Your words, and everyone who touches them.

1. Who we are

EmotiVault is provided by EmotiVault Ltd, a company registered in England and Wales (company number 17300453). Its registered office is 80 Holloway Head, Birmingham B1 1QP, United Kingdom. EmotiVault Ltd is the data controller for the personal data described in this policy. EmotiVault is offered to people in the United Kingdom.

Our iPhone app is published on the App Store by BespokeWorks AI Limited on our behalf, which is why the App Store shows BespokeWorks as the seller. EmotiVault Ltd provides the service and remains the data controller. BespokeWorks also helps us build and run EmotiVault, as our processor under a written agreement: it may use your data only on our instructions.

Contact: support@emotivault.com. EmotiVault Ltd is registered with the Information Commissioner’s Office (ICO), registration number ZC259587.

2. What we collect

• Identity: your first name, email address, a username, and your age status. You give us your date of birth at sign-up for the 18+ check, but we store only the result (that you’re an adult), not the date itself.
• What you write: journal entries, moods, tags, attachments you add, your conversations with Aurelia, and the answers you give during onboarding (such as Aurelia’s tone, your first mood and entry, and any goals or triggers you share over time).
• Voice (Premium): transcripts of voice journal entries. We do not store your audio. Only the transcript is saved, as an ordinary entry. Storage and transmission are different things, though. Where your browser has built-in speech recognition, it does the transcribing, and some browsers (Chrome, for example) send the audio to their maker to do it, under the browser’s own terms. Otherwise the recording is sent to Cloudflare’s AI service (Workers AI) to be transcribed, and is discarded once it comes back as text. See section 6.
• What we work out from it: Aurelia’s memory of you (short summaries of what has been going on, called memory threads, and the people, places and projects you mention), the search vectors that let her recall things, and the label our crisis check gives each chat message. See section 6.
• Consent records: when you gave the consents at sign-up, and which version of the wording you agreed to.
• Subscription (Premium): your plan, its status and dates, and your Stripe customer ID. Stripe holds your card details. We never see your card number.
• Technical data: sign-in records, including your IP address; your active sign-in sessions; and, if we switch it on, crash reports (below).
• Support emails: whatever you send to support@emotivault.com, and our replies. If you tell us about your health in an email, we use it only to answer you.
• Page views (page counting is currently switched off). If we switch it on, we would record the page visited (with query strings and any ids stripped), the referring site’s host name, a two-letter country, and whether you are on mobile or desktop. No user id, no cookie, no device identifier. Your IP address would never be stored: it is hashed with a salt that is destroyed and regenerated daily. Full detail on the cookies & storage page.
• Crash reports (currently switched off). If we switch them on, when something breaks in your browser we would record the error type, message, stack trace, the component and the scrubbed path, plus country and device class. These carry no account id, though a stack trace is unstructured text and we treat it as potentially identifying.

What you have to give us. To create an account you need to give an email address and your date of birth (for the 18+ check). Aurelia can’t work without processing what you write to her. Everything else is up to you: what you write, and whether you use voice, attachments or Premium.

3. What we DON'T do

• No third-party advertising trackers, no analytics SDK, no session-replay tool. We load no third-party scripts at all, and our fonts are served from our own domain rather than fetched from Google
• No cookies (see /cookies), no advertising, and no profiling for marketing. The only profiling we do is the automatic crisis check in section 6, which exists to show you support
• We have never sold personal data and will not
• We do not train any model on your content. Cloudflare, which runs all of our AI, may use it only to provide the service to us. Section 6 sets out exactly what it receives and on what terms. That is where this promise is either kept or broken, so we have written it out rather than left it as a slogan

4. Why we use your data: our lawful bases

The UK GDPR requires a lawful basis (Article 6) for each thing we do with your data. Here they are, purpose by purpose:

• Providing EmotiVault to you: your account, journal, conversations with Aurelia, voice entries, her memory of you, the crisis check, answering your support emails, and sign-in emails. Basis: contract (Article 6(1)(b)). We need it to provide the service you signed up for.
• The safety check in the demo and sandbox (no account): consent (Article 6(1)(a)).
• Premium billing: contract (Article 6(1)(b)).
• Keeping billing records for six years, and answering your data-rights requests: legal obligation (Article 6(1)(c)).
• Security, fraud prevention, crash reports and, if we switch it on, anonymous page counts: legitimate interests (Article 6(1)(f)), our interest in keeping EmotiVault safe and working. You can object (section 10).
• Marketing email (the waitlist, currently switched off): consent (Article 6(1)(a)). You can unsubscribe at any time.

