Privacy Policy

This Privacy Policy explains how Everything Awaken™ ("we", "us", "our") collects, uses, stores, and protects your personal data when you use Awaken Journal ("the Service"). Visiting our website is covered by the Everything Awaken Privacy Policy. We're written in plain language on purpose — the technical detail is real and it's all here too, just tucked under a Technical detail toggle wherever a section has one, so you can go as deep as you want without wading through it if you don't. We handle your data in line with India's Digital Personal Data Protection Act, 2023 (DPDP) — our primary regulator, not the EU's GDPR.

1. Who we are

Everything Awaken™ is a personal software project owned and operated by Tanureet Kaur Randhawa, Punjab, India. For any privacy question or request, contact us at reet@everythingawaken.com.

2. What we can see, and what we genuinely can't

There are really only two categories, and the line between them is the whole point of how Awaken is built:

• Your writing — journal entries, to-do titles and notes, money notes, categories, amounts, your own section names. This is encrypted on your device (in your browser, or in our Android or iPhone app), before a single byte is sent to us. What reaches our server is meaningless noise. We do not have the key that unlocks it — it never leaves your device. If our server were seized, hacked, or subpoenaed tomorrow, this is the part nobody would be able to read. Full story: Your Data Stays Yours.
• A small amount of plain account data — your email, username, when you last used the app, and a little technical housekeeping. We need this to run the Service, keep you logged in, and reach you if something's wrong. It's listed in full below. It is never your journal, and it never becomes an advertising profile.
• Messages you send us. Feedback and support messages you write to us are not encrypted — they're addressed to us, so we can read and answer them. Please don't paste journal content into them.

Plain copies of your notes (Notes Sync)

Awaken Notes work like a markdown vault: your notes can live as plain .md files in a folder on your own device, so Obsidian, an editor, or your own AI tools can read and edit them — and Awaken keeps them in sync across your devices. On our server they are always encrypted with your key, the same as your journal. The plain files exist only on devices you link (today: a folder on your computer, in Chrome or Edge). Those local files are not encrypted — that's what makes them readable — so they're protected by your device, or by whatever service you choose to sync that folder with.

Told openly, because we'd rather you hear it from us: in the beta version, before 1 October 2026, an early "Awaken Server" sync option also kept a plain copy of those files on our server. Our own review flagged it, and the same day we replaced it: Awaken Cloud now keeps notes encrypted on our server and plain only on your own devices, and every plain copy on our server has been deleted. The promise this page is built on, that we can't read your writing, now holds for Notes too.

We do not process payments directly — any purchase or contribution in Awaken Journal happens through Google Play (Android) or Apple's App Store (iPhone), under that store's own privacy policy. We never see or store your card, UPI, or bank details.

Technical detail — the exact field list, verified against our own database schema

This isn't a summary written from memory — it was last checked line by line against our database structure on 1 October 2026, and is re-checked whenever the database changes.

We can see, in plain text: email, username · a one-way password proof + salts (never the password itself) · row IDs and timestamps · your Google/Apple sign-in ID, if you use one · when you last used the app · icon/colour choices for your own organisation (UI settings, not content) · a push-notification address, only if you opt in · which reminders you've turned on and at what time · the shape of your data, never its words — e.g. that a task is a Frog and is done, that a transaction is an expense and which (encrypted) category it belongs to, which journal section a line sits in · your app settings (day cutoff hour, currency symbol, toolbar order, theme) · feedback and support messages you send us · if you joined the waitlist, your email on it · crash/usage telemetry (Section 5).

We can only ever see ciphertext for — meaningless to us: journal entry text · to-do titles and notes · money notes, categories, and amounts · your own section and folder names · review section names and descriptions · note titles and content.

Money totals and every score the app shows you are computed on your device from the decrypted data — we never receive or store a number, only the ciphertext it was computed from.

3. Why we collect it (purpose)

• To provide the Service — let you log in and use your journal, tasks, and money features.
• To keep the Service secure and working (the technical fields above).

We use your data only for these purposes — nothing else, and nothing is repurposed later without telling you.

4. How your writing is protected

Your password never reaches us — your browser turns it into an encryption key that stays on your device, and a separate proof that only confirms it's you. Your writing is scrambled with that key before it's sent anywhere. This isn't a policy promise; it's how the code is built, and we'd rather you verify it than trust it — the full plain-language explanation, with a "check us yourself" section, lives at Your Data Stays Yours.

Technical detail — the actual cryptography

• Argon2id for password hashing (not bcrypt) — 19 MiB memory, 2 iterations, parallelism 1.
• Two independent salts: one derives the login proof sent to us, the other derives the encryption key that never leaves your device. We are mathematically unable to derive your key from anything we store.
• A pepper — one more secret, kept outside the database entirely, on the server itself.
• AES-GCM (the browser's native `crypto.subtle`) for the content itself — encrypts and detects tampering in one step. A fresh random IV is generated for every single encryption, verified in code, never reused.
• Master-key indirection: your content is encrypted with one random key; that key is itself locked by your password. Changing your password re-locks one small key, never re-encrypts your whole journal.
• Session cookie: `httpOnly` · `secure` · `sameSite=strict` · `__Host-` prefixed · a fresh session ID minted on every login.

This is the same standard verified line-by-line against our running code in our own 47-point security review (Section 12 below), not just described in a design document.

