Privacy Policy

Who is responsible

The Hero Journal is operated by Daniel Brandão Lopes, who is responsible for your data under this policy. On Google Play, the app is published by Vin 7 Tecnologia e Negócios. For privacy questions, requests or complaints, write to hello@theherojournal.com.

What we collect

• Account. Your email address and a unique user ID. You can sign up with an email and password, with Sign in with Apple or with Sign in with Google. If you use a password, our authentication provider stores only a one-way hash of it, so nobody can read it. If you sign in with Apple or Google, we never receive your password for those services. Apple sends us your email address (or a private relay address, if you choose Hide My Email) and, the first time, your name. Google sends us your email address, your name and a link to your Google profile photo.
• Profile. Your name and, if you enter it, your date of birth. We keep the date of birth in your profile and only use it to show your age on the onboarding screen. You can also add a profile photo, taken with the camera or chosen from your photo library. The app only opens the camera or the library when you choose to add a photo.
• Your journal. Your tasks and entries: name, realm, date and time, counts, quantities, scores from 0 to 100 and notes. Also your main goal and its target date, and the score, streak and level calculated from your entries.
• Friends and nudges. The names and email addresses you add, your sharing level and the nudges you send and receive. See "Friends and what they can see".
• Contacts in entries. Some entry types let you record details about another person: first name, last name, email, phone and notes. See "Information about other people".
• Reminders. If you turn reminders on, we store that they are on, your morning and evening times, your time zone and the channels you chose (email or push).
• Notifications on your device. The mobile app only asks for notification permission when you turn reminders on. If you allow it, we store the device token issued by Apple, the language of the app and when the token was registered. The language is stored with the token so that notifications arrive in your language.
• Waitlist. If you sign up on the website form, we store your email address, the name if you give one, the page where you signed up and the date.
• Technical data. To deliver pages and keep the service secure, our servers and providers process your IP address, browser or device details, request times, the addresses requested and error messages. These logs can include an email address or a user ID.
• Stored on your device. Your login session, your language, whether you finished onboarding, a pending invite and a copy of the device token. This is needed for the app to work and is not used for advertising.

We do not collect your precise location, your phone's contact list, health data from your device or advertising identifiers, and we do not track you across other companies' apps and websites.

How we use it

• To sign you in, save your journal and sync it across your devices.
• To calculate your score, streak, level, progress charts and mission report.
• To send the reminders you turned on, by email or push.
• To show your friends' leaderboard and deliver nudges, according to the sharing level each person chose.
• To send account and waitlist emails.
• To keep the service secure, prevent abuse and fix errors.
• To understand how people use the website.
• To comply with legal obligations.

We do not sell personal data, we do not share it with data brokers and we do not use your journal for advertising.

AI and your journal

This version of The Hero Journal does not send your journal data to AI providers. Reminder messages are not written by AI either.

An AI coach is in development. Before it is released, we will update this policy and ask for your permission in the app.

Friends and what they can see

• To add a friend, you type a name and an email address. We store them in your list together with that person's score.
• If that email address belongs to an account, we also add you to that person's list, with your name, email address and score.
• You can share an invite link, which contains your user ID. When someone signs up through it, you are added to each other's lists.
• In your profile, under "What friends can see", you choose a sharing level. Private: friends see your name and score rank. Score + Streak: friends see your score and current streak. This is the default. Full Sharing: friends also see how many tasks you have today and how many you completed.
• Any signed-in user who types your email address on the add friend screen can see your name and current score, whatever your sharing level.
• When you send a nudge, we store your name, email address, the emoji and the time on the other person's account. We keep the latest 50 notifications per account. The nudge also goes out as a push notification, which shows your name, or by email if no device received it.

Information about other people

Friends' names and email addresses, and the contact details you can record in some entries, are information about other people. Only enter it if you are allowed to, and only what you need. You are responsible for that content. We store it as part of your journal and delete it when you delete the entry or your account. Anyone who wants their information removed can write to hello@theherojournal.com.

