Privacy Policy

We collect the following categories of personal data:

Account information

Email address, name, and authentication credentials (hashed passwords or Google OAuth tokens).

Journal entries

Text content, mood scores, sleep scores, and any structured data you provide.

Habits and goals

Habit definitions, tracking logs, goal descriptions, milestones, and progress data.

Voice messages

On paid plans, audio sent via Telegram or the web app is transcribed to text, and we retain the original recording by default so you can replay it — you can turn this off in Settings → Data, after which audio is discarded once transcribed. Voice transcription is not included on the free plan: a free-plan voice note is neither transcribed nor stored. Any retained recording is stored server-side and served only through an authenticated proxy that requires a login.

Images

Photos attached to entries are stored server-side and served through an authenticated proxy, so no other user can see them. Some features also send a photo to our AI providers so they can look at it (see Section 4).

Location data

If you enable weather features, we use your configured location (city or coordinates) to fetch weather data. We do not track your real-time location.

Calendar events (optional)

If you connect Google Calendar, we read the upcoming events on your primary calendar that you organise or attend (title, description, time) and turn them into tasks. See Section 6.

Push notification subscription (optional)

If you turn on push notifications, your browser gives us a subscription address and encryption keys so we can send notifications to that device. See Section 6.

Reports and feedback

If you send us a bug report, an idea, or a help request, we keep what you wrote together with your email address, plan, the page you were on, and the app version. Bug reports and ideas are also copied, with your email address, to our private issue tracker on GitHub so we can work on them (see Section 11).

Usage data

Timestamps of actions, feature usage patterns, and error logs necessary for service operation.

Under GDPR Article 6, we process your personal data on the following legal bases:

Contract performance (Art. 6(1)(b))

Processing necessary to provide the kagame service you signed up for — storing entries, running AI classification, managing your account, and processing payments.

Legitimate interest (Art. 6(1)(f))

Service improvement, bug fixing, security monitoring, and fraud prevention — including keeping a one-way fingerprint of an email address that has already used a free trial, so the trial cannot be claimed again by deleting and re-creating an account (see Section 10). We balance these interests against your rights and only process the minimum data necessary.

Consent (Art. 6(1)(a))

Optional features that require explicit opt-in: email reviews, weather/location features, Telegram bot integration, Google Calendar sync, and push notifications. You may withdraw consent at any time (see Section 9).

Legal obligation (Art. 6(1)(c))

Where required by applicable law, such as responding to lawful government requests or maintaining financial records.

• To provide and maintain the kagame service.
• To classify journal entries and generate AI coaching insights using AI services (see Section 4).
• To process subscription payments.
• To send transactional emails (account verification, password resets, subscription updates).
• To improve the service and fix bugs.
• To keep the operator informed. When an account is created, a report is sent, a Year Book print is requested, or a subscription changes, a short notification goes to the operator’s private Telegram chat. Notifications about a new account, a report, or a print request include your email address (and a report’s title); billing notifications carry only an internal account ID.

We do not use your content to train AI models. kagame uses third-party AI service providers to power features including entry classification, coaching, search, voice transcription, and image generation. When you create an entry or interact with the AI assistant, the relevant content is sent to these providers only to produce a result for you.

AI requests go through an AI gateway we operate ourselves, which forwards each one to the model provider the operator has selected for that feature, using paid business APIs. Depending on the model selected, that is OpenAI, Anthropic, Google (Gemini models), or OpenRouter — a routing service that passes the request on to the model’s developer, such as OpenAI, Anthropic, Google, DeepSeek, or Z.ai (GLM models). Our OpenRouter requests are set to deny the model provider permission to collect or keep the data. Search embeddings and voice transcription currently use OpenAI.

Photos are sent too when a feature needs to look at them: classifying and describing a photo you attach to an entry or send to the assistant, reading a journal page you photograph, suggesting goals from a picture, and matching the look of your Timeline images when you print them. If you use image generation, the image description and any photos you choose to include are sent to fal.ai. Section 11 lists every provider.

You can disable all AI processing for your account at any time in Settings → Data. When disabled, kagame runs in capture-only mode and no content is sent to external AI services.

Subscription payments are processed by Stripe. We do not store your credit card number, CVC, or billing address on our servers — Stripe handles card data in compliance with PCI DSS. We keep your subscription status and the Stripe customer and subscription identifiers needed to manage it.

Each of these is off until you turn it on, and you can turn it off again at any time in Settings.

Telegram

If you connect a Telegram bot, messages you send to the bot are forwarded to kagame via a secure webhook. Message content is processed identically to entries created through the web app. We store the resulting entry data—the original Telegram message is not stored separately.

