Privacy Policy

1. Who we are

Monk Journal is a mobile app for iOS and Android for journaling, workouts, nutrition, habits and focus. It is operated by GC Digital Solutions LLC, a Wyoming limited liability company (“we”, “us”, “our”). We are the controller of the personal data described in this policy.

• Postal address: GC Digital Solutions LLC, 30 N Gould St, STE R, Sheridan, WY 82801, USA
• Privacy contact: privacy@monkjournal.app
• General support: support@monkjournal.app

We have not appointed a Data Protection Officer; privacy questions go to the privacy contact above. This policy covers the Monk Journal app, its backend services, and the website at monkjournal.app.

2. What we collect

We collect what you give us while using the app, plus a small amount of technical data needed to run it. We do not buy data about you or track you across other apps and websites.

2.1 Account data

Your email address, your password (stored only as a salted one-way hash, never in readable form), and your display name. We use your email to sign you in, verify your address, reset your password and send service emails. Accounts whose email address is never verified are deleted automatically after 48 hours.

2.2 Profile and body data

If you provide them: date of birth, sex at birth, gender, height, weight, goal weight, activity level, training and nutrition goals, dietary restrictions, allergies, body measurements, your time zone and language. We use these to calculate targets such as calories and macros and to personalise the app. Some of this is health-related data, so we treat it with extra care: we only use it to provide the features you use, and we ask for your consent where the law requires it.

2.3 Your content

Journal entries, mood and energy ratings, gratitude notes, up to four photos per journal entry, your profile picture, workout logs (exercises, sets, reps, weights, personal records), cardio routes, meals and food logs, custom foods and exercises, habits, goals, tasks, alarms and other entries you create. This is the core of the product and it belongs to you.

2.4 Subscription data

If you buy a subscription, payment is handled entirely by Apple (App Store) or Google (Google Play). We never see your card number or billing address. Through our subscription provider RevenueCat we receive the store you bought from, the product, your entitlement status, trial or renewal dates, billing issues and a hashed reference to the original transaction.

2.5 Device and diagnostic data

When the app crashes or hits an error, a diagnostic report is sent to our crash-reporting provider (Sentry). It contains technical details such as the error and stack trace, device model, operating system and app version. Sentry is configured not to collect personal data by default, and we do not deliberately include the content of your entries. The app does not use any third-party analytics service. Our servers also keep standard request logs (such as IP address, time, requested address and response code) for security and debugging.

2.6 Consent choices and communications

We keep a record of the privacy choices you make in the app and when you made them. If you email us, we keep your message and our reply so we can help you.

2.7 What we do not collect

• Advertising identifiers (Apple IDFA or Android Advertising ID). There are no advertising SDKs in the app.
• Your contacts, calendar or browsing history.
• Microphone recordings.
• Your face or fingerprint. Biometric checks happen inside your phone’s operating system; see section 3.
• Location outside of a cardio workout you start; see section 3.

3. How specific features handle data

Face ID / fingerprint quick unlock

If you turn on quick unlock, our server creates a random secret for that device and sends it to the app once. The app keeps it in your phone’s secure storage (iOS Keychain or Android Keystore), protected by Face ID, Touch ID or your fingerprint. Our server stores only a SHA-256 hash of that secret, together with the device name, platform and the dates it was created, last used and expires. Your biometric data never leaves your phone and is never sent to us. A quick-unlock credential expires after 180 days, you can have at most five active devices (adding a sixth revokes the oldest), and they are removed when you revoke them or delete your account.

Barcode scanning and food lookups

The camera is used only to read food barcodes; nothing is recorded or saved from the camera. When you look up a barcode that is not yet in our food database, our server sends only the barcode number to Open Food Facts, a public food database. No account information or other personal data is sent with it. The food details we get back are cached in our shared food database without any link to you.

Cardio workout routes

When you start a run, walk or ride and allow location access, the app records your route (latitude, longitude, time, accuracy, altitude and speed) to show distance, pace and a map of that workout. If you allow it, recording continues while the screen is locked, but only for the duration of a workout you started. Routes are stored with that workout and deleted with it or with your account.

Photos

When you add a photo to a journal entry or set a profile picture, only the photos you pick are uploaded. They are stored in private cloud storage that is not publicly accessible, and are deleted when you delete them or your account. Photos may contain metadata added by your camera (such as the time or place a photo was taken); if you do not want that stored, remove it before attaching the photo.

Motion sensors

If you use an alarm that asks you to move to switch it off, the app uses your phone’s motion sensors to count your reps. This is used only for that purpose.

AI features and ads

The app contains AI features (food scanner, equipment scanner, nutritionist and trainer) and an advertising setting that are switched off at launch. While they are off, none of your data is sent to an AI provider or to an advertising network. Before we switch either on, we will update this policy, name the providers involved, and ask for your consent where the law requires it.

We do not use the content of your journal, workouts, meals, habits, goals or body measurements to train, fine-tune or otherwise improve any AI model, ours or anyone else’s. If we ever want to change this, we will ask for a fresh, explicit opt-in rather than changing it in a policy update.

