Koede Journal(Voice Journal)

Privacy Policy

The Japanese Privacy Policy is the original text. This English version follows it faithfully, and adds Sections 11–13 for users outside Japan. If the two versions conflict, the Japanese version prevails, except where the mandatory law of your place of residence provides otherwise.

Koede Journal (Voice Journal; “the app”) is a journaling app for recording the events and feelings of your day by voice or keyboard. This policy explains how the app handles your information.

Operator (data controller): Catalyst Inc. (株式会社カタリスト)
Mitsuhashi Bldg. 3F, 1-3-3 Kita-Aoyama, Minato-ku, Tokyo 107-0061, Japan
Contact: support@koede-journal.com

1. Where your entries are stored

Your journal entries (the original text, AI-polished text, mood tags, topics, photos, and so on) are all stored in a database on your device. They are not stored on our server (except for encrypted data kept when you turn on the optional cloud backup — see Section 5). There is no account registration, and we do not collect information that identifies you personally, such as your name or email address. We do, however, handle an anonymous identifier on our server to manage AI usage limits and friend referrals (Sections 8 and 9).

Files stored on your device may be included in the device backup features provided by your OS (iCloud Backup on iOS, device-to-device transfer on iPhone / iPad, and the like). This is not a transmission by the app; it follows your own OS settings. On Android, the app opts out of the OS automatic backup (allowBackup=false) so that its data is not included. If you do not want the app included in your iOS device backup, turn off its backup in the OS settings.

2. How your voice is handled

Speech recognition uses only the standard speech-recognition service of your OS (iOS / Android). Depending on the OS, recognition runs on the device or on the OS vendor’s servers, and may use a network connection. The app itself never sends audio data (recordings) to our server. A recording is saved only if you turn on the setting “Keep the audio too” (off by default), and it is stored only on your device (it is not included in the app’s backups — the export file or the cloud backup).

3. Place, weather, and map (optional; off by default)

You can attach the name of the place you were at, the weather, and a small map image to an entry. The three settings — place, weather, and map — are all off by default, and the app does not read your location unless you turn them on. The first time you turn one on, the app shows a screen explaining what is sent where, and then asks for the OS location permission. You can turn them off anytime under Settings → “Place & weather”, and remove the chip from any single entry with ×. Your location is read only while the record screen is open — never in the background. Reading your location and converting it to a place name (city / town) is done by the OS location service and may use a network connection, per the OS.

The app sends location data off your device in only the two cases below. In both cases, the text of your entry, the place name, and the entry’s identifier are never sent together with the coordinates. Place and weather are not sent to AI processing (Section 4) either.

  • If you turn on attaching the weather: coordinates rounded to about 1 km and the time of the entry are sent via our API server to Apple’s weather service (WeatherKit), and the weather and temperature come back
  • If you turn on attaching a map: once, when the entry is saved, coordinates rounded to the granularity needed to draw the map image (roughly 100 m — finer than the weather) are sent via our API server to Apple’s map service (Apple Maps), and a map image comes back. The image is stored on your device and shown from there, so coordinates are not sent again each time you re-read the entry

Our API server does not store the coordinates it receives and does not write them to logs (it keeps no error logs containing coordinates either). Coordinates are sent in the request body or headers, never in the URL. For weather only, to batch queries from the same area and time window, the rounded coordinates and the weather result are held in the server’s memory for at most 10 minutes (never written to disk or a database, and never linked to anything that identifies you). Note that rounding the coordinates is not a guarantee that you cannot be identified. We round them to keep what leaves your device to a minimum; what we can promise is the “no storage, no logging” described above.

On the other hand, the un-rounded coordinates, the place name from the OS, the place names you typed yourself, and the received map images are stored on your device (we never store them on our server). You can delete them with “Delete all data” (Section 10) or by uninstalling the app. To delete just a place name, you can remove it individually under Settings → “Place & weather”. If cloud backup (Section 5) is on, these are kept encrypted on your device first, the same as entries and photos.

