privacy notice

Last updated 26 October 2026. Published at skriblio.com/privacy.

Skriblio is made by STEADY LABS (PTY) LTD, registration 2026/086606/07 ("we"). Questions and requests, including anything for our Information Officer, go to info@skriblio.com and a person answers.

The short version. Your journal is encrypted on its way to our servers and while it's stored there. We never sell it or use it for advertising, and it is never used to train AI. A friend only sees a page you choose to send them. You can lock your vault with Face ID or a fingerprint, export everything at any time, and deleting your account deletes your journal.

This notice says what we collect, why, where it goes, how long we keep it, and what you can do about it. It is written to match what the app actually does. When the app changes, this changes with it, and the date at the top moves.

Who the app is for

Age. You must be 16 or older to create an account. If we learn that someone under 16 has an account, we delete it. People aged 16 and 17 get the same defaults as everyone: their pages are private, there are no advertisements, and nothing about them is profiled or used to choose what they see.

What we collect and why

Your account. Your email address, to sign you in with a one time code, Sign in with Apple, or Google, and to reach you about your account. We do not store a password. Apple may give us a private relay address instead of your real one. Google gives us the address and the name on that Google account, and we keep both with your sign in.

Your journal. The text you write, photographs you attach, drawings you make, voice notes you record, the date and time of each entry, an optional rating, an optional title, and which of them you added to your favourites. This is the product. We store it so it is there when you open skriblio again and so you can search it. When you search your journal, the words you search for go to our server to find the pages; we don't keep them, apart from the server's own request logs, which are deleted within 7 days. If you connect a computer, a page you type there is part of the same journal, and we store the computer's name so you can tell your connected computers apart. An unsaved draft stays on that computer until you save or throw it away. The computer never lists the vault.

Typed up photographs. When you attach a photograph of a handwritten page and you have said yes on the card the app shows once, we send the image to a vision model at Anthropic to type up the handwriting, so you can search it. If you haven't said yes, your phone reads the page where it can and the image is not sent. On Android your phone reads a page with Google's ML Kit text recognition, which is part of the app and runs on the phone: the picture and the words it reads are not sent to Google or to us for that. ML Kit does send Google usage metrics, such as the kind of device, the app, how long a read took, the size of the picture and error codes, and there is no setting to switch that off. The typed up text is stored with the entry. Anthropic processes the image to return the text and, under our agreement with them, does not use it to train models. If you correct a word, that swap stays on this phone and is used only to fix later typed up text on that phone. It is not sent to us or to a model. You can delete the typed up text, or delete the photograph, at any time.

A copy on your phone. So the vault opens without a signal, the app keeps a copy of your recent entries and your memory tree on your phone, inside the app's own storage, which the phone encrypts while it is locked. It is replaced each time the vault loads and removed when you sign out.

Voice notes. A voice note is stored exactly as you recorded it, with your journal. If you ask for one to be typed up, your phone does it with its own speech recognition, and the recording is not sent to us or to anyone else for that. On Android 13 and later the app asks the phone's recognizer to work on the phone only, and only offers to type a voice note up when the phone has that language installed; Android installs the language itself, and the app sends no audio anywhere for it. So that typing up works without a connection, the app also keeps a copy of each recording you make on this phone, inside the app. That copy is removed when you delete the voice note, when its entry is deleted for good, and when you sign out or delete your account. The typed words are stored with the entry so you can search them. You can remove the typed words, or delete the voice note, at any time.

Your banana. Which character you picked, the name you gave it, and the date of your last entry. This drives what the banana says and when. The kind of entry you saved each day (typed, photograph, voice note or drawing) is kept on your phone only, so your banana's world can answer it. It is not sent to us, and never to analytics.

Widgets. The home screen widgets show your banana, a prompt, the days you journaled this week and, from your favourites, a page or a photo from your memory tree. To draw them, the app keeps that small amount of information in storage on your phone that only the app and its widgets can read.

