Privacy Policy

This policy explains where Pixel Journal data is stored, what is sent to third-party services, and what rights you have.

1. Data controller

Esteban Reynier, independent developer
Email: privacy@pixeljournal.app
Website: pixeljournal.app

2. Local journal and private iCloud storage

Pixel Journal does not create a user account and does not operate a server or database containing a copy of your journal. Working data is stored locally on your iPhone.

After onboarding, if you are a Premium user and iCloud is available to the app, journal sync may start automatically. A copy is then stored in the private CloudKit database of your Apple account. It may contain entries, deletion markers, profile data, settings, trackers, free-plan progress, language, and reminder preferences. Apple operates this private database; the developer has no dashboard for browsing your journal.

Even without Premium, iCloud may separately retain your free-plan progress: earned tracker slots, remaining tracker replacements, the replacement reset date, and the status of the offer linked to your streak. This storage does not contain journal entries.

Uninstalling the app removes the local copy, but not necessarily the private iCloud copy, which may restore your journal after reinstallation. You can manage iCloud data through the settings provided by Apple.

3. Product analytics — PostHog

Production builds send usage events to PostHog Cloud EU. They are associated with a stable random identifier created on the device, not with a Pixel Journal account, email address, or civil identity. This data is pseudonymous, not strictly anonymous, and can be viewed by the developer in the PostHog project.

Events may include:

• screens visited and product features used;
• app version, device model, and technical information;
• onboarding answer categories and selected trackers;
• tracker type—such as mood, sleep, menstrual cycle, allergy, digestion, or exercise—together with the selected level and date;
• purchase funnel steps, iCloud states, and error codes.

Since version 1.3.6, first names are no longer sent to analytics. We have asked PostHog to delete the older values already stored. We do not collect email addresses, free-form journal text, contacts, photos, or precise location.

Comparing app presentations

We may compare different presentations before the Premium offer. PostHog receives the existing pseudonymous identifier, the assigned variant and date, screens actually viewed, actions, and any fallbacks or errors. Context includes the app version and build, language, environment, product, price, currency, trial terms, selected tracker count, and available acquisition information. The first assigned variant is kept to compare the journeys over time.

Personalization uses choices you have already made on your device. This test’s events add no first name, questionnaire answers, mood values, or journal entry content. The displayed examples use demonstration data and do not become entries in your journal. The other usage events described above continue to operate as usual.

4. Attribution and subscriptions

• Tenjin receives a pseudonymous identifier, installation or device identifiers when permitted by iOS, and install/conversion events. It receives no journal content.
• TikTok receives attribution events mapped by Tenjin.
• RevenueCat processes information needed for purchases, subscriptions, and restorations. The app sends it the same random identifier used with PostHog and Tenjin, plus the Tenjin installation identifier when available. It also asks the RevenueCat SDK to collect available device identifiers to link purchases with attribution. Apple processes payment.

RevenueCat sends our PostHog Cloud EU project events confirming trials, purchases, trial conversions, renewals, and refunds. The shared pseudonymous identifier, transaction identifiers, and links between RevenueCat identifiers help match them to the app journey and avoid duplicates. RevenueCat may also receive the test identifier, revision, variant, and assignment date. This matching measures trials and subscriptions without sending your journal content.

Access to the iOS advertising identifier depends on your App Tracking Transparency choice. Apple's aggregate attribution may still operate when this access is denied. Denying this access does not stop product analytics or all attribution events.

5. Website

pixeljournal.app uses Umami for aggregate traffic statistics without advertising cookies. It does not host data entered in the app.

6. Purposes and legal bases

• provide the journal, iCloud backup, and Premium features;
• understand usage, improve the product, and diagnose errors;
• compare app presentations and measure trials, subscriptions, and refunds;
• manage purchases and measure acquisition campaigns.

App and iCloud functionality is processed to provide the requested service. Product analytics is based on the legitimate interest of improving the service. Advertising processing that requires permission is based on your ATT choice and, where required by law, your consent.

7. Retention and recipients

• Local data: until deletion or app uninstallation.
• iCloud copy: according to your settings and Apple account retention.
• Product analytics: according to the retention period configured in PostHog and applicable deletion requests.
• Purchases and attribution: for the periods needed to provide the service and meet applicable provider obligations.

For these comparisons, trials are measured within 24 hours of assignment, and subscriptions, revenue, and refunds within 35 days. These measurement windows do not trigger automatic deletion. The developer may retain protected pseudonymous exports containing first assignments, identity links, and transactions needed for follow-up and data corrections; result tables are aggregated. Export retention follows the periods needed for this processing and applicable deletion requests, separately from provider retention.

Technical recipients are Apple, PostHog, Tenjin, RevenueCat, and the ad platforms to which Tenjin sends conversions. Some providers may process data outside the European Union under applicable contractual safeguards.

8. Your rights

You may request access, correction, erasure, restriction, objection, or portability by contacting privacy@pixeljournal.app. The in-app CSV export is a Premium feature. Requests concerning your data rights do not require a subscription. You can manage the private iCloud copy through your Apple account.

Deleting an entry removes it from the current journal. A deletion marker is retained for iCloud sync; the remote copy may retain the previous state until the next successful sync. This action does not delete events already sent to analytics services.

9. Security and minors

The local copy benefits from iPhone protections and network exchanges use HTTPS. Pixel Journal is not specifically directed at children. For a minor, use of the app and processing activities based on consent must be authorized or supervised by a parent or legal guardian where required by local law.

10. Changes, complaints, and contact

This policy may be updated when the product or its providers change. You may lodge a complaint with your competent data protection authority, including the CNIL. Questions can be sent to privacy@pixeljournal.app.