Privacy policy

What stays with you

The one exception is Recap summaries, if you turn them on (see Our AI provider). Photos are re-saved without location, camera or capture details before they reach your journal. You can turn iCloud sync off in Settings. Turning it off leaves the copy already in iCloud alone; you can manage that in your iPhone's iCloud settings.

What reaches our server

An anonymous mood count

When you save an answer, the app sends the date, the blank's language, your mood and your time zone, so the reveal can show how everyone felt. It does this for private answers too. It doesn't send your answer, your name or anything that identifies you. We add your mood to that day's total and store only the total. We use the time zone to check the date, then drop it.

An anonymous device key

The app makes a random key for this phone and keeps it in the phone's keychain, not in iCloud or backups. It lets us count one mood per phone per day and block abuse without knowing who you are. The key stays the same for as long as the app is installed. The signed pass that proves it expires after 30 days, and the app renews it on its own. When you save today's answer, the server returns a signed receipt that unlocks today's reveal. The receipt holds no mood or text.

Answers you share with Everyone

If you turn on Everyone for an answer, we receive the answer text with its date and language. It appears in the reveal and the feed without your name. We store it under a scrambled marker, not your device key. People who run our database can see the text. Answers the app holds back for your safety (see Safety) are never sent.

Your account, if you make one

You only need an account for Friends. Your journal never moves into it. When you sign in we store:

• A random account ID and the name you choose (up to 24 characters), which your friends see
• For Sign in with Apple: no name or email; Apple only confirms it's you
• For Google: a sign-in confirmation only, no email or profile
• For email sign-in: your email address, so we can send your sign-in code

Answers you share with Friends

If you turn on Friends for an answer, we receive the answer text and your mood, with the date and time you answered. Your friends see them with your name. Your friends list, invites and blocks are stored as pairs of account IDs. Invite links don't contain your name; the invite page shows your name and today's blank, never your answer.

Notifications

If you allow notifications, we store your phone's push token from Apple, your time zone and language, and whether you've answered today, so we only remind you when you haven't. Notifications carry general text and a date. They never include an answer, a mood or a friend's name.

Reports and reviews

When you report an answer or a person, we store which answer or account, the reason you chose and what happened next. The person isn't told who reported them. When you ask us to review a hidden answer, we store the request and the outcome.

Our AI provider

We use AI providers for these jobs. It processes only what each job needs and returns a result. Our provider doesn't use it to train its models. It keeps what we send for up to 30 days, longer only when it needs to for trust and safety reasons, and then deletes it.

• Moderation. Answers shared with Everyone or Friends are checked against our community guidelines before others see them. Only the answer text is sent.
• Grouping Everyone answers. To count answers that mean the same thing together in the reveal, we send answers shared with Everyone, with their language. Nothing else is sent. This isn't turned on yet. We'll update this policy before it is.
• Grouping Friends' answers. To show when you and your friends said the same thing in different words, we send your Friends answer and your friends' Friends answers for that day. Only the text and language go, with no names, account IDs, dates or moods. This isn't turned on yet. We'll update this policy before it is.
• Recap summaries. Only if you turn on Recap summaries. The app sends that month's blanks, answers, moods and reasons, including private ones, to write your summary. Notes and photos are never sent. Your request isn't stored or logged on our server, and you can turn this off in Settings at any time.

Usage stats

To see which screens work and which don't, the app sends anonymous usage events to TelemetryDeck, an analytics service built for privacy. Events say things like "an answer was saved" or "the reveal opened", along with the app version, language, theme and how many days since install. They never include your answers, notes, photos, mood, name or friends. The app uses a random ID made for this purpose, not your device key or Apple's device IDs. You can turn this off in Settings under Usage stats. Events waiting to send are dropped when you do.

Safety

The app checks answers for signs that someone may be in distress. This runs on your phone. If an answer matches, the app offers support resources and holds that answer back from Friends and Everyone. The check and its result never reach our server. Held answers are also left out of Recap summaries, so they never reach our AI provider.

Who we share data with

We don't sell or rent personal information, and we don't share it for advertising. We use these services to run Blankaday. Each one only gets what it needs:

We may also disclose information when the law requires it, to protect someone's safety, or as part of a sale or merger of the business, in which case this policy still applies to it.

How long we keep it

• Mood totals are kept for as long as Blankaday runs. They contain nothing about you. The marker that stops a phone counting twice is deleted within two days.
• Friends answers stay until you stop sharing them, delete the day, or delete your account.
• Everyone answers stay until you stop sharing them or delete the day. Deleting your account withdraws them too, from each device that shared them (see below).
• Account data stays until you delete your account.
• Reports, reviews and safety records are kept for one year after they're resolved, then deleted.

Your choices

• Stop sharing an answer. Turn off Friends or Everyone for that day, or delete the day. We remove it from our server.
• Export your journal. Settings, Export journal, as a PDF keepsake or a CSV file. It's built on your phone.
• Delete your account. Settings, Delete account. We delete your name, friends, invites, reports you made about accounts, notification data and your sign-in, and every answer you shared with Friends. Everyone answers aren't linked to your account, so each phone withdraws the ones it shared: this phone does it right away, and your other devices do it when they next sync your journal through iCloud. If a device is offline, has iCloud sync off, or is gone, stop sharing on it first, or write to us. You can also delete your journal from this phone and iCloud at the same time. Anonymous mood totals stay, because they can't be traced to you.
• Turn things off. Usage stats, Recap summaries, iCloud sync and notifications each have a switch.
• Ask us. Write to support@blankaday.com to ask what we hold about you, to correct it or to delete it. Depending on where you live, you may have more rights under laws like the CCPA, and you can use them the same way. We won't treat you differently for using them.

Tracking and ads

Blankaday has no ads. It doesn't use Apple's advertising ID, doesn't track you across other apps or websites, and doesn't share data with data brokers.

Children

You need to be at least 13 to use Blankaday. We don't knowingly collect information from children under 13. If you think a child has given us information, write to us and we'll delete it.

Where your data is

Our server and database are in the United States. Your journal is in your iCloud, wherever Apple keeps it for your account.

Changes

If we change this policy, we'll update the date above. If a change affects what we collect or who sees it, we'll tell you in the app first.