Inside the App

Designed for
your most private moments

What Makes diAry Different

Every feature built
around your privacy

New — Conversation Mode

It listens. It thinks.
It talks back.

A live, spoken conversation with your AI companion — a real back-and-forth that listens, thinks, and answers. Because some nights, the page isn't enough.

New — diAry Online

Your diary,
at your desk

Plans & Pricing

Start free.
Stay as long as you like.

No credit card required to start. No pressure. Just your journal.

How it works

The Day 8 Experience

"That was your last one."

On Day 8, your AI companion delivers one final response — the most personal thing it's ever said to you. After that, the upgrade gate appears. It's not a paywall. It's a moment. And you'll know exactly what diAry means to you.

Getting Started

Up and writing
in minutes

See diAry in Action

Feel the experience
before you download

The diAry Blog

Words worth
keeping

Get the App

Your safe space is
waiting for you

Download diAry today and begin the most intimate conversation you've ever had — with yourself.

Legal

Privacy Policy

Last updated: June 17, 2026 | Version 2.1 — GMX Quantum LLC

Introduction and Scope

GMX Quantum LLC ("we," "our," or "us") operates the diAry mobile application (the "App" or "Service"). We are committed to protecting your privacy and handling your personal information with transparency and care.

This Privacy Policy explains what information we collect and why, how we use, store, and protect your information, your rights regarding your personal data, and how to exercise those rights.

By using diAry, you acknowledge that you have read, understood, and agree to this Privacy Policy. If you do not agree, you must immediately cease using the Service and delete the App from your device.

Legal Basis for Processing (GDPR/CCPA Compliance)

We process your personal data under the following legal bases:

• Contractual Necessity (GDPR Article 6(1)(b)): To provide the diAry Service you have requested, process your subscription payments, and deliver AI transcription and response features.
• Legitimate Interests (GDPR Article 6(1)(f)): To improve the App and develop new features, ensure security and prevent fraud, and analyze usage patterns (anonymized data only).
• Consent (GDPR Article 6(1)(a)): To send marketing communications (if you opt in) and to use optional features requiring consent.
• Legal Obligation (GDPR Article 6(1)(c)): To comply with applicable laws and regulations and respond to lawful requests from authorities.

CCPA Business Purpose (California Users): We collect and process personal information for providing and maintaining the Service, processing transactions and managing subscriptions, detecting and preventing security incidents and fraud, debugging and repairing errors, improving and developing the Service, and complying with legal obligations.

Information We Collect

Information You Provide Directly:

• Account Information: Email address (required), first name (required), last name (required), password (stored as a salted PBKDF2-SHA256 hash — never stored in plain text).
• Journal Content (User Content): Text journal entries, voice recordings (if you use voice transcription), handwriting samples (if you use handwriting features), mood selections and emotional tracking data, timestamps and metadata associated with entries.
• Subscription and Payment Information: Subscription tier selected (monthly or annual). Payment information is processed by RevenueCat and your device's native payment system (Apple App Store or Google Play Store). We do NOT store your credit card numbers, CVV codes, or full payment credentials.
• Communications: Email correspondence, support ticket information, feedback and bug reports.
• Security Event Data (ICE Cam): If a failed or unauthorized access attempt is detected on your account, our ICE Cam security feature may capture a photo from the device camera, a timestamp, device and network details (including IP address, user agent, and a device fingerprint), and location information (approximate location derived from IP, and GPS coordinates where available). This data is logged to your security history and sent to you as a security alert.

Information Collected Automatically:

• Device Information: Device type and model, operating system and version, unique device identifiers (anonymized), app version.
• Usage Data (Anonymized): Features used within the App, session duration and frequency, error logs and crash reports, performance metrics. Note: Usage data is anonymized and aggregated. We cannot link this data to your individual Account.
• Network Information: IP address (anonymized for analytics, full IP for security purposes only), general location (country/region/city level, derived from IP address), network connection type (Wi-Fi, cellular).

Information We Do NOT Collect:

We explicitly DO NOT collect: Social Security Numbers or government identification numbers, financial account numbers (bank accounts, credit cards), biometric templates used for identification (such as stored fingerprint or face-recognition data), health information (HIPAA-protected health data), sexual orientation or gender identity, race, ethnicity, or religious beliefs, political opinions or affiliations, or information about children under 18 years of age. Note: location data, including GPS coordinates where available, is collected only in connection with ICE Cam security events as described above, and is not used for tracking or advertising.

