Privacy Policy

Untangle is a private space for your thoughts. We collect the minimum data needed to run the app, we encrypt it in transit and at rest, we never sell it, and you can export or delete your data at any time.

• Account data: email, hashed password, optional display name, account creation date.
• Content you write: journal entries, brain dumps, reflections, and any input you submit to AI features.
• Subscription data: plan, status, billing cycle, renewal date, Founding Member number where applicable. Untangle does not directly collect or store users' full payment card details — those are handled by the payment provider you use (Stripe on the web, Google Play Billing in the Android app).
• Device and log data: IP address, browser type, OS, timestamps, and basic event logs needed for security and reliability.
• Cookies: a session cookie to keep you signed in and a small number of essential cookies for security.

We use a managed authentication provider to handle sign-up, sign-in, password reset, and session tokens. Passwords are hashed — we never see your raw password.

Payment information may be shared with the payment provider you choose at the point of purchase. Untangle only receives limited transaction and entitlement information from that provider.

• Website purchases are processed by Stripe. Your card details go directly to Stripe and never touch our servers.
• Android app purchases are processed by Google Play Billing / Google Payments. Untangle never sees your card details.

For Android subscriptions, Untangle may receive and store limited purchase information needed to verify and manage subscriptions, including:

• Google Play subscription product ID
• Purchase token
• Order or transaction reference
• Subscription status
• Purchase and expiry dates
• Cancellation, grace-period and renewal status

This information is used to:

• Verify purchases
• Unlock paid features
• Prevent fraud
• Restore purchases
• Manage cancellations and expiry
• Provide customer support
• Maintain accounting and legal records

When you use a feature that involves AI reflection, the relevant text you submit is sent to a third-party AI model provider over an encrypted connection so the model can generate a response. We use providers that contractually commit not to use your inputs to train their public models.

We use privacy-respecting product analytics to understand which features people find helpful. We aim to use aggregated and pseudonymous data wherever possible.

Your data is stored with reputable cloud providers in managed, access-controlled databases. Traffic between your device and our servers is encrypted using HTTPS/TLS. Data at rest is encrypted using disk- or database-level encryption provided by our cloud infrastructure.

We share data only with vendors who help us run Untangle:

• Google Play Billing / Google Payments — Android subscription purchases and renewals.
• Google Play Developer API — server-side verification of Google Play subscription purchases and status.
• Google Cloud service-account authentication — used to authenticate our server when calling the Google Play Developer API for subscription verification.
• Stripe — website payments and billing.
• Supabase — authentication, database and backend functions.
• AI model provider(s) for reflection features.
• Analytics and error monitoring.

We may also disclose information if required by law, to protect users, or as part of a business transfer, in which case you will be notified.

We do not sell your personal data. We do not rent it. We do not share your journal content with advertisers.

You can, at any time:

• Access and review the data on your account.
• Export your journal entries and account data.
• Correct inaccurate information.
• Delete your account and the personal data tied to it, subject to limited retention required for legal and billing records.
• Object to or restrict certain processing, where you have that right under local law (UK GDPR, EU GDPR, CCPA/CPRA, etc.).

To exercise any of these rights, email privacy@untanglely.com.

We keep your data for as long as your account is active. When you delete your account, we remove your content from active systems within a reasonable period and from backups within our standard backup cycle. Subscription and transaction records (such as invoices and Google Play order references) may be retained where required for tax, accounting, fraud prevention, dispute resolution and legal compliance.

Deleting an Untangle account does not automatically cancel an external Google Play or Stripe subscription. You must cancel through the original payment provider. Before deleting your account, the app will warn you to cancel any active subscription first.

Untangle is not intended for children under 13, or under 16 in jurisdictions where the digital age of consent is higher.

We may process your data in countries other than where you live. Where required by law, we use appropriate safeguards (such as Standard Contractual Clauses) for cross-border transfers.

We will update this Privacy Policy from time to time. Material changes will be announced in-app or by email before taking effect.

Privacy questions or requests: privacy@untanglely.com.

Data controller: [Company Legal Entity Name], [Jurisdiction].