Privacy Policy

1. Information We Collect

1.1 Information You Provide

• Account information: Email address, display name, and password (stored as a secure hash via Supabase Auth).
• Journal entries: Text you type, voice recordings and their AI transcriptions (via Groq Whisper), and any captions you add. Voice recordings are not permanently stored after transcription.
• Photos: Images you upload as journal entries or as your daily Photo of the Day. Photos are compressed before upload and stored on Cloudflare R2.
• Letters and Patterns: Long-form letters and recurring family moments you save in the Memories section.
• Preferences: Your chosen Weave tone and email notification settings.
• Pairing information: The invite code used to link your account with your partner's account.

1.2 Information Generated Automatically

• AI-generated Weaves: Each morning, the Anthropic Claude API synthesizes your and your partner's daily entries into a shared narrative called a Weave. The resulting Weave is stored in our database.
• Timestamps and metadata: Entry creation time, date, and type (text, voice, photo) are recorded to power the journal feed and calendar views.
• Usage data: Basic server-side logs (request timestamps, error logs) may be retained for debugging. In the app, we record which setup screens you reach and the choices you make there (for example, whether you invite a partner or turn on notifications), linked to your account, so we can improve the setup experience. We keep this ourselves and never share or sell it. We do not use third-party analytics trackers.

1.3 Information We Do NOT Collect

• We do not collect payment card details directly. Payments are processed by Apple through the App Store, which has its own privacy policy.
• We do not use advertising tracking pixels, third-party analytics SDKs, or behavioural advertising.
• We do not collect personal information directly from children under 13. Entries and photos about your children are submitted by you as the adult account holder.

2. How We Use Your Information

We use the information we collect only to operate and improve the Service:

• Provide the Service: Store and display your entries, generate nightly Weaves, deliver Weave and reminder emails, and serve your photos.
• AI processing: Your journal entries are sent to the Anthropic Claude API to generate your Weave. Anthropic processes this data under their API terms of service. Your entries are not used to train Claude or any other AI model.
• Voice transcription: Voice recordings are sent to Groq's Whisper API for transcription. The transcription is stored; raw audio is not permanently retained after transcription.
• Email communications: We send your daily Weave, evening reminders, and transactional emails (account confirmation, password reset) via Resend. You can stop reminder, Weave, and trial emails at any time using the Unsubscribe link at the bottom of any of them.
• Service improvement: Aggregate, de-identified usage patterns may inform product decisions. We never analyse your personal content for this purpose.
• Legal compliance: We may retain or disclose information as required by applicable Canadian law or valid legal process.

3. How We Share Your Information

We do not sell your personal information. We share your information only in the following limited circumstances:

3.1 With Your Partner

When you pair with another user, both partners can view each other's journal entries, photos, and shared Weaves within the pair context. This is the core function of the Service and the basis on which you consented when pairing.

3.2 Service Providers (Sub-processors)

We share data with the following service providers, only as needed for each to provide its part of the Service. Each processes your data under its terms of service, including its data processing terms where it offers them:

• Supabase — Authentication, PostgreSQL database, and file metadata storage.
• Cloudflare R2 and Workers — Photo storage and delivery. Photos are served via signed URLs: in-app URLs expire after 24 hours; email URLs expire after 7 days.
• Anthropic (Claude API) — AI-generated Weave narratives.
• Groq (Whisper API) — Voice-to-text transcription.
• Resend — Transactional email delivery.
• Vercel — Application hosting and serverless compute.
• Expo — Push notification delivery (evening reminders, partner nudges, and new-Weave alerts). Receives your device's push token and the notification text.
• Apple — App Store purchases and delivery of push notifications to your iPhone.
• Upstash — Rate limiting to prevent abuse. Receives user identifiers and IP addresses, not your journal content.
• Sentry — Error monitoring and crash reporting. May receive device information, user identifiers, and error context.
• RevenueCat — In-app subscription management and purchase validation on iOS. Receives user identifiers and subscription state. Payment itself is processed by Apple through the App Store; we do not store card details.

3.3 Legal Requirements

We may disclose your information if required to do so by Canadian law, regulation, court order, or to protect the rights, property, or safety of Woven Moments, our users, or the public.

3.4 Business Transfers

If Woven Moments is acquired, merges with another company, or sells substantially all of its assets, your information may be transferred as part of that transaction. We will notify you by email before your data is transferred and becomes subject to a different privacy policy.

