Privacy Policy — Supalog

1. What we collect

Supalog collects only what we need to give you a useful sidekick:

Account information: Email address, name, legal name, country preferences, and device timezone.
Voice recordings: Audio you record inside the app for journaling (see Voice data).
Journal entries: Transcribed text and AI-extracted entities — tasks, people, activities, emotions — derived from your recordings.
Financial data: Transaction information parsed from bank alert emails you forward to your Supalog inbox (see Financial data).
Ask history: Your questions, Supalog's answers, searches of your account data, public-web search queries, and the citations returned with an answer.
Device and notification data: An app-scoped analytics identifier, device platform, and Expo push token when you enable push notifications.
Usage and diagnostic data: Feature interactions, subscription state, and backend crash or performance reports used to operate and improve Supalog.

We use your data to:

Transcribe voice recordings into text journal entries.
Extract tasks, activities, people, and emotions from your entries using AI.
Parse and categorize financial transactions from forwarded bank alerts.
Surface patterns, correlations, and insights over time.
Operate and improve app functionality and fix bugs.
Deliver requested push notifications and keep them scheduled in your timezone.
Publish an idea only when you turn on sharing. Shared ideas are unlisted and reachable through the direct link you choose to send.

We do not use your data to:

Your voice recordings get the strictest handling:

Processing: Audio is sent to our transcription provider (AssemblyAI) for speech-to-text.
Retention: Audio recordings and transcribed journal entries are saved to your account so you can replay and revisit them until you delete them or delete your account.
No training: Your audio is never used to train speech recognition or any other model.
Access: Only your account can access your recordings and journal entries. Our team doesn't read your transcriptions unless you explicitly ask for support help.

Supalog's spending tracker works by parsing the bank-alert emails you forward to a personal Supalog inbox address. Concretely:

No bank login: We never ask for, receive, or store your banking credentials, passwords, or PINs.
No account access: We have zero access to your bank account, balance, or transaction history beyond what you explicitly forward.
Email parsing only: Forwarded emails are read by automated classifiers and language models, which extract transaction details (amount, merchant, date).
Encryption: All financial data is encrypted at rest using AES-256.
Not financial advice: Supalog provides informational spending summaries. We are not a financial advisor and we don't make recommendations.

Supalog uses AI to extract meaning from your journal entries:

What it does: Identifies tasks, people, activities, emotions, and spending mentioned in your entries. Surfaces correlations and patterns over time.
How: Your transcribed text is processed by large language models (Anthropic Claude, OpenAI) to extract structured data.
No training: Your data is processed under zero-retention API agreements. Your entries are never used to train or fine-tune any model.
Accuracy: AI-extracted information may contain inaccuracies. You can edit, correct, or delete any extracted item.

The vendors we use to operate Supalog:

AssemblyAI: Speech-to-text transcription. SOC 2 Type II certified. Audio is sent there for processing; Supalog stores your copy in your account.
Anthropic (Claude) & OpenAI: AI text processing. Zero-retention API usage — no storage, no training.
TypeSafe: Classifying forwarded emails and matching account data to the right category.
Cloudflare: CDN, DNS, and R2 object storage for account audio and media files.
Apple Push Notification Service: Delivers app notifications.
RevenueCat: Manages subscriptions and entitlements using your Supalog account id and App Store purchase history.
PostHog: Product analytics tied to your Supalog account id and email. IP-based GeoIP enrichment is disabled. We do not use PostHog for advertising or cross-app tracking.
Brave Search: Receives public-web queries that Ask or an automated classifier needs to answer. Search results and citations may be saved with the relevant Ask conversation.
Sentry: Receives backend crash and performance diagnostics, including request and account context when available, so we can diagnose failures.

We do not use any of these providers for advertising, and we do not track you across other companies' apps or websites.

Audio and journal entries: Retained until you delete individual entries or delete your account.
Financial data: Retained until you delete individual transactions or delete your account.
Ask history and citations: Retained with your conversation until you delete the conversation or your account.
Push devices: Retained while registered to your account and removed when the account is deleted.
Account deletion: Requested in Settings → Danger Zone → Delete account. We use a five-minute processing window so an accidental request can be cancelled by signing back in. After that window, account database rows and user-owned stored files are permanently removed.

Wherever you live, you have the right to:

Access: View all data we hold about you within the app.
Export: Download all your journal entries, extracted data, and spending history in standard formats (JSON, CSV).
Delete: Delete individual entries, transactions, conversations, or your entire account and all associated data.
Correct: Edit any AI-extracted information that is inaccurate.
Withdraw: Stop using the service at any time. Revoking your bank forward rule stops new transactions from being parsed.

For privacy questions, data requests, or concerns:

For general support: supalog.app/support