Privacy Policy

We collect the following types of information:

• Account information: Name, email address, and authentication provider (Google, Apple, or email)
• Content you create: Journal entries, replies, photos, comments, and questions you submit
• Usage and analytics data: How you interact with the Service, including pages visited, features used, referral and campaign information, and standard browser and device information, IP addresses, and approximate location derived from IP addresses
• Email activity: Delivery status, opens, and clicks for emails we send you

We use your information to:

• Provide, maintain, and improve the Service
• Compile and deliver journal newsletters to your group members
• Send you service-related emails (reminders, notifications)
• Respond to your questions and support requests
• Detect and prevent fraud or abuse
• Measure campaign performance and onboarding conversion, diagnose problems, and improve the Service

Your journal content is shared with other members of the same journal group — this is the core function of the Service. We do not sell your personal information.

We may share information with:

• Service providers: Third-party services that help us operate, such as authentication, email delivery, and cloud hosting
• Analytics providers: PostHog helps us understand product usage and onboarding conversion. Google Analytics 4 (GA4) helps us measure traffic and pageviews. We use these services for the limited purposes of operating, diagnosing, measuring, and improving Together.
• Legal requirements: When required by law or to protect our rights

Together's primary application data, such as account records and journal content, is stored on infrastructure managed by Google Cloud Platform. Analytics data described below is processed and stored separately by PostHog and Google. We use security measures designed to protect your information, including encryption in transit and at rest. However, no method of transmission over the Internet is 100% secure.

Together and our analytics providers use cookies, local storage, and similar browser storage to keep you signed in, maintain an analytics identity and session, and remember first-touch campaign and batch attribution.

PostHog records product activity before and after signup. Before you sign in, that activity is associated with an anonymous browser identifier. When you sign in, we may connect earlier activity from the same browser to your internal Together account identifier (our Postgres user ID). For identified product analytics, PostHog may also receive limited account information that is available, such as your name, email address, signup method, how you discovered Together, and account creation date. We also attach the first campaign and campaign batch that brought the browser to Together so we can measure onboarding and conversion.

We also keep a limited campaign record with your account when it is created, including the signup method and campaign and batch labels observed in the browser or carried through email signup. The record preserves the first and current campaign observations available at signup; these can reflect shared browser history and are not proof of an advertising click or your first-ever contact with Together. Later sign-ins do not rewrite this account-creation record. We use it to measure signup conversion and may include it in PostHog signup events.

PostHog collects IP addresses and can use them to derive approximate location for analytics and diagnostics. We distinguish designated test accounts and test browser sessions in analytics so we can separate QA activity from business reports while keeping the underlying events.

GA4 and its Enhanced Measurement features measure website use, including pageviews, scrolling, outbound link clicks, and similar interactions. GA4 may receive the page path, page URL, page title, campaign parameters, and standard browser or device information. As of July 29, 2026, Google Signals and user-provided data collection are disabled, the GA4 property has no Google Ads links, and its regional settings allow ads personalization. Together does not intentionally send GA4 your Together account ID, email, name, or product-lifecycle conversion events such as signup completion or journal creation.

Together does not display third-party advertisements and does not sell your personal information.

You have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your account and associated data
• Unsubscribe from email communications at any time
• Export your data in a portable format

To exercise these rights, contact us at hello@journaltogether.app.

The Service is not intended for children under 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected information from a child under 13, we will take steps to delete it.

We retain your account data for as long as your account is active. Journal content is retained as long as the journal exists. We retain product analytics, including analytics associated with an identified account and campaign attribution, only as needed to operate, protect, measure, and improve the Service, subject to our provider settings.

We retain the limited account-creation campaign record with your account, subject to verified requests. Temporary email-signup context expires after 30 minutes. Consumed or expired context is scheduled for physical removal within 24 hours in normal operation. Service or database outages can delay removal; cleanup resumes when service is restored. Copies in backups or logs may remain subject to backup and log retention, rather than this temporary-context removal schedule.

As last verified on July 29, 2026, our GA4 property settings retain event data for 2 months and user data for 14 months, with the user-data period resetting when new activity is recorded. PostHog analytics retention follows our PostHog project and provider settings.

To request account deletion, contact us using the address below. We process verified deletion requests across systems we control, including identified PostHog analytics associated with the account. We may retain or de-identify limited information when required by law or reasonably necessary for security, fraud prevention, dispute resolution, and backup or log integrity.

PostHog, Google, and other service providers may process or store your information in the United States and other countries. Data protection laws in those countries may differ from the laws where you live. You may contact us using the address below for more information.

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Service. The date at the top of this page indicates when this policy was last revised.

If you have questions about this Privacy Policy, please contact us at hello@journaltogether.app.