Your journal entries, moods and conversations with Aurelia reveal information about your mental health. That makes them special category data under Article 9 of the UK GDPR, which needs a second, separate condition on top of the Article 6 basis above. The condition we rely on is explicit consent under Article 9(2)(a). There is no other realistic one: we are not a health provider, so the health-and-social-care conditions in Article 9(2)(h) and (i) are not open to us, and neither legitimate interests nor contract can carry Article 9 data.

How that consent is given. At sign-up there are two separate ticks: one confirming you are 18 or over, agree to the Terms and have read this policy, and a second, on its own, giving your explicit consent to us processing what you write about your mental health, including the automatic crisis check in section 6. The account can’t be created without both. We record the moment you consented and the version of the wording you agreed to.

If you try EmotiVault without an account (the demo or the sandbox), nothing you write leaves your device unless you turn on the safety check. If you do, pressing “I agree, turn it on” is your consent (Article 6(1)(a)) and your explicit consent (Article 9(2)(a)) for each entry you save or send to be checked once by our AI service for signs of crisis, so we can show you help. The text isn’t stored or linked to you. Your choice is remembered in your browser until you press “Turn off”, which withdraws it.

Withdrawing it. At any time, and it must be as easy as giving it. Delete your data or your whole account from /you, or email us (section 15). Withdrawal stops future processing and, on the delete path, erases what we hold; it does not make lawful what was already lawfully done before you withdrew. Withdrawing consent means Aurelia can no longer function, so withdrawal and account closure are in practice the same act.

5. Where it lives, and who can see it

Your account, journal entries, moods, Aurelia’s memory of you and your chat history are stored in a Postgres database run for us by Supabase, encrypted in transit (TLS 1.3) and at rest (AES-256). The database region is stated in section 12 alongside every other place your data goes. End-to-end encryption, where even we cannot decrypt your content, is on the roadmap for journal entries and voice. It is not built today.

Until it is, people at EmotiVault, and at BespokeWorks AI Limited, which supports the service for us, can technically reach your data. Our access-control policy lets them look at your content only when you ask us to (a support request, for example), to meet a legal duty, to deal with a security incident, or to fix a fault that can’t be fixed any other way. Every time someone does, it is logged.

Our API is a Cloudflare Worker. Cloudflare runs code at whichever of its data centres is nearest the person making the request, so the words you type pass through Cloudflare infrastructure that may be outside the UK while they are in transit. Nothing is stored there except short-lived rate-limit counters (and, if we switch on page counting, the daily salt described on our cookies page).

The website itself is static files served by Firebase Hosting (Google). Serving a page creates a request log at Google that includes your IP address, and Google keeps these logs for a few months. No account content passes through it.

6. What our AI provider receives

Aurelia is not a model we host. To answer you, we send your words to an AI service. This section says exactly what leaves our systems, because a vague answer here would be the most misleading thing on the page.

What it receives. Your message, the recent turns of that conversation, and a personalised instruction block built from your account: your first name and pronouns if set, the emotions you log most, any triggers, coping methods and wellness goals you have shared, your crisis preference, summaries of up to five active memory threads, and up to twelve people, places or projects Aurelia knows about. It also receives your recent journal entries and messages when Aurelia updates her memory of you, the text of entries and messages when they are converted into the numeric vectors that power recall, and, when your browser can’t transcribe a voice entry itself, the recording, for transcription.