How We Use Your Information

Core Service Provision: We use your information to create and maintain your Account, store and synchronize your journal entries across your devices, process voice transcription requests through OpenAI's Whisper API, generate AI Companion responses and emotional analysis through Anthropic's Claude API (with OpenAI's GPT-4 used as a fallback provider), generate spoken AI voice responses through OpenAI's text-to-speech service, enable Burn Mode and automatic entry deletion, export journal entries (PDF, text, or JSON), manage your diAry Elite subscription, process payments through RevenueCat, send subscription renewal reminders, handle refund requests, authenticate your login, send account verification emails, and process password reset requests.

Service Improvement and Development: We use anonymized, aggregated data to analyze usage patterns and identify popular features, identify and fix bugs and technical issues, develop new features and improve existing ones, optimize app performance and user experience, and conduct A/B testing of new features. We do NOT use your individual journal content for these purposes.

Communication: We may send you transactional emails (account verification and password reset emails, subscription renewal and payment confirmations, critical security alerts, important updates to Terms of Service or Privacy Policy, customer support responses) which you cannot opt out of, as they are necessary to provide the Service. We may also send marketing emails (product updates and new feature announcements, tips for using diAry effectively, special offers or promotions) which you can opt out of at any time by clicking "Unsubscribe" in any marketing email, adjusting email preferences in your Account settings, or contacting [email protected].

AI Processing and Third-Party Services

Voice Transcription (OpenAI Whisper API): When you record a voice journal entry, the audio file is sent to OpenAI's Whisper API for transcription. OpenAI processes the audio and returns text transcription. Audio data is transmitted over encrypted connections (HTTPS/TLS).

AI Companion Responses and Emotional Analysis (Anthropic Claude API, with OpenAI fallback): When you request an AI response or emotional analysis, your journal entry text is sent to Anthropic's Claude API to generate the response. If the Anthropic service is unavailable, your text may instead be sent to OpenAI's GPT-4 API as a fallback. Journal content is transmitted over encrypted connections (HTTPS/TLS).

AI Voice / Text-to-Speech (OpenAI): When you use spoken AI voice responses, the text to be spoken is sent to OpenAI's text-to-speech service to generate the audio.

Data Handling by AI Providers: We send only the content necessary to provide these features. Our use of Anthropic and OpenAI is governed by their API terms, under which submitted content is not used to train their models. We do not control these third parties' practices and encourage you to review their respective policies.

Third-Party Service Providers: We use Anthropic (AI responses and analysis), OpenAI (voice transcription, AI fallback, and text-to-speech), Amazon Web Services/AWS (cloud hosting and database), RevenueCat (subscription management), Apple App Store (payment processing for iOS), and Google Play Store (payment processing for Android).

Your Control Over AI Processing: You can control AI processing by not using voice transcription features (type journal entries manually), not requesting AI Companion responses (journal without AI assistance), and not using spoken AI voice responses. If you do NOT use AI features, your journal content is NOT transmitted to third-party AI services.

Data Sharing and Disclosure

We Do NOT Sell Your Personal Information: GMX Quantum LLC does NOT sell, rent, or trade your personal information to third parties for monetary or other valuable consideration. This prohibition applies to all users, including California residents under CCPA.

When We Share Your Information: We share your personal information only in limited circumstances: with your consent, with service providers (AWS, Anthropic, OpenAI, RevenueCat - these providers are contractually obligated to use your data only to provide services to us, maintain appropriate security measures, comply with applicable data protection laws, and delete or return data upon termination of services), for legal obligations (in response to valid subpoenas, court orders, or search warrants, lawful requests from law enforcement or government agencies, legal processes requiring disclosure), to protect rights (to investigate, prevent, or take action regarding illegal activity, enforce our Terms of Service, protect the rights, property, or safety of GMX Quantum LLC, our users, or the public, defend against legal claims or lawsuits), and in business transfers (if GMX Quantum LLC is involved in a merger, acquisition, bankruptcy, or sale of assets, your information may be transferred to the acquiring entity).

