This Privacy Policy explains what personal information ebb collects, how we use it, and the choices you have. ebb is a private mental energy ledger designed to minimize the data we hold about you.
Our privacy principles
- No advertising. We do not sell your data, share it with data brokers, or use it for targeted advertising.
- No profiling. We do not use your entries to build advertising or behavioural profiles.
- No ML training. We do not use your content to train machine-learning models.
- Data minimization. We collect only what is necessary to run the service.
- Your control. You can export your data or permanently delete your account at any time.
Information we collect
Account information. When you sign up, we collect your email address and (if you use email/password sign-in) a hashed password managed by our authentication provider. If you sign in with Google, we receive your email address and a provider-issued user identifier — not your Google password.
Ledger content. The entries and presets you create — activity label, amount, direction (deposit/withdrawal), domain, life area, optional note, and timestamp.
Device and usage data. Standard log data (IP address, browser type, timestamps) collected by our hosting provider for security and reliability. We use Google Analytics 4 with IP anonymization enabled, Google Signals disabled, and ad personalization disabled. We send only categorical action metadata (e.g. "log_entry, direction=withdrawal, domain=intellectual") — never activity labels, notes, amounts, or user identifiers.
Local preferences. Your theme and time-format choices are stored in your browser's local storage and are not sent to us.
How we use information
- To provide and maintain the ledger, including sign-in, sync across your devices, and features like the recovery queue and saboteurs panel.
- To secure the service, prevent abuse, and diagnose problems.
- To understand aggregate, anonymised usage patterns so we can improve the product.
- To comply with legal obligations.
We do not process your personal information for any purpose materially different from these without your consent.
Legal bases (EEA/UK, where applicable)
Where the GDPR applies, we rely on: performance of a contract (to run the service you signed up for), our legitimate interests (in maintaining a secure, functional product and understanding aggregate usage), your consent (for optional analytics where required), and compliance with legal obligations.
Sensitive information
Some of your entries may reflect information about your mental state. We treat all ledger content with heightened care: it is stored under row-level security so that only you can read it, it is never shared with third parties for marketing, and it is never used to train models. You control what you log — please avoid recording clinical information you do not want stored.
Sharing
We do not sell your personal information. We share limited data only with service providers acting on our instructions and bound by confidentiality:
- Hosting and database (application hosting and authenticated Postgres storage).
- Authentication (email/password and Google sign-in).
- Analytics (Google Analytics 4 for anonymised, categorical usage metrics).
We may also disclose information if required by law, to enforce our Terms, or to protect the rights, safety, and property of ebb or others.
International transfers
ebb is operated from and its data may be processed in the United States and other countries. Where required, we rely on appropriate safeguards for cross-border transfers.
Retention
We retain your ledger content and account information for as long as your account is active. If you delete your account, we remove your entries, presets, and account record from our production systems promptly. Residual copies may persist in encrypted backups for up to 30 days before being overwritten in the ordinary course of backup rotation. Server logs are retained for up to 90 days for security and diagnostic purposes.
Security
Data is transmitted over TLS and stored in a database protected by row-level security policies that limit access to your own rows. Access to production systems is restricted and audited. No system is perfectly secure, and we cannot guarantee absolute security.
Your rights
Depending on where you live, you may have the right to access, correct, export, restrict, or delete your personal information, to object to certain processing, and to lodge a complaint with a supervisory authority.
Australia. The Australian Privacy Principles under the Privacy Act 1988 (Cth) apply. You may request access to or correction of your personal information, and you may complain to the Office of the Australian Information Commissioner (OAIC).
United States. If you are a resident of California, Colorado, Virginia, Connecticut, Utah, or another state with a comprehensive privacy law, you may have the right to know what personal information we hold, request deletion, request correction, opt out of "sale" or "sharing" (we do not sell or share for cross-context behavioural advertising), and be free from discrimination for exercising your rights.
You can exercise most rights directly in the app:
- Export — Settings → Your data → Export as JSON.
- Delete — Settings → Delete account.
For other requests, email hello@dailyebb.app.
Children
ebb is not directed to children under 16, and we do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, contact us and we will delete it.
Cookies and similar technologies
We use a small number of cookies and browser storage items strictly necessary for the app (session tokens) and for anonymised analytics. We do not use advertising or cross-site tracking cookies.
Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be reflected by an updated "Effective" date at the top of this page.
Contact
Questions or privacy requests? Email hello@dailyebb.app.