Who that is. Every AI task runs on Cloudflare Workers AI, an AI service run by Cloudflare, Inc., which also hosts our API. That covers Aurelia’s replies, the crisis check below, building her memory, the search vectors that power recall, and voice transcription. No other AI company receives your content. The model that answered is recorded against each message in your own data, so this is auditable rather than a promise. If we ever add another AI provider, it will only be under a contract that allows it to handle health information, and we will update this policy and email you at least 30 days before it receives anything.

The crisis check. Every message you send Aurelia, and every journal entry you save, is checked automatically for signs of distress, by the same AI service on the same terms. If something is flagged, you are shown crisis support: Samaritans (116 123), SHOUT (text 85258) and 999. That support is guaranteed by our code, not left to the AI’s judgement: if a flagged reply doesn’t include the helplines, our code adds them, so the AI cannot withhold them. If the check can’t be made (because the AI service is down, say), our server treats the message as needing support rather than assuming you are fine.

Each chat message is stored with the label the check gave it (routine, deep or crisis), and the label is deleted with the message. The result of checking a journal entry isn’t stored. This is automated profiling of health information, but it doesn’t decide anything about you. Nothing is blocked, restricted or reported to anyone, and its only effect is extra support. If you think a label is wrong, tell us and we will correct it.

In the demo and the sandbox, where you have no account, the check runs only if you turn it on (section 4). Each entry you then save or send is checked once and isn’t stored.

Retention and training. We do not train models on your content. Cloudflare may process it only to provide the service to us, and it says it doesn’t store your content to train AI models and doesn’t train on it.

We never send the AI your name beyond a first name, your email address, your account id, your billing details, or any entry you have locked as private.

7. Who else handles your data

These organisations handle personal data for us, to run EmotiVault. Unless we say otherwise below, each works under a contract that lets it use your data only to provide its service to us. Where one is outside the UK, see section 12.

• Supabase (Supabase Pte. Ltd, Singapore; your data is stored in London) runs our database and sign-in. It holds everything you write.
• Cloudflare, Inc. (US) runs our API and protects it from attack, and runs Workers AI, which does all of our AI work (section 6). Everything you send passes through it.
• Google LLC (US) serves the website through Firebase Hosting. It sees request details, including your IP address, but never your content, and keeps these logs for a few months.
• Google LLC, Gmail (US). For now, sign-in links and password-reset emails are sent through Google’s Gmail service, so Google handles your email address and the link. Gmail is a consumer service, so Google handles this under its own terms rather than a contract with us. That is why we are moving these emails to Resend (below). They never contain anything you have written.
• Stripe (Stripe Payments Europe, Ltd, Ireland, and Stripe, LLC, US) takes Premium payments. It sees your email address and payment details; we never see your card number. Stripe is also an independent controller for its own fraud-prevention and anti-money-laundering checks, under its own privacy policy.
• Resend (Plus Five Five, Inc., US) is our email service. It sees your email address and the message.
• BespokeWorks AI Limited (UK) publishes our iPhone app and helps us build and run EmotiVault, as our processor under a written agreement. Its people follow the same access rules as ours (section 5).
• Our business email provider holds the emails you send to support@emotivault.com, and our replies.

We don’t share your data with anyone else, except where the law requires it (a court order, for example). Before we add an organisation that can see what you write, we will update this list and email you.

8. Sealed entries & the Ideas board

Sealed (time-capsule) entries in your Vault stay private to your account and are hidden in the app until the unlock date you chose. Sealing is an app-level promise, not extra encryption: like every entry, sealed entries are encrypted in transit and at rest, and the staff-access controls in section 5 apply until end-to-end encryption ships. Once unlocked, an entry remains visible only to you.

The Ideas board, where you will be able to suggest and upvote ideas for EmotiVault, isn’t open yet. When it opens, posting will always be a separate, deliberate action. Nothing from your journal or your chats is ever shared. Posts are anonymous (they never show your name or username), every post is held for review before anyone else sees it, and posts are deleted about 31 days after posting. The rules are in our community guidelines.

