Privacy

Privacy Policy

Clarity Box™ exists to hold private thoughts. This policy explains exactly what we collect, why we collect it, who can see it, how long we keep it and how to remove it. Plain language, no hidden practices.

Last updated: January 2026

1. Who is responsible for your data

The owner and operator of Clarity Box™ is the data controller for the personal information described here. You can reach us through the support page inside the app or the feedback form for any privacy request.

2. What we collect

Account details: your email address, sign in identifiers, and any name you choose to give us. Profile details you volunteer during onboarding: how you identify, faith or belief background, the reasons you are here, and your intention. Reflection content: everything you write in the guided journal, your two boxes, letters, stars, reports, Reflection Coach conversations and, where you use voice journaling, the audio you record and its transcript. Consent records: the date you accepted the Terms and the Privacy Policy and whether you opted into community updates. Billing records: plan, status, renewal dates and payment provider identifiers, never full card numbers. Technical data: visitor and session identifiers, page paths, feature and sign-in events, referrer, browser and device information, language, time zone, and approximate country, region or city. This activity data helps us understand use, keep the Service secure and improve it; it does not include the words you write in reflections.

3. Why we use it, and the lawful bases

To provide the Service and your account, which is performance of our contract with you. To store and display your reflections and generate reports, also contractual. To process sensitive categories such as faith or health related reflections, only on the basis of your explicit consent given at onboarding, which you may withdraw at any time. To keep the Service secure, prevent abuse and fix errors, which is our legitimate interest. To send community updates, only where you opted in, on the basis of consent. To meet tax, accounting and legal obligations, which is legal obligation.

4. Special category and sensitive information

Reflections often touch on health, relationships, beliefs and other sensitive matters. We treat that content as confidential, restrict internal access, and never use it for advertising or profiling. You are free to write pseudonymously and to omit identifying details about yourself or anyone else.

5. Artificial intelligence processing

When you use AI powered features, the relevant text or transcript is sent to our AI provider so a response can be generated. That processing happens under a contract that prohibits using your content to train the provider's models. AI features are optional: the framework, the journal and your boxes all work without them. Outputs are generated automatically and should not be relied on as professional advice.

6. Who else processes your data

We use a small number of vetted providers acting on our instructions: cloud hosting and database services for storage and authentication, an AI gateway for the features above, a payment provider that acts as merchant of record for subscriptions, and email delivery for account and support messages. We do not sell your personal information, and we do not share it with advertisers or data brokers. We may disclose information where legally required, or where necessary to protect someone's safety or our legal rights.

7. International transfers

Our providers may process data outside your country, including in the United Kingdom, European Economic Area and United States. Where data leaves the UK or EEA it is protected by appropriate safeguards such as standard contractual clauses or an adequacy decision.

8. Other people mentioned in your reflections

You may write about other people. Please share only what you genuinely need for your own reflection. Shared features such as the Two Box Mirror never reveal another person's private text: they show structural comparisons only, and only after both people explicitly approve.

9. How long we keep it

Reflection content is kept until you delete it or delete your account. Account records are kept while your account exists. Billing and tax records are kept for as long as applicable law requires, typically six to seven years. Backups containing deleted data are overwritten on a rolling cycle, normally within thirty days. Support and feedback messages are kept for up to two years unless you ask us to remove them sooner. Site activity records are retained for operational analytics and security, then deleted or anonymised under our retention practices. You may contact us to request deletion of activity records linked to your account.

10. Security

Data is encrypted in transit and at rest by our infrastructure providers. Access is restricted by row level security rules so your rows are readable only by your account. Administrative access is limited, logged and used only for maintenance, security or a request you have made. No system is perfectly secure, and we will notify you and the relevant regulator where required if a breach affecting your data occurs.

11. Cookies and local storage

We use a session cookie or token so you stay signed in. Local storage holds preferences, drafts and a random visitor identifier; session storage holds a random identifier for the current browser tab. These identifiers support first-party usage analytics and are not the words you write in reflections. We do not run advertising cookies or cross-site tracking pixels.

12. Your rights

Subject to local law you may: access a copy of your data, correct it, delete it, restrict or object to certain processing, withdraw consent at any time, and receive your data in a portable format. The Privacy Centre lets you export the listed account and reflection categories and delete individual categories. Manage Account lets you request permanent deletion of the account and its sign-in identity. Contact us for a broader access or deletion request, including activity data linked to your account. We respond to written requests within one month.

13. Complaints

If you are unhappy with how we handle your data, contact us first through the support page. You also have the right to complain to your data protection authority, such as the Information Commissioner's Office in the United Kingdom or your national supervisory authority in the European Economic Area.

14. Children

The Service is not intended for anyone under 16, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will delete it.

15. Changes to this policy

We will update this page when our practices change and revise the date at the foot of the page. Significant changes will be highlighted in the app, and where the change relies on your consent we will ask for it again.