← Back to home

Privacy Policy

Last updated: October 2026 · antia is in beta: features evolve, and this policy will evolve with them. When it changes in a way that matters, we will publish the change here and, where the law requires it, ask for your consent again.

The short version

  • You own all your content — memories, reflections, metadata, voice recordings, photos.
  • We do not sell, rent, or monetize your data, and we do not show ads.
  • We identify the AI providers that process your journal and ask for your permission.
  • You can export your memories and life-model data at any time.
  • You can delete individual memories, or erase your whole account, yourself from the app.

Who we are

antia is operated by antia Journal, Inc., a Delaware corporation (United States), registered at 131 Continental Dr, Suite 305, Newark, DE 19713, United States (our Delaware registered office). For the purposes of EU/UK data protection law, we are the controller of your personal data. You can reach us about privacy at privacy@antia.io.

antia Journal, Inc. has no establishment in the EU/EEA. For our current EU/EEA and UK beta users, an EU representative (GDPR Art. 27) and a data protection officer are being arranged; we will publish their contact details here as soon as they are appointed. At public launch we will pause new EU/EEA and UK sign-ups until those appointments are in place. In the meantime you can raise anything with us directly at privacy@antia.io, and every right in this policy applies in full.

What we collect

Data you provide: Email, display name, and a hashed password for authentication; an optional date of birth and country; and the memories you capture — text, voice recordings, and photos.

Data we generate: Embedding vectors for memory search and your Route, and metadata such as themes, people, locations, dates, and emotional tone extracted from your memories. This generated data is stored alongside your memories in our cloud database.

Data collected automatically: Product-analytics events linked to your account (via PostHog) to understand feature usage; on the mobile app, crash and error reports (via Sentry); and standard server logs. We log your IP address for security and abuse prevention.

Photo moments (optional, on-device): If you grant photo-library access on mobile, the app groups your photos by when and where they were taken to suggest days worth writing about. This grouping happens entirely on your device — your photo library is never scanned by our servers, and nothing about it is uploaded. A photo only leaves your device if you choose to attach it to an entry; attached photos keep their embedded metadata (like location and time), which we treat as part of your memory. You can revoke photo-library access anytime in your device settings.

Beta-invite signups: If you request access through an invitation page, we collect your name, email address, the platforms you tell us you'd like to use, and your IP address (for security). Our lawful basis is our legitimate interest (Art. 6(1)(f) GDPR) in running and growing the beta. We use it to send you access and the occasional beta update — every beta email includes an unsubscribe link. It is stored separately from any journal data, never shared or sold, and kept until you create an account or for up to 12 months, whichever comes first. You can ask us to delete it any time at privacy@antia.io.

What we do NOT do

  • We do not sell, rent, or monetize your data.
  • We do not use third-party advertising trackers or cross-site tracking inside the app.
  • The AI providers process your content to deliver features, not to train their models (per their API terms).

How your data is stored

Your memories are stored in our cloud infrastructure on AWS, encrypted in transit (TLS 1.2+/1.3) and at rest (AES-256). The desktop app also keeps a local copy for fast, offline-capable capture; new memories sync to the cloud when you reconnect.

The mobile app also keeps a local copy of your entries on your device, so your journal stays readable when you have no signal, and it holds entries you write offline until they can sync. The same local copy includes the most recent version of your Route — the life view the app composes from your entries — so it too stays visible offline, marked with how old it is. This copy lives in the app's private storage, protected by your device's own encryption; it is scoped to your account and wiped when you log out. It never includes Locked entries (those exist on your device only in encrypted form) or Burned writing — neither as entries nor inside the Route view.

Guest mode works fully offline with data kept on your device. If you are online, a temporary device account is created and your data syncs to the cloud so you can move to a full account later.

