Privacy Policy

The short version

• Your journal entries are private to you. Nobody else can read them in the app.
• We don’t sell your data. There are no ads and no tracking or analytics cookies.
• Your voice is transcribed on your device — no audio is ever uploaded.
• Your journal is stored in the EU. The only thing that leaves is text you send to the AI features — that goes to our AI provider, DeepSeek, in China. See AI features. Don’t use them and nothing you write leaves the EU.
• You can permanently delete your account and everything in it, any time.

Who we are

Oremi (“we”, “us”) is the journaling app at oremi.app. For anything privacy-related, contact questions@oremi.app.

What we collect

Account

• Your email address, and a password (stored hashed — we never see it).
• If you sign in with Google: your name, email address and profile picture from your Google account. We don’t receive your Google password.

Profile

• Your name and how you like to be addressed.
• Optional details you choose during onboarding: occupation, personality.
• A profile picture, if you upload one.
• Your timezone and reminder time, if you enable reminders.

What you write

• Journal entries (typed, or text transcribed from your voice).
• Mood check-ins and any notes attached to them.
• Daily and monthly goals, streaks, and rewards you unlock.

Technical

• A session cookie to keep you signed in. It is strictly necessary — we use no advertising, tracking or analytics cookies.
• If you enable notifications, a push subscription identifying your device to the browser’s push service.
• Standard server logs kept by our hosting provider (e.g. IP address, timestamps).

Voice journaling

Speech-to-text and read-aloud run entirely in your browser using its built-in speech APIs. Audio recordings are never uploaded to us or stored. Only the resulting text is saved — and only if you choose to save the entry. Depending on your browser, speech recognition may be processed by your browser vendor; that is governed by their privacy policy, not ours.

AI features

When you use “Talk it through” or generate a monthly summary, we send the text needed to produce a reply to our AI provider, DeepSeek. That can include:

• the messages in that conversation;
• your first name, preferred term of address, occupation and personality;
• your current mood, and short excerpts of recent entries, so the reply feels continuous.

DeepSeek is based in China, so this text is processed on servers there, under Chinese law. We send only what’s needed for the reply — never your whole journal.

If you ask Oremi about facts or current events, your search query (not your journal) is sent to Wikipedia, DuckDuckGo and Google News to look it up.

If you would rather no journal text ever leaves the app, simply don’t use the AI conversation or summary features — everything else (writing, moods, goals, streaks, the printable journal) works without them.

Where your data lives

Your journal itself is stored in one place, in the EU. Oremi is used around the world, so here is exactly who touches what:

• Supabase — your account, journal and files. Hosted in the EU (Frankfurt). This is where your entries live.
• Vercel — runs and delivers the app from servers around the world, so it’s fast wherever you are.
• DeepSeek — the AI. DeepSeek is based in China, so any text you send to the AI features is processed on their servers there. See AI features below.

International transfers

Because Oremi is used worldwide, your data may be transferred to and processed in countries other than your own — including, if you use the AI features, China. Data protection laws in those countries may be weaker than at home, and (for UK/EU users) China is not covered by an adequacy decision.

You are in control of the part that leaves the EU: only the AI features send text to DeepSeek. Write, track moods, set goals and generate your printable journal, and nothing you write leaves Supabase in the EU.

Who can see your entries

Only you. Every table is protected by row-level security, so the database itself refuses to return one person’s rows to another account.

To be honest with you: your entries are not end-to-end encrypted. They are encrypted in transit (HTTPS) and at rest by our database provider, and access is restricted — but a system administrator with the database’s secret key could technically read them. We don’t do that, and we don’t sell or share your entries with anyone. If you want zero-knowledge storage, it isn’t built yet.

Keeping it safe

• Everything is served over HTTPS and encrypted at rest.
• Per-account row-level security in the database.
• An optional passcode lock on your device, from You → Privacy & passcode.

How long we keep it

Until you delete it. Delete a single entry any time, or delete your whole account from You → Delete my account. That permanently removes your profile, entries, moods, goals, streaks, rewards, uploaded picture and push subscriptions. It cannot be undone, and we don’t keep a shadow copy. Backups held by our providers may persist for a short period before rotating out.

Your rights

Your rights depend on where you live — for example the UK/EU (UK GDPR and GDPR), California, and many other places give you rights to access, correct, export, delete, or object to how your data is used.

We’ll honour those requests wherever you live, not only where the law forces us to. You can edit your profile and delete your account in the app at any moment; for anything else, email questions@oremi.app. If you’re in the UK or EU and we’ve let you down, you can also complain to your local data protection authority.

Children

Oremi isn’t intended for children under 16 — or under the minimum age in your country, if that’s higher. If you believe a child has created an account, contact us and we’ll remove it.

Changes

If we change this policy we’ll update the date at the top, and for anything significant we’ll tell you in the app.

Contact

Questions, concerns, or a data request: questions@oremi.app.