9. How long we keep it

• Journal entries, moods, chat history, Aurelia’s memory threads and the people she knows about: kept for as long as your account exists. Yours forever: we do not delete your words on a timer.
• Aurelia’s memory window: Free tier, a rolling 30 days; Premium, unlimited. This is a limit on what Aurelia can recall, not a deletion. Your entries stay where they are either way. On the Free tier the derived search vector attached to a chat message older than 12 months is discarded, because we have forbidden ourselves to use it. The message text is untouched.
• Aurelia’s greeting log (kept so she does not repeat herself): 180 days.
• Ideas board posts: deleted about 31 days after posting (the board isn’t open yet).
• Sign-in records, including your IP address: 90 days. Active sign-in sessions: until you sign out or they expire.
• Support emails: two years after the last message.
• Page views: 90 days (page counting is currently switched off). Crash reports: 30 days (currently switched off). Neither is linked to an account.
• Waitlist sign-ups (the waitlist is currently switched off): 24 months, then deleted. A waitlist row is keyed to the email address you gave rather than to an account, so deleting your account does not by itself remove it. Email us and we will.
• Billing records: subscription status, dates and payment records are kept after account deletion where UK tax and accounting law requires it (six years). These hold no journal content.
• Account deletion: your content is erased from our live systems immediately. We then keep a record of your account id and when it was erased for 90 days, so that a restored backup can’t bring the account back.
• Backups: our database backups age out within 7 days, and never take longer than 30, after which an erased account cannot be restored from them.

When you delete your account, we delete everything we hold about you, except what the law requires us to keep. The Ideas board, greeting-log, search-vector, sign-in-record, page-view, crash-report, waitlist and erasure-record periods above are enforced by scheduled database jobs, not by someone remembering to delete things.

10. Your rights, and how to use them

Under the UK GDPR you have the rights below. To exercise any of them, email support@emotivault.com from the address on your account. We will acknowledge within 72 hours and respond within one month, which is the statutory deadline; if a request is genuinely complex we may extend by up to two further months and will tell you why within the first month. There is no charge.

• Access (Article 15): a copy of everything we hold about you. In the app, /you exports the journal entries held on that device as text or PDF, which is the fastest route to your own writing. It does not yet cover your chat history with Aurelia, her memory threads, or your account record, so a full Article 15 request is handled manually: email us and we will assemble the complete set.
• Portability (Article 20): your data in a structured, commonly used, machine-readable format, or sent directly to another controller where technically feasible. The in-app export is human-readable rather than structured; ask us and we will provide JSON. A one-click structured export is being built, and we are not going to describe it as though it already exists.
• Rectification (Article 16): correct anything inaccurate. Your name, handle and preferences are editable in /you, and entries are editable in the app. For anything else, email us.
• Erasure (Article 17): /you → “Delete everything” erases your entries, chat history, Aurelia’s memories and your account, immediately and irreversibly. The email route is set out on /account-deletion for when you can no longer sign in.
• Restriction (Article 18): ask us to pause processing while a dispute about accuracy or lawfulness is resolved.
• Objection (Article 21): object to processing we base on legitimate interests, which for us means security, fraud prevention, crash reports and, if switched on, page counts. We will stop unless we can show compelling grounds that override your interests. We don’t send marketing email; if we ever do, it will only be with your consent, and you can stop it at any time.
• Automated decisions (Article 22): the crisis check in section 6 is automated, but it makes no decision with legal or similarly significant effects on you. It never blocks, restricts or reports anything, and its only effect is to show you support, so Article 22 does not apply. You can still tell us if you think a label is wrong, and we will correct it.
• Withdraw consent (Article 7(3)): at any time, and as easily as you gave it. See section 4.
• Complain: tell us first at support@emotivault.com, and we will reply within one month. You can also complain to the Information Commissioner’s Office at any time (ico.org.uk, 0303 123 1113). You do not need our permission, and it costs you nothing.

11. Children's data

EmotiVault is for adults aged 18 and over. The age check happens at sign-up, and anyone who says they are under 18 is not given an account (we point them to Childline, 0800 1111, and SHOUT, text 85258, instead). We do not knowingly collect data from anyone under 18. If you believe we have, write to support@emotivault.com and we will delete it.