3.5 Safety, Abuse & Illegal Content

To keep the Service safe and lawful, we may access, review, preserve, and disclose your content and account information when we have a good-faith belief that doing so is reasonably necessary to: (a) detect, investigate, or respond to a report of objectionable content, abuse, or a violation of our Terms; (b) detect, prevent, or address fraud, security, or technical issues; or (c) comply with applicable law or a valid legal request. We may use automated tools to detect known child sexual abuse material (CSAM). Where we become aware of apparent CSAM, we will preserve it and report it to the appropriate authorities — including the National Center for Missing & Exploited Children (NCMEC) and the Canadian Centre for Child Protection (Cybertip.ca) — as required by law. This is an exceptional safety measure; we do not otherwise monitor or read your private entries.

4. Data Retention

We retain your data for as long as your account is active or as needed to provide the Service. Specifically:

• Journal entries, photos, Letters, and Patterns: Retained until you delete them individually or close your account.
• Weaves: Retained as shared pair content. Weaves survive individual account deletion as described in the Terms of Service.
• Account information: Retained until account deletion.
• Deleted content: Removed from our live systems at the time of deletion. Copies may remain in our providers' backups until those backups expire on their normal schedule.
• Email logs: Delivery metadata retained by Resend per their retention policy (typically 30 days).
• Server logs: Retained for up to 90 days for debugging, then deleted.

5. Security

We take reasonable technical and organisational measures to protect your data, including:

• Passwords are hashed and never stored in plain text, managed by Supabase Auth.
• All data in transit is encrypted via TLS/HTTPS.
• Photos are stored in Cloudflare R2 with access controlled by signed, time-limited URLs. Photos are accessible only to you and your paired partner.
• Database access is governed by Supabase Row Level Security (RLS) policies ensuring each user can only access their own pair's data.
• API keys and secrets are stored as environment variables and never hardcoded.

No security system is perfect. You are responsible for exercising your own judgment about the sensitivity of content you choose to upload. We encourage you to consider carefully before storing highly sensitive images or information in any digital service, including Woven Moments.

If a breach of security safeguards involving your personal information creates a real risk of significant harm to you, we will notify you as soon as feasible and report the breach to the Office of the Privacy Commissioner of Canada, as Canadian law requires. We keep a record of every breach.

6. Your Rights & Choices Under PIPEDA

Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), you have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you. We will respond within 30 days.
• Correction: Update inaccurate or incomplete information from within the app (Settings, entry editing).
• Deletion: Delete individual entries, photos, Letters, or Patterns at any time from within the app. You can edit the text of a Weave in the app; to have a Weave removed, contact us. To delete your entire account, use the Settings screen in the app, or contact us at hello@wovenmomentsapp.com.
• Data export: In-app export is not currently available. You may request a copy of your data by emailing hello@wovenmomentsapp.com and we will fulfill reasonable requests within 30 days. We strongly recommend requesting an export before deleting your account, as deletion is permanent.
• Withdraw consent: You may withdraw consent to our processing of your personal information by deleting your account. Note that withdrawal does not affect Weaves, which are jointly generated shared content.
• Opt-out of emails: Stop reminder, Weave, and trial emails at any time using the Unsubscribe link in any of them. Push notifications are controlled separately in the app under Settings. Transactional emails (account confirmation, password reset) cannot be disabled as they are necessary for account security.
• Complaints: If you believe we have not handled your personal information in accordance with PIPEDA, you may file a complaint with the Office of the Privacy Commissioner of Canada at www.priv.gc.ca.

To exercise any of these rights, email us at hello@wovenmomentsapp.com.

Washington residents: see our Consumer Health Data Privacy Policyfor how we handle health information in your journal and your rights under Washington's My Health My Data Act.

7. Cookies & Local Storage

We use minimal browser storage to keep you logged in and remember your preferences. We do not use third-party advertising cookies or cross-site tracking.

8. Children's Privacy

Woven Moments is designed for adults aged 18 and over. We do not knowingly collect personal information directly from children under 13. Because many families use the app to capture memories involving their children, entries and photos about minors are submitted by and under the responsibility of the adult account holder.

If you believe we have inadvertently collected personal information from a child under 13 without parental consent, please contact us at hello@wovenmomentsapp.com and we will delete it promptly.

9. International Data Transfers

Woven Moments is operated from Ontario, Canada. Our service providers (Supabase, Cloudflare, Anthropic, Groq, Resend, Vercel, Expo, Apple, Upstash, Sentry, RevenueCat) may process data in the United States and other countries. By using the Service, you consent to the transfer of your data outside of Canada for processing by these providers. We take reasonable steps to ensure that transferred data receives a level of protection consistent with Canadian privacy law.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email and by displaying a prominent notice in the app at least 14 days before changes take effect. The Last Updated date at the top reflects the most recent revision.

11. Contact & Privacy Officer

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact our Privacy Officer at:

You also have the right to file a complaint with the Office of the Privacy Commissioner of Canada: www.priv.gc.ca or 1-800-282-1376.