If you revoke the location permission in the OS settings, the app stops reading your location, and later entries will no longer get a place, weather, or map (entries already saved are unchanged).

4. AI polishing (optional; you can turn it off)

When AI polishing is on, the text of the entry you saved is sent via our API server to Google’s Gemini API to be tidied and structured.

Other AI features exist, and they all travel the same route. Conversation mode sends the text you are writing so it can offer the next question. The weekly and monthly reflections send the text of several entries together — the last 7 days, or that month — which is how they differ from AI polishing, where one entry is sent at a time. All of them are handled on the same terms below (consent, being able to turn it off, not stored on our server, not used for training).

About this processing:

  • We ask for your consent on first launch, and you can turn it off anytime in Settings (everything else — recording and reading — keeps working with it off)
  • Our server does not store the text and does not write it to logs
  • We use a configuration in which the AI input is not used to train AI models
  • Photos are never sent to the AI (they stay on your device, and are kept — encrypted — only if you turn on cloud backup)
  • To manage usage limits, however, an anonymous identifier and the time of use are recorded on our server (Section 8)

5. Cloud backup (optional; off by default)

On the paid plan (Pro) you can use automatic cloud backup of your entries and photos (opt-in; nothing is sent unless you turn it on). When it is on:

  • All entries and photos are encrypted on your device (AES-256-GCM) first, then sent to and kept on our server (the latest 3 generations)
  • The key that decrypts the backup (your recovery code) exists only on your device and is never sent to us. No one — including us — can read the contents of your backup
  • If you lose the recovery code, no one — including us — can restore the backup
  • You can turn it off anytime, and you can delete the backup on the server anytime from inside the app
  • The contents of the backup (text and photos) stay sealed, but we do handle incidental information such as its size and timestamps in order to store and operate it

6. Usage and crash analytics (you can turn it off)

To improve the app, we use the services below. The text of your entries, mood tags, and topics are never sent to either of them (what is sent is anonymous behavioral data — such as which features are used — and technical information when something breaks).

  • PostHog (PostHog, Inc., USA): anonymous usage measurement under an anonymous identifier (screens viewed, feature usage counts, and the like)
  • Sentry (Functional Software, Inc., USA): technical information when a crash or error occurs (the error, OS type, and the like)

You can turn this off anytime with the app setting “Share usage data”; once off, nothing further is sent. The app contains no advertising SDKs.

Separately, if — and only if — you send us a message from “Feedback & issues” in the app, that message is sent to our server together with an optional reply address you choose to provide, your device type, and the app version. The text of your entries and your photos are never sent with it. Nothing is sent unless you tap send on that screen.

7. In-app purchases

Payments for in-app purchases (subscriptions) are processed by Apple or Google; we never receive your payment details such as credit card numbers. We use RevenueCat, Inc. to manage purchase state, and an anonymous identifier plus purchase information (the plan purchased, purchase date, and so on) is sent to RevenueCat. The text of your entries is never sent to RevenueCat. The same anonymous identifier is attached to AI-processing requests to confirm purchase state.

We also pass the anonymous identifier issued by the analytics service in Section 6 to RevenueCat as a customer attribute, so that purchases can be counted as belonging to the same person as the usage data. We do this only while the “Share usage data” setting is on; turning it off deletes that identifier from RevenueCat as well, and we stop passing it.

Running “Delete all data” in the app also deletes this RevenueCat purchase record (the anonymous identifier and purchase history). Note that deleting your data does not cancel your subscription (cancel it from your App Store / Google Play subscription settings), and a plan you have already purchased can be brought back anytime with “Restore purchases” in the app.

8. Managing AI usage limits

AI features have usage limits over a set period (per day, per week, and so on, depending on the feature) so that everyone can use them fairly. To count usage, our server records the anonymous identifier from Section 7, the feature used, and the time of use. The text of your entries and your photos are never part of this record.