12. Where your data goes, and international transfers

We are a UK controller, EmotiVault is offered to people in the UK, and the UK GDPR applies to everything described here. This is where your data actually goes:

• Your account and everything you write: our Supabase Postgres database, hosted in London, United Kingdom (AWS region eu-west-2).
• In transit through our API: Cloudflare’s global edge network, which runs each request at the data centre nearest the person making it. Not stored there.
• AI replies, the crisis check, memory, search vectors and transcription: Cloudflare Workers AI, on Cloudflare’s global network (not pinned to a region). Cloudflare is a US company. See section 6.
• Website delivery: Firebase Hosting (Google), global CDN. Request metadata including your IP address; no account content.
• Billing: Stripe, contracted through its Irish entity with processing by Stripe, LLC in the United States.
• Email: sign-in and password-reset emails currently go through Gmail (Google, United States) while we move them to Resend (United States), which handles our other email.
• BespokeWorks AI Limited: United Kingdom.

So some of your data is processed outside the UK, including all of our AI work, which Cloudflare can run in data centres outside the UK. That is lawful, but it needs a safeguard rather than a reassuring sentence. These are the safeguards:

• Cloudflare, Google, Stripe and Resend are certified under the UK Extension to the EU–US Data Privacy Framework (the “UK–US data bridge”), which the UK treats as adequate. Our contracts with Cloudflare, Google (Firebase), Stripe and Resend also include the Standard Contractual Clauses with the ICO’s UK Addendum, as a fallback.
• Supabase (our database) stores your data in London. Its contracting company is in Singapore, so access from outside the UK is covered by the Standard Contractual Clauses with the ICO’s UK Addendum, backed by our transfer risk assessment.

You can ask us for a copy of the safeguards that apply to your data at support@emotivault.com.

13. Cookies & device storage

We set no cookies, load no third-party scripts, and serve our fonts from our own domain, so no font request hands your IP address and the page you are reading to Google. What we do keep on your device is a short list of first-party storage items that keep you signed in, keep your journal readable offline, remember the settings you chose, and, in the demo, remember whether you turned on the safety check. Our iPhone app keeps your sign-in in the iOS Keychain, and an unsaved draft, your settings and today’s mood check-in on your phone. Nothing is used for tracking, and there are no advertising IDs.

Every one of them is named, explained and given a lifetime on the cookies & storage page, along with why no consent banner is required today and exactly what would change that.

14. Changes to this policy

If we make a material change, we will email you before it takes effect, and update the version and date at the top of this page. If a change needs your consent (a new use of your health information, for example), we will ask for it. We will not treat your continuing to use EmotiVault as agreement. Before any new AI provider receives your content, we will give you at least 30 days’ notice (section 6).

15. Contact + privacy lead

For privacy questions, exports, deletions, complaints, or to exercise any of your rights, write to support@emotivault.com.

The controller is EmotiVault Ltd (company number 17300453), 80 Holloway Head, Birmingham B1 1QP, United Kingdom.

Data Protection Officer. We have not appointed one. The law requires a DPO where an organisation’s core activities involve special category data on a large scale (UK GDPR Article 37), and at our current size that isn’t yet the case. We will review this when we reach 5,000 accounts, or 12 months after launch, whichever comes first. Until then a director of EmotiVault Ltd is responsible for privacy, reachable at support@emotivault.com.

Changes to this page

• 29 September 2026: our ICO registration number, ZC259587, is added to section 1. Nothing else changed.
• 27 September 2026: version 1.0, the first final version. EmotiVault is now for adults only (18+). All of our AI runs on Cloudflare Workers AI; OpenRouter (the GLM model), Anthropic and Google Gemini, named in earlier drafts, receive nothing. Lawful bases are set out purpose by purpose, with explicit consent for health information given by its own tick. The demo safety check now needs your agreement. Added: who can access your data, every retention period, the crisis-check label and your rights around it, the temporary use of Gmail for sign-in emails, and how to complain. Echoes, described in earlier drafts, became part of your private Vault in May 2026.
• Before 27 September 2026: pre-launch drafts, up to version 0.5.