The desktop companion. To walk around your screen and keep out of the way during calls, the companion looks, on your computer, at where other windows are, which app each one belongs to (never their titles or what is in them), and whether the camera or microphone is in use. None of that leaves your computer. The companion updates itself. When it starts, and then about once a day, it asks skriblio.com whether a newer version exists. The request carries only the companion's own version, your operating system and its processor type, and nothing about you or your journal. A newer version is downloaded in the background, its signature is checked against our public key (a package that fails the check is thrown away), and it is put in the next time the companion starts. Older builds that cannot update themselves ask for a version number twice a day and offer a download link.

Subscription. Purchases go through Apple or Google. We never see your card. RevenueCat, our subscription service, tells us whether your subscription is active and until when, and we store that date. RevenueCat receives your account id and an identifier for your device, so a purchase can be matched to your account.

Device and usage. Product analytics through PostHog and Google Analytics: which screens you open, how you opened the app (from the icon, a widget or a reminder) and how smoothly the worlds draw (a bucket of slow frames in one minute), which buttons you tap, which prompt you used (a few prompts about hard days are counted only as "other"), how you rated a day, how long a voice note was, which first week step you finished and how many days in, whether a purchase was the free weeks, and which of our reminder and friend screens you saw and what you answered. No analytics field says what kind of entry a save was. Never your words, your photographs or what a voice note says. PostHog links these events to your account id, and its location lookup is switched off. Google Analytics uses a random id instead of your account, and works out an approximate location, such as the city, from your connection without keeping the IP address. Each of these services keeps a random id for your install. Crash reports through Sentry when the app fails, scrubbed on the phone of journal text and email, and stored without your IP address. The app sends no push notifications from a server and stores no push token. Our own ads. We advertise skriblio on Instagram, and to see which ads work, the iPhone and Android apps include Meta's software development kit. It tells Meta that the app was installed and opened, with an anonymous id for your install, and RevenueCat tells Meta when a free trial starts or a plan is paid for, with that same anonymous id. Meta uses this to count results for our ads. The app never asks to track you and never reads your advertising identifier: on iPhone Meta only gets what Apple allows without that permission, and on Android the app does not hold the advertising id permission at all. Nothing you journal, no photographs, no voice notes and not your email ever go to Meta. We don't show ads in the app and we never sell your data.

Reminders. Reminders are optional and off unless you choose them. The app asks once during your first run, and again after a save if you have not answered; either way, nothing is set until you pick how often, and "not now" sets nothing. They are made on your phone by the phone itself, on a schedule it keeps, so nothing is sent to a server and no push token is stored. A reminder holds a line from the banana or a prompt to try, and never anything from your journal. If you choose the time it learns, the app keeps the time of day of your recent saves, on your phone only, to find the hour you usually journal. Choosing no reminders in the app clears the list. Notifications need your phone's permission, which you can withdraw in its settings at any time.

Friends. If you journal with friends, we keep your own name if you set one, the first name you typed for each friend, your banana, who you journal with, a hashed copy of each open invite (never the link) and when each was made. Each invite also has a friend code, four letters taken from the name you typed and three random digits, such as JACO 482. The current app only uses the link, but we still make a code so a friend on an older version of the app can type it instead, and it is removed when the invite is used, cancelled or expires. A code is a small secret, so we count wrong codes (the person who typed them, and when) for two days at most and stop a person after about ten wrong ones in an hour. A friend who opens your link, or types a code, sees your banana and the name you typed on the invite before they say yes, and nothing else; the server answers with those two things and no others. Your friends' apps can learn if you've journaled today, worked out from your pages' dates in your own time zone, and, only when you have both been away a while, that you both have. They see your banana and your own name. We never share a page, a title, a photo, a time or how many days. All of it is deleted when journaling together ends (an ended one is kept until you've both seen it, thirty days at most) or when you delete your account. Pages sent to a friend. If you choose to send a page to a friend you journal with, we make one copy of that page for them: its title and words, its doodle, its first photo and its first voice note if it has them, the short line you add, and the first name you typed for yourself in that friendship. The copy is stored in a private folder that only your friend can read, and it has no link back to your page, so editing or deleting your page changes nothing on their side. Your friend sees that one page and nothing else from your journal. We keep when it was sent, when your banana delivered it, when your friend took it off their tree and, if they reported it, when and why. No notification is sent: your friend finds out the next time they open skriblio. When your friend takes a page off their tree, we delete the copy at once. If they report it, we keep the copy so it can be reviewed, and delete it once the report is dealt with. A friend can block you, and then nothing more reaches them from you. You can send each friend one page a week. A page you sent is deleted when you delete your account or when your friend deletes theirs.

