Privacy Policy

1. Who we are

Clicked Emotions is operated by Coding Monks OÜ, a company registered in Estonia. References to “we”, “us”, or “our” refer to Coding Monks OÜ.

For privacy questions: privacy@clickedemotions.com

2. What we collect

We collect only what is necessary to provide the service:

• Account information — your email address and authentication credentials. If you sign in with a third-party identity provider, we receive only your name and email from that provider.
• Journal pages — your page text, titles, and photos, and the emotion labels and reflection saved with each page. These are encrypted on your device before they are saved, and we cannot read them.
• Analysis notes and chats — short notes from AI analysis (main emotion, intensity, triggers, people you name, behaviours, and life areas), your pattern map and profile, period insights, follow-up questions, and chat messages. These are stored in readable form on our servers so we can show your patterns and provide chat. Access to them is restricted, but they are not encrypted with your key.
• Metadata — entry dates, word counts, and creation timestamps. This is stored unencrypted solely to display your journal timeline without requiring decryption.
• Usage data — standard server logs (IP address, browser type, pages visited) retained for up to 30 days for security purposes only.
• Product analytics — anonymised feature usage events (e.g. which features are used, not what you write) to help us understand and improve the product.

3. How we use your data

We use your data solely to provide, maintain, and improve the service you have signed up for. We do not sell your data, use it for advertising, or share it with any party beyond what is described in this policy.

The table below sets out the lawful basis under GDPR for each type of processing:

4. Analytics and product monitoring

We use limited product analytics tools to understand how the app is used — for example, which features are used and where users encounter problems. These tools collect anonymised event data and do not receive the content of your journal entries.

We do not use advertising networks, behavioural tracking, or cross-site tracking of any kind. We do not build advertising profiles or sell usage data.

We also use error monitoring tools to detect and fix crashes and reliability issues. These tools receive technical diagnostic information (e.g. error messages, device type) and do not receive journal content.

5. No sharing of emotional data

We do not share your journal entries, AI-generated insights, emotion tags, or any other personal content with therapists, employers, family members, schools, insurers, healthcare providers, law enforcement, or any other third party — unless you explicitly choose to use a sharing feature, or unless we are compelled by a valid legal order. Our AI provider processes content only as described in Section 6.

If we ever receive a compelled legal request for data, we will notify you to the extent permitted by law. Because your pages are encrypted and we cannot read them, we are unable to produce readable pages in response to any such request. The analysis notes and chats described in Section 2 could be produced if we are legally required to do so.

6. AI processing

Some features of Clicked Emotions use artificial intelligence to process your content — for example, to transcribe handwritten photos or analyse emotional patterns in your writing. To provide these features, your content is temporarily sent to our AI provider, Google Cloud (Vertex AI).

During AI processing, your content is in readable form for the duration of the request. We do not keep the text of your page after the response is returned. Our AI provider handles content under its own terms, which may allow it to keep content for a limited time, for example for safety and abuse checks. Google does not use this content to train its models.

Your page is encrypted on your device before it is saved. The short notes from AI analysis are kept as described in Section 2.

7. Encryption and key management

Your journal pages are encrypted on your device using industry-standard algorithms. Your encryption keys are derived from your password and are never transmitted to or stored by us in a readable form.

A recovery key is generated when you create your account. If you lose your password and your recovery key, your encrypted data cannot be recovered by anyone, including us. This is by design.

8. Sensitive data

Emotional and mood data may constitute sensitive health-related personal data under GDPR Article 9. We treat all journal content as sensitive regardless of legal classification. Our encryption means your stored pages are never accessible to us in readable form. The analysis notes and chats described in Section 2 are readable by our systems, and access to them is restricted.

By creating an account and using AI features, you explicitly consent to the processing of this data as described in this policy. You may withdraw consent at any time by deleting your account.

9. Third-party service providers

To operate the service, we use third-party providers in the following categories:

• Authentication and database — stores your encrypted pages, analysis notes, and chats, and manages account authentication.
• Hosting and infrastructure — serves the application and handles network requests.
• Payment processing — handles subscription billing. We never receive or store your card details directly.
• AI processing — temporarily processes content to enable transcription and emotional analysis (see Section 6).
• Product analytics — receives anonymised usage events to help us understand feature usage. Does not receive journal content.
• Error monitoring — receives technical diagnostic data to help us detect and fix reliability issues. Does not receive journal content.

We do not use advertising networks, social media trackers, or data brokers.

For a full list of sub-processors, contact us at privacy@clickedemotions.com.

10. Data retention and deletion

Your data is retained for as long as your account exists. When you delete your account from Settings, we permanently delete all your pages, analysis notes, chats, encryption keys, photos, and account information. Deletion is immediate. Backups are purged within 30 days.

11. Your rights

Depending on your location, you may have the right to access, correct, export, restrict processing of, or delete your personal data. To exercise any of these rights, contact us at privacy@clickedemotions.com.

Because your pages are encrypted with your key, we cannot provide readable exports of them on your behalf — but you can export them directly from the app while your vault is unlocked.

If you are in the European Economic Area, you have the right to lodge a complaint with your local data protection supervisory authority.

12. Children

Clicked Emotions is not directed at children under 16. We do not knowingly collect data from anyone under 16. Contact privacy@clickedemotions.com if you believe a child has created an account.

13. Changes to this policy

If we make material changes, we will notify you by email or in-app notice at least 14 days before changes take effect. Continued use after that date constitutes acceptance.