Google Calendar

If you connect Google Calendar, we request read-only access to your calendars (the calendar.readonly scope) plus your Google email address, so we can show which account is connected. We read the upcoming events on your primary calendar that you organise or attend and create a matching task for each (title, description, and time). We never create, change, or delete anything in your Google Calendar. The access tokens Google gives us are stored encrypted. When you disconnect Google Calendar or delete your account, we revoke our access with Google and delete the tokens. kagame’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: calendar data is used only to provide this feature to you, is never sold, never used for advertising, and never used to train AI models.

Push notifications

If you allow push notifications, your browser gives us a subscription address and encryption keys for that device, which we store until you turn notifications off, the subscription expires, or you delete your account. Notifications are delivered through your browser vendor’s push service (for example Apple, Google, or Mozilla), which passes on the encrypted message without being able to read it.

kagame uses cookies only to keep you signed in (session and sign-in security cookies) and to remember your light or dark theme choice. We do not use tracking cookies, advertising cookies, or third-party analytics cookies. If we measure visits, we do it only on our public pages (never inside the app once you are signed in), with cookieless analytics that count page views without setting cookies or identifying you. No cookie consent banner is required because we only use strictly necessary and preference cookies.

If you are in the European Economic Area, you have the following rights under the General Data Protection Regulation:

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

Your data is retained for as long as your account is active. You may delete individual entries or your entire account at any time.

A few things are handled differently, and we want to be plain about them:

• Photos and voice recordings are removed from our file storage straight after the account is deleted. If that step fails, the leftover files are flagged automatically and removed by hand.
• Backups. Our encrypted database backups are not edited to remove a single account. Deleted data disappears from them as old backups expire, normally within about 30 days.
• Free-trial record. If your account used a free trial, we keep a one-way fingerprint (a SHA-256 hash) of your email address, never the address itself, so the same email cannot claim a second free trial. It is not linked to any of your content.
• Undeliverable-email record. If email to your address bounced or was marked as spam, we keep a one-way fingerprint of the address so we stop sending it non-essential email.
• Payment records. Stripe keeps its own records of past payments, as payment and tax law requires.
• Reports on GitHub and operator notifications. Deleting your account does not delete the copy of a bug report or idea in our GitHub issue tracker, or past notifications in the operator’s Telegram chat (Section 3). Ask us and we will remove your email address and details from them.
• Legacy copies from our 2026 infrastructure move. When we moved our hosting and file storage in July 2026, we kept copies as a way back in case the move failed: a frozen snapshot of the photos and voice recordings uploaded before the move (with a backup copy of it in Cloudflare R2), a database copy taken during the move, and an older database copy on a retired server from our previous hosting setup. These copies are not used to run the service and only the operator can reach them, but deleting your account does not remove data from them. They are kept until we decommission them, and deleted then.

We work with the following service providers. Each processes only the data it needs for its purpose:

Hetzner (EU)

Hosting for our servers, database, and our own AI gateway.

Cloudflare

Network delivery and protection for our website, and Cloudflare R2 file storage (EU jurisdiction) for your photos, voice recordings, our encrypted database backups, and the legacy file snapshot described in Section 10.

AI model providers: OpenAI, Anthropic, Google, and OpenRouter

AI text processing, photo understanding, search embeddings, and voice transcription, depending on the model the operator selects for each feature. Through OpenRouter, a request may be handled by the selected model’s developer, such as OpenAI, Anthropic, Google, DeepSeek, or Z.ai (see Section 4).

fal.ai

Image generation, only when you use it.

Stripe

Subscription payments.

Resend

Sending transactional and notification email.

Google

Sign in with Google and, if you connect it, Google Calendar.

Telegram

The Telegram bot, if you connect it; and the operator’s private notification chat, which receives the email address of new accounts and of people who send a report (see Section 3).

GitHub

Our private issue tracker. Bug reports and ideas you send are copied there with your email address, plan, the page you were on, and the app version.

Better Stack

Operational and error logs. Entry text, email addresses, locations, and other things you write are redacted from our logs before they are sent.

Weather providers (OpenWeatherMap, Open-Meteo)

Your configured location, to fetch weather for your entries.

Pexels

The search words you type when you look for a stock photo.

Browser push services

Delivering encrypted push notifications, if you turn them on.

Where a provider handles EU personal data outside the European Economic Area, the transfer relies on appropriate GDPR safeguards (Standard Contractual Clauses or an adequacy decision). Contact [email protected] for the current list of sub-processors.

kagame is not intended for users under 16 years of age. We do not knowingly collect data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

We may update this Privacy Policy from time to time. We will notify registered users of material changes via email at least 14 days before the changes take effect. The “effective date” at the top of this page indicates when this policy was last revised.

The data controller responsible for your personal data is:

For privacy-related inquiries, contact us at [email protected].