Aggregated and Anonymized Data: We may share aggregated, anonymized data that cannot identify you individually, such as overall app usage statistics, anonymized feature adoption rates, and aggregated mood tracking trends. This data does not constitute "personal information" under GDPR or CCPA.

Data Retention and Deletion

We retain your personal information for the following periods: Account Information (until you delete your Account + 30 days), Journal Entries (stored on our cloud infrastructure and synced to your devices until you delete them, or until you delete your Account + 30 days), Burn Mode Entries (automatically deleted after the time period you specify), Subscription Data (7 years - required for tax/accounting compliance), Payment Transaction Records (7 years - required for tax/accounting compliance), Customer Support Emails (3 years), Security Logs (90 days), and Anonymized Usage Analytics (indefinitely - cannot be linked to you).

Account Deletion: You may delete your Account via the App (Settings → Account → Delete Account, confirm deletion by entering your password - your Account and cloud-stored data will be deleted within 48 hours) or via email (send a request to [email protected] with subject "DELETE MY ACCOUNT" - we will process your request within 30 days).

What Happens When You Delete Your Account: Immediately deleted (within 48 hours): your email, name, and Account credentials, all cloud-stored journal entries, all mood tracking data stored on our servers, your subscription status (subscription will be canceled). Deleted within 30 days: backup copies stored for disaster recovery, cached data in content delivery networks. NOT deleted (legal/regulatory requirements): transaction records (subscription payments) - retained for 7 years for tax compliance, anonymized usage analytics (cannot be linked to you), communications with customer support (retained for 3 years). Cannot be deleted: data you stored locally on your device - you must manually delete the app and clear app data.

Burn Mode – Automatic Deletion: When you enable Burn Mode for journal entries, entries are permanently and irreversibly deleted after the specified time period, deleted entries are removed from both local storage and cloud storage (if applicable), and we cannot and will not recover Burn Mode entries under any circumstances.

Data Security Measures

We implement industry-standard security measures to protect your information:

Encryption: In Transit (all data transmitted between your device and our servers is encrypted using HTTPS/TLS), At Rest (journal entries stored on our AWS database are encrypted at rest using AES-256 storage encryption), Passwords (stored using salted PBKDF2-SHA256 hashing - never stored in plain text).

Access Controls: Role-based access control (RBAC) for internal systems, multi-factor authentication (MFA) for administrative access, and the principle of least privilege (employees access only data necessary for their role).

Network Security: Firewalls and intrusion detection, DDoS protection via AWS infrastructure, and rate limiting on sensitive endpoints.

Application Security: JWT (JSON Web Token) authentication with expiration, rate limiting to prevent brute force attacks, input validation and sanitization to prevent injection attacks, and secure coding practices. An independent third-party security review has been performed on the Service.

Device-Level Security (Your Responsibility): Ghost Mode (helps prevent screenshots and screen recordings within the app), Biometric Authentication (support for Face ID, Touch ID, or fingerprint if you enable it), and device-level protections provided by your operating system.

Limitations of Security – Important Disclaimer: No security system is impenetrable. We cannot guarantee absolute security. Despite our security measures, unauthorized access, hacking, data breaches, or security incidents may occur. You are responsible for choosing a strong, unique password, securing your device with a passcode/biometric lock, not sharing your account credentials, installing security updates for your device OS, using antivirus/anti-malware software, and being vigilant against phishing attacks.

Your Privacy Rights

Regardless of your location, you have the following rights: Right to Access (request a copy of all personal information we hold about you), Right to Correction (correct inaccurate or outdated personal information - update directly in Settings → Profile), Right to Deletion (request deletion of your personal information via [email protected] or delete Account via app), Right to Object (object to processing of your personal information for direct marketing - opt out by clicking "Unsubscribe" in marketing emails), and Right to Data Portability (request a machine-readable copy of your journal entries - you can export to PDF, text, or JSON directly in-app).

How to Exercise Your Rights: Contact us at [email protected] with subject line "PRIVACY REQUEST – [Your Request Type]" and include your full name, email address associated with your Account, and specific request details. Response Time: We will respond within thirty (30) days of receiving your request.

