Reflections privacy
Your writing is yours. Reflections encrypts it on your device, and this page lists everything else we keep.
What we store
Your account email and name, your plan, and your writing, which is encrypted.
Who can read your writing
Only you, because it is encrypted on your device before it is saved.
What leaves your device
Encrypted copies, so your writing syncs. No note text goes to any AI service.
How to delete it
Open Account and choose Delete data or account, which takes effect straight away.
What Reflections keeps
To sign you in: your email address, the name you give us, and your profile photo if you add one. Your writing: notes, moods, tags, cover images, attachments, letters to your future self, and the people you add, with their catch-ups, reasons to reconnect and reminders. All of it is encrypted before it is saved. To run your plan: whether you are on Free or Pro, your Razorpay subscription ID and payment status, and how many notes you started this month.
How encryption works
Before anything is saved or synced, your device encrypts your writing with AES-256. The key that unlocks it is protected by a password only you know: your account password, or a separate private-writing password if you chose one. That key never reaches our servers. Setting up private writing gives you a recovery key, the only other way in if you forget your password. We cannot reset it or read your writing for you. An encrypted copy also stays on your device, so writing works offline and opens quickly.
What the server can see
Encryption hides the words themselves. The server can still see your email address and name, your profile photo, your plan, when each item was created or changed, how many notes you have, the open date of each letter, whether you asked for the newsletter, and that a Release happened (never its words). Invites leave a record too: the server stores the invite code and whether the person joined.
On-device intelligence
Reflections has no server-side AI. Search, related notes and tag suggestions run on your device, using a small open model that your device downloads once from Hugging Face. No AI service receives your writing, and none is trained on it.
Voice notes and contacts
Voice notes use the speech recognition built into your browser. Your browser may send the audio to its own provider to turn it into text. Chrome, for example, sends it to Google. Type instead if you want every word to stay on your device. If you import contacts, they are read from a file or a person you pick on your device. Reflections never connects to your Google account for this. Contacts are encrypted on your device before they are saved.
Services we use
Supabase runs sign-in, the database and file storage. It holds your encrypted writing. Razorpay handles checkout, subscription billing, and card or bank details. Reflections never sees your card number. Vercel hosts the app and keeps ordinary server logs. Resend sends the welcome email. Reports sent with Report a problem reach us through EmailJS, along with your email address. Google provides Google sign-in and the contacts import, when you choose them. Hugging Face hosts the on-device model your device downloads.
Analytics
Reflections runs no analytics or tracking scripts, on the public pages or in the app.
Export, deletion, and account closure
Account has a full backup (.json) and an archive (.zip) of your notes and people. Exports are not encrypted, so store them with care. Deleting a single note or person keeps an encrypted copy for 30 days, in case you ask us to restore it. After that it is erased. In Account, Delete data or account gives you two choices. Delete your saved writing and keep your sign-in, or delete the account too. Deleting the account cancels Pro and removes your sign-in. Both take effect straight away.
Using Reflections
Use Reflections as a personal writing tool. Do not use it for anything illegal or harmful, and do not try to reach another person's account or files. You must be at least 13 years old to use Reflections. If you are under 18, read this page with a parent or guardian. Reflections is not therapy, crisis support or medical care.
Security and limits
Besides encryption, Reflections uses account-scoped database rules, private file storage and encrypted connections. No online service can promise perfect security. Sync, payments and exports need an internet connection and can fail when a provider is down. Plans and limits may change. When they do, the app says so plainly.