5. What we can see about how you use the app

We keep two very different kinds of telemetry, and we'd rather name both plainly than let you assume the friendlier one covers everything:

• Always on, and disclosed here — the bare minimum for the app to work and for us to know it's working: crash and error reports (no content, no personal data in them), and which module you opened and what action you took, tied to your account and a timestamp. This is not aggregate-only — it's a real, per-account record, and we'd rather say that plainly than let "we can't see your writing" be misread as "we can't see anything about you at all."
• Opt-in, off by default, and nothing like this exists yet: anything beyond raw usage counts — behavioural patterns, scores, product-analytics events. If we ever build something in this category, it asks first. Nothing today falls into it.

Either way: no session replay, ever. No device fingerprinting. No third-party analytics, tracking, or advertising vendor anywhere in this app — telemetry goes to our own server only. Your IP address is never saved by the app: it's held in memory for at most an hour to stop login abuse, then dropped.

Technical detail — exactly what's captured

Crash/error telemetry: app version, module name, device category, error message, and a stack trace — nothing from a request body, nothing decrypted. Usage telemetry: your account ID, the module, the action, and a timestamp — stored as a real, individually-queryable row, not a pre-aggregated counter, because that's what the field actually is in the database and we'd rather say so than round it down to something friendlier.

6. Cookies

We use a single essential session cookie to keep you logged in. We do not use tracking or advertising cookies. See our Cookie Policy for details.

7. Sharing your data

We do not sell, rent, or trade your personal data. We may disclose data only if required by law, or to protect the rights, safety, and security of our users and the Service — and what we could hand over is the plain account data in Section 2; your writing would still be unreadable ciphertext.

A few service providers are part of how Awaken works, and we'd rather name them than hide them:

• Cloudflare — our network provider. All traffic to Awaken passes through Cloudflare on its way to our server; your writing is already encrypted when it does.
• Google / Apple — only if you choose "Sign in with Google" or "Sign in with Apple" where the app offers it: they confirm who you are. They never see your journal.

Purchases and contributions in Awaken Journal are handled entirely by Google Play (Android) or Apple's App Store (iPhone), under that store's own privacy policy. We never receive your card, UPI, or bank details, and we do not share your journal content, tasks, or notes with Google, Apple or anyone else.

8. How long we keep it, and what deleting actually does

You can delete your account, or just wipe your data and keep the account, at any time from Settings. It happens immediately — not on a schedule, not with a grace period.

Technical detail — what "delete" actually removes, verified against the code

Deleting your account runs a real, synchronous deletion — not a flag on a row. Every content table (entries, notes, finance, to-dos, reviews) and every account-linked table (sessions, push subscriptions, usage history) is removed. Feedback and support messages you sent us, your waitlist/invite email, and any Notes Sync copy on our server are deleted too. One narrow, deliberate exception, stated honestly rather than left for you to discover: anonymised crash reports survive with your account link removed (no identity, no content — kept so a bug bad enough to make someone leave is still worth reading). Our server's own backups (encrypted, nightly) keep only the last 3 nights — so a deleted account is gone from every backup within 3 nights. Plain note copies you chose to keep on your own device or Drive are yours: deleting your Awaken account can't reach them, so delete those yourself if you want them gone.

9. Your rights

You have the right to:

• Access — ask what personal data we hold about you.
• Take it with you — export your full account as a file, whenever you want, from Settings.
• Correct — ask us to fix inaccurate data.
• Delete — erase your data yourself, immediately, from Settings (see Section 8), or ask us to.
• Withdraw consent — at any time, for anything you consented to.

To exercise any of these, email reet@everythingawaken.com and we'll respond within a reasonable time.

Technical detail — where this stands against India's DPDP Act

Stated honestly, not rounded up — an open item here matters more than a claim that doesn't hold:

• ✅ Data minimisation and purpose limitation — architectural, checked against Section 2's table, not a policy choice.
• ✅ Right to erasure and data portability — both are real, working features in the app today (Section 8, Section 9), not promises.
• 🟠 Decided, not finished: the minimum age is 14 (Section 10). DPDP treats everyone under 18 as a child needing verifiable parental consent once its rules apply in full (13 May 2027). Today we ask; before that date we will either verify a parent's consent for 14–17-year-olds or raise the minimum age to 18.
• 🔴 Still open: the exact timeline for notifying a data breach. We're not going to claim it's settled before it is — this page will update the day it closes.

10. Children

Awaken is for people 14 and older. If you're 14–17, please use it only with a parent's or guardian's permission. If we learn that someone under 14 has an account, or that a 14–17-year-old is using it without permission, we will remove the account and its data. Parents and guardians can contact us at any time to review or remove their child's data.

11. Keep your own copy

Awaken Journal runs on the web and in our Android and iPhone apps. We take reasonable care, but like any software, faults we don't foresee can lose, reset, or change data. Please don't rely on it as your only copy of important information — export a backup from Settings now and then.

12. Security, in one paragraph

Your password never reaches us. Your encryption key never leaves your device. We run per-account login protection, rate limiting on every write, weekly automated dependency scanning, and a public channel for security researchers to report problems responsibly — checked in our own 47-point internal security review against OWASP's Application Security Verification Standard and verified against our running code (last re-checked 1 October 2026). It is an internal review: no outside firm has audited Awaken yet, and we'll say so here until one has. The full, human-readable story — with the "don't take our word for it, check yourself" section — is at Your Data Stays Yours, and every rule and all 47 controls are in The Awaken Journal Standard.

13. Changes to this policy

As Awaken grows, we may update this policy. We'll change the "last updated" date above, and for significant changes we'll email account holders.

14. Contact

Questions, requests, or grievances? Email reet@everythingawaken.com. We read every message.