California Privacy Rights (CCPA)

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with additional privacy rights including Right to Know (request disclosure of categories and specific pieces of personal information collected, request disclosure of sources, purposes, and third parties with whom we share data), Right to Delete (request deletion of personal information we have collected - subject to legal exceptions), Right to Opt-Out of Sale (We do NOT sell personal information, so no opt-out is necessary), and Right to Non-Discrimination (we will not discriminate against you for exercising your CCPA rights - we will not deny service, charge different prices, or provide different quality of service).

How to Exercise CCPA Rights: Email [email protected] with subject line "CCPA REQUEST – [Right to Know / Right to Delete]" and include your full name, email address associated with your Account, California residency confirmation, and specific request details. Response Time: We will respond within forty-five (45) days (extendable to 90 days if complex).

European Privacy Rights (GDPR)

If you are in the European Economic Area (EEA), United Kingdom, or Switzerland, the General Data Protection Regulation (GDPR) provides you with additional privacy rights including Right of Access (Article 15), Right to Rectification (Article 16), Right to Erasure/"Right to Be Forgotten" (Article 17), Right to Restriction of Processing (Article 18), Right to Data Portability (Article 20), Right to Object (Article 21), Right to Withdraw Consent (Article 7), and Right to Lodge a Complaint (file a complaint with your local supervisory authority/Data Protection Authority).

How to Exercise GDPR Rights: Email [email protected] with subject line "GDPR REQUEST – [Specific Right]". Response Time: We will respond within one (1) month (extendable to 3 months if complex).

Children's Privacy

diAry is intended solely for users who are 18 years of age or older. We do NOT knowingly collect, solicit, or maintain personal information from individuals under 18 years of age.

COPPA Compliance (United States): We do not knowingly collect personal information from children under 13, we do not direct the Service to children under 13, and we do not knowingly allow children under 13 to create accounts.

Parental Notice: If you are a parent or legal guardian and believe your child under 18 has created an Account, immediately contact us at [email protected] with subject line "UNDERAGE ACCOUNT – DELETE IMMEDIATELY". We will delete the Account and all associated data within forty-eight (48) hours of verification.

International Data Transfers

Your personal information may be transferred to, stored, and processed in the United States (AWS servers in us-east-1 region, Virginia) and other countries where our service providers operate. For EU/EEA users, this means your data may be transferred outside the European Economic Area (EEA).

GDPR Safeguards for EU Users: We ensure adequate protection through Standard Contractual Clauses (SCCs) - we use EU-approved Standard Contractual Clauses with AWS and other service providers, Adequacy Decisions (where applicable, we rely on the European Commission's adequacy decisions), and Supplementary Measures (encryption in transit and at rest, access controls and authentication).

Data Breach Notification

In the event of a data breach that affects your personal information, we will notify you within seventy-two (72) hours of discovering the breach (GDPR requirement) via email to your registered email address and via in-app notification, and notify authorities by reporting the breach to relevant supervisory authorities (e.g., EU DPAs, California Attorney General) as required by law.

Breach notifications will include description of the breach (what happened, when, how), categories and approximate number of affected users, categories and approximate number of affected records, likely consequences of the breach, measures taken to address the breach, recommended actions you should take (e.g., change password, monitor accounts), and contact information for further inquiries.

Changes to This Privacy Policy

We reserve the right to modify this Privacy Policy at any time. Material changes that significantly affect your rights will be communicated by updating the "Last Updated" date at the top of this Policy, sending email notification to your registered email address, displaying an in-app notification upon your next login, and providing thirty (30) days' notice before changes take effect.

Continued use of the Service after changes take effect constitutes your acceptance of the modified Privacy Policy. If you do not agree to the modified Privacy Policy, you must stop using the Service and delete your Account.

Contact Information

GMX Quantum LLC
Registered Address: Wilmington, Delaware, United States
Email: [email protected]
Data Protection Officer: [email protected] (Subject Line: "ATTN: DATA PROTECTION OFFICER")

For questions, concerns, or requests regarding this Privacy Policy, contact [email protected] with subject line "PRIVACY POLICY INQUIRY". Response Time: We aim to respond within forty-eight (48) business hours.

Effective Date: June 17, 2026 | Version: 2.1

By using diAry, you acknowledge that you have read, understood, and agree to this Privacy Policy.

Get in Touch

We're here
for you