  • We record only “which feature, when”; it is never linked to your name, email address, or anything similar
  • Records older than a set period are deleted the next time the same person uses the same feature. Because deletion happens only on a next use, if you stop using the app those records remain on the server
  • If you would like them deleted, see Section 10

9. Friend referrals (invite codes)

If you use the friend-referral feature, our server stores the information below. The text of your entries and your photos are never involved.

  • For the person who issued an invite code: the anonymous identifier from Section 7, the code, and when it was issued
  • For the person who entered an invite code: the anonymous identifier from Section 7, the code entered, when it was entered, and when the reward was granted

The referrer sees only the number of people who used their code. Neither side can ever see the contents of the other’s journal. We keep these records to prevent duplicate rewards and abuse, and they are deleted automatically once 400 days have passed since their last use. For deletion via “Delete all data” in the app, see Section 10.

10. Deleting your data

Because your data (entries and photos, plus the coordinates, place names, and map images of Section 3) lives on your device, you can delete it yourself with the app setting “Delete all data” or by uninstalling the app. If cloud backup was on, you can also delete the backup on the server anytime with “Delete the cloud backup” inside the app (uninstalling alone does not delete the encrypted backup on the server — if you want everything gone, delete it before uninstalling). The RevenueCat purchase record in Section 7 is deleted along with it (cancelling the subscription itself has to be done on the store side, and an already-purchased plan can be brought back with “Restore purchases”).

The server-side records described in Section 8 (AI usage limits) and Section 9 (friend referrals) are deleted together when you run “Delete all data” in the app (if deletion fails — no connection, for example — we tell you right then). Uninstalling alone does not delete them, but records past their retention period are deleted automatically (Section 8 records within days of last use; Section 9 records 400 days after last use). For any other deletion request, contact us via Section 15 (we will explain, when you contact us, how to identify the records concerned).

11. Children

Children under 13 may not use the app (Terms of Service, Section 2). The app is not directed to children under 13, and we do not knowingly collect personal information from children under 13. Because there are no accounts, the app does not ask for a name, birthday, or contact details in the first place. If you believe a child has used the app and information about them has reached our server, contact us via Section 15 and we will delete it.

12. International data transfers

We operate from Japan, and the service providers named in this policy (Apple, Google, RevenueCat, PostHog, Sentry) process data in the United States and other countries. The limited information described in this policy may therefore be processed outside your country of residence. Wherever it is processed, it remains subject to the commitments in this policy — and the strongest protections here do not depend on location: your entries stay on your device, and a cloud backup is encrypted on your device before it leaves. If you are in the EU/EEA or the United Kingdom, note that Japan is recognized as providing an adequate level of data protection (European Commission adequacy decision 2019/419 and the corresponding UK adequacy regulations).

13. Your privacy rights

Depending on where you live — for example the EEA, the United Kingdom, or certain US states — the law may give you rights over your personal information, such as the rights to access, correct, delete, or receive a copy of it, and to object to or restrict some processing. The app is built so that you can exercise the substance of these rights directly: your entries live on your device, where you can read, edit, and delete them anytime; “Delete all data” also deletes the server-side records described in Sections 8 and 9; and you can delete the cloud backup anytime from inside the app (Section 5). For anything the in-app controls do not cover, contact us via Section 15.

Two honest limitations that follow from the app’s design:

  • Because there are no accounts, we usually cannot link server-side records to a person without the anonymous identifier (we will explain how to find it when you contact us)
  • We cannot read or produce the contents of an encrypted cloud backup for anyone — including you — without your device or recovery code

We do not sell your personal information, we do not share it for targeted advertising, and we do not use it for profiling that produces legal or similarly significant effects. If you live in the EEA or the United Kingdom, you also have the right to lodge a complaint with your local data protection authority.

14. Changes to this policy

If we revise this policy, we will publish the revision on this page. Important changes will also be announced in the app.

15. Contact

Questions about this policy: support@koede-journal.com

Established: July 5, 2026 / Last revised: August 30, 2026