentication.

Encryption at rest: Backups are encrypted before they leave the server and can only be read with a key held separately from the backup storage. The live database file itself is not encrypted by the application; it is protected by server access controls, which means anyone with administrative access to the server can read it. We describe this plainly rather than claiming more than the system does.

Encryption in transit: All data is transmitted over HTTPS/TLS. HTTP connections are automatically redirected to HTTPS.

5. Data Retention and Deletion

We retain your data for as long as your account is active. If you request account deletion, access is disabled immediately and all active API sessions are revoked. You have 24 hours to cancel using the recovery link sent to your account email. After that deadline, journal entries, behaviors, tags, invitations, credentials, and other account data are permanently removed from the live service.

Minimal audit facts consisting only of an action name and timestamp may be retained. User references, email addresses, IP addresses, and audit payload values are removed. Backups containing deleted data expire on a 7-day rolling schedule.

You can request deletion from your Account page or through the authenticated mobile API. Contact brian.colfer@gmail.com if you cannot use the self-service process.

6. Data Sharing

We do not share your personal data with third parties except:

• Hosting infrastructure — DigitalOcean stores your data as the cloud provider.
• Email delivery — Mailgun is used to send transactional emails and essential administrative service announcements. We share the recipient email address and message content with Mailgun only as needed to deliver and monitor the email.
• Legal requirements — if required by law, court order, or to protect the safety of users.

7. Analytics and AI Features

Behavior Insights does not currently use third-party analytics or tracking services. All pattern analysis (Data Discovery, Pattern Observations, Insights) is computed locally on our servers using only your own data.

Administrators can see first-party aggregate logging counts, but the reporting does not show administrators your journal content, account identity, behavior names, or tags. Activity contributed by groups of one to four people is shown only as “Fewer than 5.” A zero may be shown exactly because it represents no user activity.

When you are signed in, Insights provides an exact logging-activity summary for your own account. It does not permit you or an administrator to use that feature to view another person’s account.

If optional AI-powered features are introduced in future, we will request your explicit consent before any of your data is processed by an external AI service. You will be able to opt in or out independently of your core account.

8. Your Rights

You have the right to:

• Access — request a copy of the personal data we hold about you.
• Correction — ask us to correct inaccurate information.
• Deletion — use the self-service 24-hour deletion process or ask us for assistance.
• Portability — request your journal data in a machine-readable format.

To exercise any of these rights, contact us at brian.colfer@gmail.com. We will respond within 30 days.

9. Cookies

We use session cookies solely to keep you signed in. We do not use advertising cookies, third-party tracking pixels, or any persistent cross-site tracking technology.

10. Changes to This Policy

We may update this policy from time to time. We will notify you of material changes via email or an in-app notice at least 14 days before they take effect. The “Last updated” date at the top of this page always reflects the current version.

11. Contact

For privacy-related questions or requests, contact: brian.colfer@gmail.com.