Privacy Policy
SecretiBenefits-Relationship
This policy explains how this application handles information and how to contact us about privacy.
Information we process
SecretiBenefits is a private reflection journal for adults. On your iPhone it stores the pseudonyms, connection notes and meeting dates you enter, dated journal text and tags, pinned status, five-axis mood ratings, plans and text addresses, boundaries, red flag notes and private notes. These records are encrypted in an application file using AES-256-GCM. A randomly generated installation secret is kept in the device Keychain and is not sent to our server. Backup preferences are stored locally. If you enable encrypted server backup, the server receives an opaque encrypted copy of these records, a separate installation authentication token over HTTPS, and the size of the encrypted copy. PostgreSQL stores a hash of that token, a random installation identifier, creation and update timestamps, and the latest encrypted blob. The encryption key is separately derived on your device and is never sent. The service and its Railway hosting infrastructure necessarily receive network requests and associated technical information such as IP addresses, request times, paths, response status and connection metadata, including requests to this policy. Our application does not request your email, real name, photographs, contacts or location, and has no account system.
How we use information
Local records let you organize connections, write reflections, track your own ratings, maintain boundaries and plan meetings. Insights and chemistry calculations run locally; plaintext journal content is not submitted for analytics. Device authentication protects entry to the journal and an opaque cover hides content when the app becomes inactive. Optional local notifications remind you of a plan using fixed neutral wording without pseudonyms, addresses or notes. Optional encrypted backup saves the latest copy for restoration by the same installation. Installation authentication authorizes access to that copy. Technical information is used to deliver requests, check database readiness, diagnose generic service failures and limit abuse.
Service providers and sharing
We do not include advertising, analytics, social sign-in, outbound email or other third-party application SDKs. The backend runs on Railway with a Railway-hosted PostgreSQL database; Railway and its infrastructure providers process encrypted backups and technical traffic as hosting providers. The service does not send the decrypted journal or its encryption key to them. Operating-system authentication, Keychain and notification functions are provided by iOS on your device. Opening the public policy sends an ordinary web request to the hosting service. Our server code logs generic startup and failure events and random request identifiers, without authorization headers, journal blobs or plaintext records. Hosting-level network and operational logs are separate from these application logs. We do not sell personal journal records or provide a public feed.
Data retention
Local records remain until you edit or delete them in the app or remove the app's local storage. The journal file is excluded from the app's iCloud device backup and uses complete file protection. The installation secret is marked as accessible only while the device is unlocked and as belonging to this device; a Keychain item may persist across app removal. We do not promise recovery after reinstallation or loss of that key. The server keeps one current encrypted backup and the installation record until you request server deletion. A new upload replaces the current database row; this application does not keep a version history or set an automatic expiry. Turning backup off stops future uploads but does not remove a stored server copy. Rate-limit metadata is held temporarily in process memory with one-minute windows and bounded entries, and is cleared on process restart. Railway operational logs, database storage and any provider snapshots follow the provider's configuration and lifecycle. We have not established a specific retention or final erasure duration for provider logs or snapshots and do not promise one.
Deleting your information
You can delete individual connections, journal entries, plans and vault notes. Deleting a connection also removes its linked entries, ratings, plans and notes locally; with backup enabled, a later successful upload replaces the encrypted server copy. In Settings, Delete server backup removes both the installation database row and its encrypted backup and turns backup off. Delete all local and server data first requires successful server deletion, then clears the local journal and pending reminders. If the network operation fails, the app reports the failure and does not claim complete deletion. Delete local data only is available with backup off and leaves any server copy until you delete it separately. Database deletion removes the live rows; it cannot guarantee immediate removal from infrastructure logs, storage remnants or provider snapshots. There is no account or password recovery route. We cannot identify or decrypt your backup from an email address, and losing the installation secret can prevent you from authorizing later access or deletion through the app.
Permissions and your choices
Face ID, when available, is used through Apple's LocalAuthentication framework; your device passcode is the operating-system fallback. We do not receive biometric templates or your device passcode. A configured device passcode or supported device authentication is required to open the journal. The app asks for notification permission only when you enable a plan reminder. You can deny or withdraw notifications in iPhone Settings; your saved plans and journal remain usable. After restoring a backup, reminders must be enabled again. No camera, microphone, photo library, calendar database, contacts, geographic map or location permissions are requested.
Your privacy rights
You can inspect, edit and delete your records directly in the app. Depending on applicable law, you may have rights to access, correct, restrict or object to processing, request deletion or portability, and complain to your local data protection authority. For privacy questions or requests, contact sinclair.stricklandd@icloud.com. This address is a public privacy contact; the app does not use it for accounts, verification or message delivery. Please do not email intimate journal content or installation secrets. Because the service has no identity account and stores only encrypted records, we may be unable to associate a request with a particular installation or recover its content. The authenticated in-app controls are the direct way to manage your installation's server data.
Security
Journal content is encrypted with AES-256-GCM using a 256-bit key independently derived from the random device installation secret. A separately derived authentication token is sent over HTTPS and only its SHA-256 hash is stored in PostgreSQL. Every private API operation is scoped to that installation; another token cannot read its backup. The server applies payload limits, basic request rate limits, database constraints and bounded connections. The application locks after backgrounding and immediately covers inactive content. We do not receive the device passcode or encryption key. These measures reduce risk but cannot guarantee security on a compromised or unlocked device, prevent a person from photographing a visible screen, or guarantee uninterrupted service. Keep your iPhone and passcode secure.
Children’s privacy
SecretiBenefits is intended for adults aged 18 and older and is not designed for children. We do not intentionally solicit information from children. If you believe a child has supplied data through this service, contact sinclair.stricklandd@icloud.com without including sensitive journal content, and we will consider the request within the limits of the installation-based encrypted storage model.
Changes to this policy
We may update this policy when application behavior, hosting or privacy practices change. The current policy is available through the app's Settings and this public page, and its effective date identifies the version in effect. Review the policy when updating the app or changing backup preferences. Material changes will be reflected in the policy and, where appropriate, application release information.