Journal school and your first week. Journal school progress and your first week (six steps: write, pick a world, start from a prompt, try a way to journal, record a voice note, scan a page or take a photo), each with the day it was first done, are kept on your account so a new phone has them. They hold step names and dates only, never a prompt or what you wrote. They are in your export and deleted with your account.

Care log. A short record of what the banana did and when, such as the day you came back after a quiet spell. It is included when you export your journal.

Lawful basis (for readers in the EU and UK)

Performance of a contract for the journal, account and subscription features you asked for. Consent for typing up photographs in the cloud (a card asks once, before any photograph leaves the phone for a model). Legitimate interest for crash reporting and product analytics, which you can object to by emailing us.

Where your data lives

Our database and file storage are with Supabase in Frankfurt, Germany. Images sent to be typed up go to Anthropic in the United States, which returns the text, does not train on them, and keeps inputs only for a limited time for safety and abuse checks. Sign in emails are sent through Resend. RevenueCat, PostHog, Google Analytics, Sentry and Meta are in the United States or the EU depending on region; see the processor list at skriblio.com/privacy/processors. Transfers out of South Africa and the EU rest on those providers' standard contractual clauses and data processing agreements.

Who sees your data

Us, to run the service and to help you when you write in. The processors above, each only for their one job. Nobody else, unless the law compels us, in which case we tell you if we are allowed to.

How long we keep it

Your journal, for as long as your account exists. Deleted entries are removed from your view immediately, wait 30 days in recently deleted, and are then purged from our database and storage. Friends: an open invite and its friend code until it is used, cancelled or seven days pass; wrong friend codes, two days; a friendship until either of you ends it, then until you've both seen that, thirty days at most. Pages sent to a friend: until your friend takes them off their tree, a reported page until its report is dealt with, and every one of them when either of you deletes an account. The record that one was sent, for the weekly limit, stays for as long as both accounts exist. Journal school and first week records, for as long as your account exists. Server request logs, 7 days. A downloaded companion update, until it is put in or replaced. Analytics events, 12 months. Crash reports, 90 days. When you delete your account, everything we hold is deleted, your stored files first (photographs, voice notes and drawings), then the account, which removes every row that belongs to it. Backups roll off within 30 days. Our processors delete what they hold on their own schedules: analytics events within 12 months, crash reports within 90 days, and the stores and RevenueCat keep purchase records as the law and their rules require.

Your rights

You can export everything from inside the app ('you', then 'settings', then 'export data'), with or without a subscription; without one, 'export data' is on the plans page. You can delete your account from inside the app, and it is immediate. If you no longer have the app, write to info@skriblio.com from the address you sign in with and we delete it within 30 days; skriblio.com/delete-account says how, and how to delete only some of it. You can ask us to correct something, to stop analytics for your account, or to tell you exactly what we hold, by emailing info@skriblio.com. We answer within 30 days. If you are unhappy with our answer you may complain to the Information Regulator of South Africa or, in the EU and UK, to your local supervisory authority.

Security

Your journal is encrypted in transit and at rest. It is not end to end encrypted, because searching your pages and typing up your handwriting happen on our server. Access is limited to the service itself, and to the director of the company only for support you ask for. You can put your vault and your pages behind Face ID, Touch ID, or your device's equivalent; home and your banana stay open.

Children

The service is for people aged 16 and over. We do not knowingly collect information from anyone under 16.

Changes

We post changes here with a new date and, for anything that changes what we collect or why, we tell you in the app before it applies.

also here: privacy, terms, processors. questions to info@skriblio.com.