Privacy Policy

1. Who we are

Clicked Emotions is operated by Coding Monks OÜ, a company registered in Estonia. References to “we”, “us”, or “our” refer to Coding Monks OÜ.

For privacy questions: privacy@clickedemotions.com

2. What we collect

We collect only what is necessary to provide the service:

• Account information — your email address and authentication credentials. If you sign in with a third-party identity provider, we receive only your name and email from that provider.
• Journal content — your entry text, photos, emotion labels, and AI-generated insights. This content is encrypted on your device before it reaches our servers. We store only encrypted data and cannot read it.
• Metadata — entry dates, word counts, and creation timestamps. This is stored unencrypted solely to display your journal timeline without requiring decryption.
• Usage data — standard server logs (IP address, browser type, pages visited) retained for up to 30 days for security purposes only.
• Product analytics — anonymised feature usage events (e.g. which features are used, not what you write) to help us understand and improve the product.

3. How we use your data

We use your data solely to provide, maintain, and improve the service you have signed up for. We do not sell your data, use it for advertising, or share it with any party beyond what is described in this policy.

The table below sets out the lawful basis under GDPR for each type of processing:

4. Analytics and product monitoring

We use limited product analytics tools to understand how the app is used — for example, which features are used and where users encounter problems. These tools collect anonymised event data and do not receive the content of your journal entries.

We do not use advertising networks, behavioural tracking, or cross-site tracking of any kind. We do not build advertising profiles or sell usage data.

We also use error monitoring tools to detect and fix crashes and reliability issues. These tools receive technical diagnostic information (e.g. error messages, device type) and do not receive journal content.

5. No sharing of emotional data

We do not share your journal entries, AI-generated insights, emotion tags, or any other personal content with therapists, employers, family members, schools, insurers, healthcare providers, law enforcement, or any other third party — unless you explicitly choose to use a sharing feature, or unless we are compelled by a valid legal order.

If we ever receive a compelled legal request for data, we will notify you to the extent permitted by law. Because your journal content is encrypted and we cannot read it, we are also unable to produce readable journal content in response to any such request.

6. AI processing

Some features of Clicked Emotions use artificial intelligence to process your content — for example, to transcribe handwritten photos or analyse emotional patterns in your writing. To provide these features, your content is temporarily transmitted to a third-party AI processing provider.

During AI processing, your content is in readable form for the duration of the request only — typically a matter of seconds. It is not stored, logged, or retained by us or our AI provider after the response is returned. Our AI provider is contractually prohibited from using your content to train or improve AI models.

After AI processing is complete, all content is encrypted on your device before being saved. If you prefer not to use AI features, you can use the app in transcription-only mode.

7. Encryption and key management

All journal content is protected by end-to-end encryption using industry-standard algorithms. Your encryption keys are derived from your password and are never transmitted to or stored by us in a readable form.

A recovery key is generated when you create your account. If you lose your password and your recovery key, your encrypted data cannot be recovered by anyone, including us. This is by design.

8. Sensitive data

Emotional and mood data may constitute sensitive health-related personal data under GDPR Article 9. We treat all journal content as sensitive regardless of legal classification. Our encryption means this data is never accessible to us in readable form.

By creating an account and using AI features, you explicitly consent to the processing of this data as described in this policy. You may withdraw consent at any time by deleting your account.

9. Third-party service providers

To operate the service, we use third-party providers in the following categories:

• Authentication and database — stores your encrypted data and manages account authentication.
• Hosting and infrastructure — serves the application and handles network requests.
• Payment processing — handles subscription billing. We never receive or store your card details directly.
• AI processing — temporarily processes content to enable transcription and emotional analysis (see Section 6). Your content is not retained or used for training.
• Product analytics — receives anonymised usage events to help us understand feature usage. Does not receive journal content.
• Error monitoring — receives technical diagnostic data to help us detect and fix reliability issues. Does not receive journal content.

All providers are bound by data processing agreements. None are permitted to use your data for their own purposes. We do not use advertising networks, social media trackers, or data brokers.

For a full list of sub-processors, contact us at privacy@clickedemotions.com.

10. Data retention and deletion

Your data is retained for as long as your account exists. When you delete your account from Settings, we permanently delete all your journal content, encryption keys, photos, and account information. Deletion is immediate. Backups are purged within 30 days.

11. Your rights

Depending on your location, you may have the right to access, correct, export, restrict processing of, or delete your personal data. To exercise any of these rights, contact us at privacy@clickedemotions.com.

Because your journal content is end-to-end encrypted, we cannot provide readable exports of it on your behalf — but you can export your own data directly from the app while your vault is unlocked.

If you are in the European Economic Area, you have the right to lodge a complaint with your local data protection supervisory authority.

12. Children

Clicked Emotions is not directed at children under 16. We do not knowingly collect data from anyone under 16. Contact privacy@clickedemotions.com if you believe a child has created an account.

13. Changes to this policy

If we make material changes, we will notify you by email or in-app notice at least 14 days before changes take effect. Continued use after that date constitutes acceptance.