Privacy Policy
Updated September 10, 2026
Your notebook and your circle posts serve different purposes. Signing in lets your saved notebook records sync to your account. Posting in a circle deliberately shares that post with its members.
What the pilot handles
| Information | Why it is used |
|---|---|
| Email address and account ID | Create and find your account, send requested sign-in links and associate your records with you. |
| Sign-in links, session records and security limits | Check access, expire links and sessions, and limit abusive requests. Server credentials are stored as hashes where used for verification. |
| Saved journal entries, later notes, practice completions and browser exercise records | Keep your personal notebook and progress available across signed-in browsers. |
| Browser drafts, cached records and unsynced changes | Keep work on your device and support account syncing. Current browser drafts remain local to that device and account. |
| Circle display name, membership, posts, replies and practice dates | Let you participate in the invitation-only circle you join. |
| Connection details, request timing and transfer counts | Deliver the website and apply security and usage limits. Hosting and email providers may keep their own operational records. |
Who can see what
Your account notebook is not a public feed and is not automatically shared with circle members. Circle posts and replies are visible to other members of that circle. A linked account connects your sign-in identity with your circle membership.
Authorized service operators and infrastructure providers may be able to access stored data to operate, maintain or recover the service. Expand is not end-to-end encrypted: private account access does not mean only you hold the decryption keys.
The current application does not contain an advertising-data sale feature, advertising trackers or product-analytics scripts. It does not send notebook entries to an AI model or automatically publish them as research data.
Service providers and security
Fly.io hosts the application and its SQLite data on encrypted storage. Website connections use HTTPS. Backups can contain account records, notes and shared content and must be handled as private operational data. Encryption does not eliminate the possibility of unauthorized access or loss.
Resend delivers the transactional sign-in email you request. It receives the delivery address and email contents, including the sign-in link, and processes delivery information. Your journal is not included in these emails. Provider processing follows their own service arrangements: Fly.io security information and Resend security information.
Optional payments
If you choose to support Expand, you leave this site for a Stripe-hosted checkout. Stripe processes your payment details, contact information and transaction data. Expand operators can see payment records in Stripe for reconciliation and payment support; the app does not receive your full card number. Your notebook and practice records are not sent with the support link, and payment does not change your app access or results. See Stripe’s Privacy Policy.
Storage and retention
Browser account caches and drafts remain until changed or removed from that browser. Signing out does not erase that local cache. The current sign-in link lasts 15 minutes and server sessions expire after 30 days unless ended earlier; browser session storage has a separate lifetime.
The pilot has no finalized automatic account, notebook or circle-content deletion schedule. Operator backups may outlast a change in the live database. The complete retention periods and a working deletion-request route must be finalized before this becomes a completed policy.
Your choices
You can choose what to write and what to post, export your account notebook through Your data, and sign out. Clearing this site’s browser data removes local copies and drafts; it does not delete synced server records. Export unsynced work before clearing anything.
Earlier notes saved without an account are not automatically imported. You choose whether to copy them into the signed-in account. The Mac companion’s notebook is separate from the web account notebook.
Do not assume that sharing an entry in a circle or exporting a file can be undone for everyone who already received a copy. Account deletion, access/correction requests, applicable rights, operator identity and a verified contact route remain to be specified. No unsupported contact address or promised response deadline is supplied in this draft.
Scope of this draft
This notice describes the current pilot rather than a claim of compliance with every privacy law. Applicable legal bases, geographic scope, transfer arrangements and age-related requirements need review once the responsible operator and intended users are confirmed. The Cookie Policy draft explains browser storage in more detail.