Who receives your data

We use a small number of providers, each with a specific job:

• Supabase: authentication, database, file storage and server functions. Your account, journal and profile photo are stored there.
• Twilio SendGrid: delivers our emails, so it receives your email address and the content of the message, which can include your name, your task list or the name of a friend who sent a nudge.
• Apple: Sign in with Apple, and Apple Push Notification service, which receives the device token and the text of each notification.
• Google: Sign in with Google and Google Analytics. When the Android app sends notifications, they go through Firebase Cloud Messaging, which receives the device token and the text of each notification.
• Ahrefs: website analytics.
• Our website host: delivers the website, so it handles request data such as IP addresses.

Each provider only receives what it needs to do its job, and must protect that data at a level at least equal to this policy.

We also disclose data if the law requires it, to protect rights or someone's safety, or to a buyer if the product is ever sold or merged. In that case, this policy continues to apply to your data.

Analytics and cookies

The website and the web app use Google Analytics and Ahrefs Web Analytics to count page views and understand how people find us. Google Analytics sets the cookies _ga and _ga_<id>, which can last up to 2 years, and receives your IP address, approximate location, device and browser details and the pages you visit. Ahrefs says it does not use cookies and does not store IP addresses with analytics data.

These tools do not receive your journal. The mobile apps do not load them. You can block or delete cookies in your browser settings.

Why we are allowed to use your data

• To provide the service you asked for: account, journal, friends and reminders.
• Your consent: notifications, camera and photo access, and optional information such as your date of birth. You can withdraw it at any time.
• Legitimate interests: security, fixing errors and understanding how the website is used.
• Legal obligations: when the law requires us to keep or disclose data.

How long we keep it

• Your account and journal: for as long as your account exists. We do not delete inactive accounts automatically.
• Entries and friends you remove: deleted from our database when you remove them.
• Notifications: we keep the latest 50 per account.
• Device tokens: up to 10 per account. A token is removed when you sign out, when Apple reports that it stopped working, or when you delete your account.
• Waitlist: until you ask us to remove it, or until you delete an account with the same email address.
• Technical logs and database backups: they expire on our providers' own schedule. Backups last at most 30 days.

How to delete your data

You can delete your account and your data at any time, in the app or on the website: open your profile and choose Delete my account. It takes effect immediately and cannot be undone. You can also ask by email, without installing anything. See how to delete your account for the steps and for what is deleted and what may remain.

Security

Traffic between the app and our servers uses HTTPS, and our database provider encrypts data at rest. Requests for personal data must be authenticated, and your journal is stored under your user ID, so one account cannot read the entries of another. Profile photos are in a private storage bucket and are only reachable through signed links that expire. No system is perfectly secure. If a breach affects your data, we will notify you and the relevant authorities as the law requires.

Where your data is processed

Our providers process data in the United States and other countries, so your information may be transferred outside the country where you live. Where the law requires a safeguard for these transfers, we rely on the ones our providers offer, such as standard contractual clauses.

Your rights

Depending on where you live, including under the Brazilian LGPD, the European GDPR and the California CCPA, you can ask us to confirm what we hold about you, give you a copy, correct it, delete it, restrict or object to certain uses, and withdraw any consent you gave. You can also complain to your data protection authority. In Brazil, that is the ANPD.

To exercise these rights, write to hello@theherojournal.com. We reply within 30 days, or sooner if the law where you live requires it. We will not charge you or treat you differently for asking.

We do not sell your personal information and we do not share it for cross-context behavioral advertising.

Children

The Hero Journal is not directed to children under 13, and we do not knowingly collect their data. If you believe a child gave us personal information, write to hello@theherojournal.com and we will delete the account.

Changes to this policy

If we change how we handle your data, we will update this page and its date. For important changes, we will also let you know in the app or by email before they take effect.

Contact

Questions, requests or complaints: hello@theherojournal.com. See also the Terms of Use and the Support page.