Calmline – Privacy Policy
Last updated: 8 October 2026
1. Who we are
Calmline is a private one-line-a-day journal for Android, published by Miranda Gutarra, Alvaro, Belgium (“we”, “us”). We are the data controller for the limited data described below. Contact: homeboyassets@gmail.com.
2. The short version
- Your journal entries, moods and settings stay on your phone, encrypted. We never receive them and there is no Calmline account or server.
- The app shows ads and uses basic analytics and crash reporting. These services process a few technical identifiers, described in section 4.
- Where the law requires your consent (for example in the EEA and the UK), personalised ads and analytics only start after you agree. If you refuse, you may still see limited, non-personalised ads, and analytics stays off. You can change your choice at any time in Settings.
3. Data that stays on your device
Journal text, the mood you pick, entry dates, your reminder time, your language choice and, if you enable it, your app-lock code are stored only in the app’s private storage on your phone. The journal and settings databases are encrypted with AES-256; the encryption key is kept in the Android Keystore. The app-lock code is stored only as a one-way hash. The daily reminder is scheduled locally on your phone; it does not use a push-notification server.
If you use Export my data, the app creates a file and opens Android’s share sheet. Where that file goes is your choice; we do not receive it. Calmline includes its fonts inside the app and does not contact Google Fonts.
Uninstalling the app or clearing its storage deletes all of this data. We cannot recover it for you.
4. Data processed by third-party services
Calmline contains the following SDKs. They transmit data from your device to their providers.
| Service | Data | Purpose |
|---|---|---|
| Google AdMob (Google Mobile Ads SDK) | IP address, Android advertising ID and other device identifiers, ad interactions, diagnostics | Showing ads, ad measurement, fraud prevention |
| Google consent form (User Messaging Platform) | Your consent choices | Asking for and recording your consent |
| Firebase Analytics | App-instance ID, advertising ID, approximate location derived from IP, app usage events (for example, “an entry was saved”, without its content) | Understanding how the app is used so we can improve it |
| Firebase Crashlytics | Crash reports, device model and OS version, an installation identifier | Finding and fixing crashes |
| RevenueCat and Google Play Billing | Anonymous app user ID, purchase history for the one-time “Premium” purchase | Processing and restoring your purchase. Payment details are handled by Google Play; we never see them |
None of these services receives your journal text or moods. The providers act under their own terms and privacy policies: Google (AdMob, Firebase), Firebase and RevenueCat.
5. Consent and your choices
- On first launch, where required, Google’s consent form lets you accept or refuse personalised ads and the use of identifiers. You can reopen it later from Settings → Privacy options.
- You can reset or delete your Android advertising ID in Android Settings → Privacy → Ads.
- You can remove ads by buying Premium inside the app.
6. Legal bases (GDPR)
- Consent (Art. 6(1)(a)) for advertising and analytics identifiers where required. You can withdraw it at any time, which does not affect earlier processing.
- Legitimate interest (Art. 6(1)(f)) for crash reporting, to keep the app stable and secure, and for limited, non-personalised ads if you refuse consent.
- Contract (Art. 6(1)(b)) for processing and restoring your purchase.
7. Retention
Data on your device is kept until you delete it. Data held by the providers in section 4 is kept according to their own retention settings and policies. We do not build user profiles and cannot identify you from the identifiers we receive.
8. International transfers
The providers above may process data outside the European Economic Area, including in the United States. They rely on safeguards such as the EU–US Data Privacy Framework or Standard Contractual Clauses.
9. Your rights
Under the GDPR you may request access, rectification, erasure, restriction, portability, and object to processing, and you may withdraw consent at any time. Because we cannot link the identifiers we receive to you unless you tell us your advertising ID or app-instance ID, we may ask you for it to act on a request. Write to homeboyassets@gmail.com. You also have the right to lodge a complaint with the Belgian Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit) or your local authority.
10. Children
Calmline is not directed at children and is intended for people aged 18 and over. If you believe a child has used the app, contact us.
11. Not medical advice
Calmline is a personal journal and mood check-in. It is not a medical device and does not diagnose, treat or prevent any condition, and it is not a substitute for professional care. If you are in crisis, contact your local emergency services.
12. Changes
If we change this policy, we will update the date above and, for significant changes, tell you in the app.
13. Contact
Miranda Gutarra, Alvaro – homeboyassets@gmail.com