privacy notice

Draft. Effective on the day the app is first available in the stores. Published at skriblio.com/privacy.

Skriblio is made by STEADY LABS (PTY) LTD, registration 2026/086606/07 ("we"). Questions and requests, including anything for our Information Officer, go to info@skriblio.com and a person answers.

This notice says what we collect, why, where it goes, how long we keep it, and what you can do about it. It is written to match what the app actually does. When the app changes, this changes with it, and the date at the top moves.

Who the app is for

Adults. You must be 18 or older to create an account. If we learn that someone under 18 has an account, we delete it.

What we collect and why

Your account. Your email address, to sign you in with a one time code, Sign in with Apple, or Google, and to reach you about your account. We do not store a password. Apple may give us a private relay address instead of your real one. Google gives us the address on that google account.

Your journal. The text you write, photographs you attach, the date and time of each entry, an optional rating and an optional title. This is the product. We store it so it is there when you come back and so you can search it. If you pair a computer, a page you type or a photo you drop there is the same journal. An unsaved draft stays on that computer until you save or throw it away. The computer never lists the vault.

Transcripts of your photographs. When you attach a photograph of a handwritten page, we send the image to a vision model at Anthropic to turn the handwriting into text, so you can search it. The transcript is stored with the entry. Anthropic processes the image to return the text and, under our agreement with them, does not use it to train models. If you correct a word, that swap stays on this phone and is used only to fix later transcripts on that phone. It is not sent to us or to a model. You can delete a transcript, or delete the photograph, at any time.

Your banana. Which character you picked, the name you gave it, and the date of your last entry. This drives what the banana says and when.

Your circle. If you choose to add friends, we store the names you type and, once a friend accepts, their WhatsApp number, the time they accepted, and the exact wording they agreed to. We use this only to send the notices described in the app: the first after five quiet days, then at most every four days, at most three times in one silence, and one message when you write again. Nothing about the content of your journal is ever sent to anyone.

Your friends' consent. When a friend opens your invite link and accepts, we record their number, the time, the words they agreed to, and a hashed form of their IP address. This is how we prove they agreed. A friend can stop all messages by replying "stop" or by asking you to remove them; both take effect immediately.

Subscription. Purchases go through Apple or Google. We never see your card. RevenueCat, our subscription service, tells us whether your subscription is active and until when. We store that date.

Device and usage. A push notification token so the banana can send you the occasional notice. Product analytics through PostHog and Google Analytics: which screens you open and which buttons you tap, so we can see what is confusing. Google Analytics uses an anonymous id, not your email. Crash reports through Sentry when the app fails. No advertising identifiers, no advertising networks, no selling or sharing of data for advertising, ever.

Care log. A record of what the banana did and when: notices sent to you, messages sent to friends, when it stood down. Shown to you in the app.

Lawful basis (for readers in the EU and UK)

Performance of a contract for the journal, account, subscription and circle features you asked for. Consent for cloud transcription (a card asks once, before a photograph leaves the phone for a model, if this phone cannot read it), for push notifications, and, on your friend's side, for receiving messages. Legitimate interest for crash reporting and product analytics, which you can object to by emailing us.

Where your data lives

Our database and file storage are with Supabase in Frankfurt, Germany. Images sent for transcription go to Anthropic in the United States for the duration of the request. RevenueCat, Expo (push delivery), PostHog and Sentry are in the United States or the EU depending on region; see the processor list at skriblio.com/privacy/processors. Transfers out of South Africa and the EU rest on those providers' standard contractual clauses and data processing agreements.

Who sees your data

Us, to run the service and to help you when you write in. The processors above, each only for their one job. Nobody else, unless the law compels us, in which case we tell you if we are allowed to.

How long we keep it

Your journal, for as long as your account exists. Deleted entries are removed from your view immediately and purged from our database and storage within 30 days. Friend numbers, until you remove the friend or they stop, then purged after 30 days. Consent records, for as long as the friend is in your circle and 30 days after. Analytics events, 12 months. Crash reports, 90 days. When you delete your account, everything above is deleted, photographs first, then the account, which removes every row that belongs to it. Backups roll off within 30 days.

Your rights

You can export everything from inside the app (You, then Export) and from the subscription screen even after the trial ends. You can delete your account from inside the app; it is immediate and complete. You can ask us to correct something, to stop analytics for your account, or to tell you exactly what we hold, by emailing info@skriblio.com. We answer within 30 days. If you are unhappy with our answer you may complain to the Information Regulator of South Africa or, in the EU and UK, to your local supervisory authority.

Security

Data is encrypted in transit and at rest. Your journal is not end to end encrypted: our servers can read it, because transcription and search need to. Access is limited to the service and to the director of the company for support you ask for. You can lock the app with Face ID, Touch ID, or your device's equivalent.

Children

The service is for adults. We do not knowingly collect information from anyone under 18.

Changes

We post changes here with a new date and, for anything that changes what we collect or why, we tell you in the app before it applies.

also here: privacy, terms, processors. questions to info@skriblio.com.