journdaily
JournDaily is a cloud-connected app. To use it you create an account, and your journal — including text, photos, videos, places, and conversations — is stored on our servers. This policy explains what we collect, why, and your rights over that data.
1. About JournDaily
JournDaily (“we”, “our”, or “the app”) is a private-first travel and life journal for the web, iOS, and Android, developed by ALIV CODE Ltd. You write days, organise them into trips and chapters, and may later share selected memories with people you choose.
This Privacy Policy explains what information we collect when you use JournDaily, how we use it, and your rights regarding that information. It applies to the JournDaily applications and to this website.
2. Account registration
Using JournDaily requires creating an account. During registration we collect:
- Your email address (used for authentication and email verification via AWS Cognito)
- A username (public-facing identifier within the app)
- A display name (shown on your profile and to other users)
- A password (hashed and managed by AWS Cognito — we do not store your plaintext password)
You may sign in with Apple where that option is offered. Apple provides us with an identifier and, depending on your choice, your email address. You may also enable multi-factor authentication (TOTP), which is managed through AWS Cognito.
3. Data we collect and store
Core app data is stored server-side. The following information is collected and stored on our servers:
| Category | What we store |
|---|---|
| Account & profile | Email, username, display name, avatar image, profile visibility (public or private), optional home / current location, theme and similar preferences |
| Journal | Entry text, dates and times, attached photos and videos, places you attach to an entry, and the trip or chapter an entry belongs to |
| Trips & chapters | Titles, dates, destinations and travel details you add, covers, and membership of group trips |
| Sharing | Shared Chapters you create (title, cover, audience, optional unlisted link token, and a snapshot of the memories you chose to share) |
| Social | Follow requests and accepted follows, likes and comments on shared items, blocks, and in-app messages |
| Notifications | Events such as follows, messages, and activity on content you have shared |
| Moderation | Reports you submit about other users or content, and reports others submit that mention you |
| Security events | Event type, timestamp, IP address, User-Agent string, associated user ID |
| Policy acceptance | Timestamp, IP address, and User-Agent recorded when you accept our Terms and Privacy Policy |
| Feedback | In-app feature requests and issue reports you submit |
Your device stores authentication tokens and a small number of local preference flags (such as theme). Journal content is not kept as the primary copy only on the device.
4. Location
JournDaily does not continuously track your GPS. Location appears only when you choose to add it:
- An optional home or current place on your profile
- A place you attach to a journal entry or trip
Places on private entries stay private with those entries. Places on a Shared Chapter follow the audience you gave that chapter.
5. Photos, video, and files
If you grant the app access to your photo library, that permission is used to set a profile picture, attach media to journal entries, and (where offered) save media from messages. Originals and derived sizes (thumbnails, resized images, transcoded video) are stored in our object storage. Access is granted with short-lived links; we do not put journal objects on a public bucket.
6. Third-party services
JournDaily relies on the following infrastructure to operate:
- AWS Cognito — authentication, identity, email verification, and MFA. Subject to Amazon’s privacy policy.
- MongoDB — database where app data is stored. Subject to MongoDB’s privacy policy.
- Redis — rate limiting and server-side caching. Transient data; not a lasting personal archive.
- Amazon S3 (or an equivalent object store in development) — avatars and journal media.
- Apple — Sign in with Apple, and App Store diagnostics if you install from Apple. Subject to Apple’s privacy policy.
- Google — Play Store diagnostics if you install from Google. Subject to Google’s privacy policy.
We do not use advertising networks, and we do not sell your personal data.
7. How we use your data
We use the data we collect to:
- Provide, maintain, and improve JournDaily
- Authenticate you and secure your account
- Store your journal and show it back to you across devices
- Honour sharing you initiate (followers, Shared Chapters, unlisted links, group-trip membership)
- Deliver messages and notifications
- Detect abuse, spam, and security incidents
- Keep an audit trail of consent to these terms and this policy
- Respond to feedback, reports, and support requests
8. Sharing and visibility
Journal entries start private. Other people see your writing only when a specific mechanism allows it, for example:
- You include a memory in a Shared Chapter whose audience they belong to
- They open an unlisted link you enabled for a Shared Chapter
- They are a member of a group trip you added them to (members of that trip can read its entries)
- Your public profile fields (username, display name, avatar, and anything you mark visible) when someone views or searches for you
Follow relationships are stored on our servers. Likes and comments attach to shared items, not to your private diary. If you revoke a share or rotate a link, new access stops; already-issued media URLs expire after a short time.
9. Security event logging
We log security-relevant events (such as login attempts, password changes, and suspicious activity). These logs include event type, timestamp, IP address, User-Agent, and user ID. They are used for security monitoring and are not sold. We may disclose them if required by law.
10. Data retention and account deletion
Your data is retained for as long as your account is active. You can delete your account from JournDaily settings. Account deletion removes your profile, journal, media, and related app data from our active systems, and removes authentication credentials from AWS Cognito.
Some records may be kept after deletion for legal and audit purposes:
- Security event logs — up to 12 months
- Consent records (that you accepted Terms and this policy) — up to 7 years
- Any data we are required to retain by law — for the period that law requires
Copies of memories you already shared with others (for example a Shared Chapter snapshot another person can still open until you unshare it, or a message you sent) may remain visible to those recipients in line with how those features work. Delete your account or unshare when you want that to stop going forward.
Within the product, deleting an entry usually marks it deleted rather than erasing the database row immediately. Deleted entries are hidden from the app. Account deletion is the path that removes your data from the service as described above.
11. Children’s privacy
JournDaily is intended for users aged 13 and over. This minimum age aligns with UK GDPR and the ICO’s Age Appropriate Design Code, which permits services to set a minimum age of 13 for UK users when appropriate safeguards are in place.
If you are located in an EU member state that has set a higher age of digital consent (up to 16 under EU GDPR), you must have obtained parental or guardian consent before using JournDaily. We do not knowingly collect personal information from children below the applicable minimum age. If you believe a child below that threshold has created an account, contact us at [email protected] and we will delete that account and its associated data.
12. Your rights under UK GDPR and applicable data protection law
As a user of JournDaily, you have the following rights under UK GDPR (and, where applicable, EU GDPR):
- Access — request a copy of the personal data we hold about you
- Rectification — ask us to correct inaccurate or incomplete data
- Erasure — request deletion of your personal data; you can also delete your account in the app
- Restriction — ask us to limit how we use your data in certain circumstances
- Portability — request your data in a structured, commonly used, machine-readable format
- Objection — object to processing based on legitimate interests
- Withdraw consent — where processing is based on consent, withdraw it without affecting the lawfulness of prior processing
To exercise these rights, contact [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with the UK Information Commissioner’s Office at ico.org.uk, or — if you are in the EEA — with your local data protection authority.
13. International processing
We operate from the United Kingdom. Some processors (for example Amazon Web Services) may handle data in other regions. Where we transfer personal data internationally, we do so with appropriate safeguards required by UK data protection law.
14. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be communicated in the app. The “Last updated” date at the top of this page always reflects the most recent revision. Continued use after a change means you acknowledge the revised policy. Where the app requires a new acceptance, you will be asked to accept before continuing.
15. Contact us
Questions about this policy or your personal data:
[email protected]
ALIV CODE Ltd, United Kingdom