4. Why we use your data (legal bases)

If you are in the EU, EEA, UK or Switzerland, the GDPR requires a legal basis for each use of personal data. Ours are:

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

5. Who processes your data

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We use a small number of service providers that process data on our behalf, only to run the service:

Open Food Facts receives barcode numbers only, as described in section 3, and no personal data.

We may also disclose data where the law requires it, to protect the rights, safety or property of our users or others, or to detect and prevent fraud and abuse. If our business is merged, acquired or sold, personal data may transfer to the new owner under this policy, and we will tell you before that happens.

When we add, remove or replace a provider, we update this list.

6. International transfers

We are based in the United States and your data is stored in the United States. When we transfer personal data from the EU/EEA, UK or Switzerland, we rely on the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum, with additional safeguards where needed. You can ask for a copy at privacy@monkjournal.app.

7. How long we keep it

Apple, Google and RevenueCat keep their own purchase records under their own policies and legal obligations.

8. Exporting and deleting your data

Export

In the app, open Settings → Export your data. You can export everything or pick categories, as JSON or CSV. When the export is ready you get a download link that works for 7 days.

Delete your account

In the app, open Settings → Delete account and confirm with your password. If you cannot access the app, email privacy@monkjournal.app from your account email address.

• Your account is deactivated immediately and you are signed out.
• After 7 days, your account and everything linked to it are permanently deleted: profile, journal entries, photos, workouts, routes, meals, custom foods and exercises, habits, goals, quick-unlock credentials, data exports and subscription records. We also ask RevenueCat to delete its customer record for you.
• Backups containing your data expire within a further 7 days.
• We keep a minimal record that the deletion happened (with your identifiers replaced by a one-way hash), and anonymised records of past consent choices and security events, so we can prove we honoured your request and meet legal obligations.

Deleting your account does not cancel a subscription. Cancel it in your App Store or Google Play subscription settings first.

9. Your rights

Wherever you live, you can access, export, correct and delete your data using the app or by emailing us. Depending on where you live, you may also have these rights:

EU, EEA, UK and Switzerland (GDPR)

Access, rectification, erasure, restriction of processing, data portability, objection to processing based on legitimate interests or for direct marketing, withdrawal of consent at any time (without affecting earlier lawful processing), and the right to lodge a complaint with your data protection authority. EU authorities are listed at edpb.europa.eu; in the UK it is the ICO. We would appreciate the chance to resolve your concern first.

California (CCPA/CPRA) and other US states

The right to know what personal information we collect and how we use and disclose it, to access, correct and delete it, to opt out of its sale or sharing, to limit the use of sensitive personal information, and not to be discriminated against for using these rights. We do not sell or share personal information and have not done so in the past 12 months. In the past 12 months we have collected the categories described in section 2: identifiers (such as email and device identifiers), customer records, commercial information (subscription status), internet activity (request logs and diagnostics), geolocation (cardio routes you record), photos you upload, and health and fitness information you enter. We collect sensitive personal information only to provide the features you use. You may use an authorised agent; we may ask for proof of authorisation. Residents of other US states with privacy laws have similar rights.

How to make a request

Email privacy@monkjournal.app. We may ask you to confirm your identity, usually by replying from your account email. We respond within 30 days (GDPR) or 45 days (CCPA), free of charge. California residents may also contact the California Attorney General or the California Privacy Protection Agency.

10. This website

monkjournal.app sets no cookies and runs no analytics or advertising trackers. It stores a few preferences in your browser’s local storage (theme, language and your answer to our location prompt) and never sends them to us.

If you agree to the location prompt, your browser asks the geolocation service ipapi.co for your approximate city and time zone based on your IP address, so the footer can greet you from where you are. If you decline, no request is made. You can change your choice using “Cookie preferences” in the footer.

If you join the waitlist, your email address, chosen tier and language are emailed to our team inbox and you receive one confirmation email, both sent through Resend. The website does not store them in a database. To be removed, email hello@monkjournal.app.

Like any web server, Cloudflare processes your IP address and request data to deliver the site and protect it from attacks.

11. Children

Monk Journal is not directed at children. You must be at least 13 years old to use it, or older where the law of your country requires a higher age for consent to data processing (for example 16 in some EU countries). We do not knowingly collect personal data from children under 13. If you are a parent or guardian and believe your child has given us personal data, email privacy@monkjournal.app and we will delete it.

12. Security

All traffic between the app and our servers is encrypted with TLS. Our production database and backups are encrypted at rest, uploaded files are kept in private storage, passwords are stored only as salted hashes, and quick-unlock secrets are stored only as hashes. Access to production systems is limited to the people who operate the service.

No system is perfectly secure. If a breach affects your personal data, we will notify you and the relevant authorities as required by law. To report a security issue, email security@monkjournal.app.

13. Changes to this policy

We update this policy when what we collect, why we collect it, or who processes it changes. The “Last updated” date at the top shows the current version. For material changes, we will tell you in the app or by email before they take effect. Previous versions are available on request.

14. Contact

• Privacy and data requests: privacy@monkjournal.app
• Product support: support@monkjournal.app
• Post: GC Digital Solutions LLC, 30 N Gould St, STE R, Sheridan, WY 82801, USA