Privacy Policy — Supalog

1. What we collect

Supalog collects only what we need to give you a useful sidekick:

Account information: Email address and basic profile data you provide during sign-up.
Voice recordings: Audio you record inside the app for journaling (see Voice data).
Journal entries: Transcribed text and AI-extracted entities — tasks, people, activities, emotions — derived from your recordings.
Financial data: Transaction information parsed from bank alert emails you forward to your Supalog inbox (see Financial data).
Usage data: Aggregate interaction patterns (features used, session duration) to improve the product. Never tied to your content.

We use your data to:

We do not use your data to:

Your voice recordings get the strictest handling:

Processing: Audio is sent to our transcription provider (AssemblyAI) for speech-to-text.
Retention: Audio recordings and transcribed journal entries are saved to your account so you can replay and revisit them until you delete them or delete your account.
No training: Your audio is never used to train speech recognition or any other model.
Access: Only your account can access your recordings and journal entries. Our team doesn't read your transcriptions unless you explicitly ask for support help.

Supalog's spending tracker works by parsing the bank-alert emails you forward to a personal Supalog inbox address. Concretely:

No bank login: We never ask for, receive, or store your banking credentials, passwords, or PINs.
No account access: We have zero access to your bank account, balance, or transaction history beyond what you explicitly forward.
Email parsing only: We extract transaction details (amount, merchant, date) from the forwarded alert emails.
Encryption: All financial data is encrypted at rest using AES-256.
Not financial advice: Supalog provides informational spending summaries. We are not a financial advisor and we don't make recommendations.

Supalog uses AI to extract meaning from your journal entries:

What it does: Identifies tasks, people, activities, emotions, and spending mentioned in your entries. Surfaces correlations and patterns over time.
How: Your transcribed text is processed by large language models (Anthropic Claude, OpenAI) to extract structured data.
No training: Your data is processed under zero-retention API agreements. Your entries are never used to train or fine-tune any model.
Accuracy: AI-extracted information may contain inaccuracies. You can edit, correct, or delete any extracted item.

The vendors we use to operate Supalog:

AssemblyAI: Speech-to-text transcription. SOC 2 Type II certified. Audio is sent there for processing; Supalog stores your copy in your account.
Anthropic (Claude) & OpenAI: AI text processing. Zero-retention API usage — no storage, no training.
Cloudflare: CDN, DNS, and R2 object storage for account audio and media files.
Apple Push Notification Service: Delivers app notifications.
RevenueCat: Manages subscriptions and entitlements. Receives only your anonymized purchase identifier.

Audio and journal entries: Retained until you delete individual entries or delete your account.
Financial data: Retained until you delete individual transactions or delete your account.
Account data: Retained while your account is active. Permanently deleted within 30 days of an account-deletion request.

Wherever you live, you have the right to:

Access: View all data we hold about you within the app.
Export: Download all your journal entries, extracted data, and spending history in standard formats (JSON, CSV).
Delete: Delete individual entries, transactions, or your entire account and all associated data.
Correct: Edit any AI-extracted information that is inaccurate.
Withdraw: Stop using the service at any time. Revoking your bank forward rule stops new transactions from being parsed.

For privacy questions, data requests, or concerns:

For general support: supalog.app/support