WithinPrivacy Policy
Last updated: November 11, 2026
This policy explains what information the Within mobile app ("Within", "the app") collects, how it is used and shared, and the choices you have. Within is published by Brice-Yazid Aminou, a sole proprietor based in Québec, Canada ("we", "us").
1. The short version
- Your journal is stored on your phone. You can use Within without an account.
- If you sign in, your journal is backed up to our cloud database so you can restore it.
- We use analytics, including screen recordings of app sessions, to understand how Within is used and to improve it. These recordings can include what is shown on screen, including text you type in the app.
- We don't sell your information, we don't show ads, and we don't use your journal to train AI models.
2. Information we collect
| What | When | Why |
|---|---|---|
| Journal content: moments, emotions, thoughts, notes, reflections, body sensations and related entries | Always stored on your device. Copied to our cloud database only if you sign in. | To provide the journal and, if you sign in, to back it up and restore it. |
| Account information: your email address, name (if shared) and an account identifier from Sign in with Apple or Google | Only if you choose to sign in. | To create your account and link your backup to it. |
| Usage data: screens viewed, features used, taps and events, app version, device model, operating system, language and an app-generated identifier | While you use the app. | To understand how Within is used, measure what works and improve it. |
| Session recordings: recordings of how you move through the app, which can capture what appears on screen, including text you type and journal content shown on screen | While you use the app. | To find confusing screens and bugs and to improve the experience. |
| Crash and diagnostic data: error reports, stack traces and device state at the time of a crash | When the app crashes or hits an error. | To find and fix problems. |
| Notification token | If you allow notifications. | To send the reminders you asked for. |
| Purchase information: subscription status and transaction identifiers (no card numbers) | If you subscribe to a paid plan. | To unlock paid features and manage your subscription. |
| Messages you send us | If you contact us. | To answer you. |
Face ID, Touch ID and passcode checks are handled by your phone's operating system. We never receive your biometric data.
3. Service providers
We rely on the following providers to run Within. They process information on our behalf, under their own security and privacy commitments:
- Supabase: account sign-in and journal backup (servers in the United States).
- PostHog: product analytics and session recordings (United States).
- Mixpanel: product analytics (United States).
- Sentry: crash and error reporting.
- Google Firebase Cloud Messaging and Expo: delivering notifications.
- RevenueCat, together with Apple and Google: processing and managing subscriptions. Payments are handled by the App Store or Google Play; we never see your payment card details.
- Apple and Google: sign-in, if you choose to use it.
Because these providers are located outside Québec and Canada, your information may be stored and processed in other countries, including the United States, where local laws may give authorities access to it.
4. What we don't do
- We don't sell or rent your personal information.
- We don't use your information for advertising, and there are no ads in Within.
- We don't use your journal to train artificial intelligence models.
- We share information only with the providers listed above, or when the law requires it.
5. How long we keep information
Journal content on your device stays until you delete it or uninstall the app. Backed-up journal content and account information are kept while your account exists and deleted when you ask us to delete your account. Analytics, session recordings and crash reports are kept for as long as our providers' retention settings allow, generally no more than one year.
6. Your rights and choices
- Use Within without an account: nothing from your journal is backed up to our cloud database.
- Notifications: turn them off at any time in your phone's settings.
- Access, correction and deletion: you can ask for a copy of your information, ask us to correct it, or ask us to delete your account and backup by writing to us (see below). We answer within 30 days.
- Withdraw consent: you can withdraw your consent to a use of your information at any time, which may limit what the app can do.
- Complaints: if you are not satisfied with our answer, you can contact the Commission d'accès à l'information du Québec, the Office of the Privacy Commissioner of Canada or your local data protection authority.
7. Security
Data sent between the app and our providers is encrypted in transit, and access to our systems is limited. No method of storage or transmission is completely secure, so we can't guarantee absolute security. If a breach puts you at risk of serious harm, we will notify you and the relevant authorities as the law requires.
8. Children
Within is not intended for children under 14, and we don't knowingly collect their information. If you believe a child has given us information, contact us and we will delete it.
9. Not medical advice
Within is a self-reflection journal, not a medical or mental health service. If you are in crisis, contact your local emergency services.
10. Changes to this policy
We may update this policy. We will change the date at the top and, for significant changes, let you know in the app.
11. Contact
The person responsible for the protection of personal information is Brice-Yazid Aminou. Write to getwithinapp@gmail.com for any question or request about your information.