Locked entries (end-to-end encrypted)

You can mark any entry as Locked. A Locked entry is encrypted on your device with a key derived from a lock passphrase that you choose and that never leaves your device. We store only the encrypted form (the ciphertext), an encrypted copy of your entry key, and the settings needed to derive your key from your passphrase — none of which we can use to read your entry. Your lock passphrase is separate from your login password: resetting your login password does not unlock your Locked entries, and we never receive, store, or email your lock passphrase.

"End-to-end encrypted" and "we cannot read it" describe Locked entries only. Your ordinary entries are processed by us and our AI providers to deliver the features you ask for, with the consent you give at sign-up (see "Our legal basis for using your data"). Burn, below, is different again — we never receive that content at all.

Because we cannot read Locked entries, they are deliberately excluded from all processing: they are not analysed by our AI, not turned into your Route, not searchable, not retrievable by Ask, and not seen by any human reviewer. They are a private vault, not part of your life-map.

A permanent consequence you should understand before you use this: if you lose your lock passphrase and your recovery code, your Locked entries are gone for good — we cannot reset, recover, or decrypt them. This is the point of the feature, not a defect. When you set up your vault we ask you to save a recovery code in your password manager or device keychain; we never keep a copy of it, and by default we never email it. (If you ever choose the option to have us email your recovery code, anyone who can then read that email can use it to open your vault — so we recommend against it, and it is never the default.)

A Locked entry is still your personal data and is still covered by your rights below. You can export it together with the encrypted key material you need to decrypt it yourself, and you can delete it at any time.

Burn (ephemeral writing)

You can write an entry and then Burn it. Burned writing never leaves your device and is never sent to or stored by us. While you are writing, your draft is held only on your device, in encrypted form; when you Burn it, that draft is destroyed, and the only thing sent to us is a record that you burned something on a given date — never the content, never a copy, never a summary, never a word count or how long you spent. We keep this date-only record so your timeline can acknowledge the act, and you can see and delete these records like any other data.

Two honest notes. First, our promise is "we never store or transmit your burned writing" — not "your writing is never written to your device." While you are writing, we keep your draft on your device as encrypted data so your work survives a crash; when you Burn, we wipe it. Second, separate from anything we do, your device's own operating system — its keyboard, predictive-text, and screenshot features — keeps its own records that are outside our control; we can't promise your device has no memory of you typing.

Our legal basis for using your data

We only process your personal data where the law allows:

  • To provide antia (performance of our contract with you, GDPR Art. 6(1)(b)): creating your account, storing the memories you capture, generating your embeddings, metadata, and Route, and letting you search and reflect.
  • Your explicit consent for sensitive content (Art. 9(2)(a)): the memories you write can reveal sensitive things — your health and state of mind, your beliefs, your relationships. Under EU law this is special-category data, and we process it only with the explicit consent you give when you sign up. You can withdraw it at any time by deleting your account; withdrawal does not affect processing that already happened.
  • Our legitimate interests (Art. 6(1)(f)): keeping antia secure and preventing abuse (including logging your IP address), and understanding how features are used to improve them. You can object, and you can turn product analytics off (on the mobile app, Settings → Privacy).
  • Legal obligation (Art. 6(1)(c)): we keep limited payment and tax records where the law requires.

Locked storage is a separate, optional consent. When you set up your vault, we ask for a distinct, optional consent to store your Locked entries in encrypted form. This is separate from the consent you give at sign-up to process your ordinary entries: you can give it on its own, withdraw it on its own, and declining it simply means Locked entries are unavailable — nothing else about antia changes. Because we cannot read Locked entries, this consent covers only their encrypted storage, not any processing of their contents.

AI processing and your permission

Antia uses AI as part of its journaling service. Before AI processing begins, we explain the providers and data involved and ask for your permission. We record the disclosure version, your affirmative choice, and when it was made. An existing account or acceptance of a general privacy notice does not by itself grant this separate AI permission.

We collect the entries, questions, conversations, images and recordings you submit through Antia. For AI features, we send relevant journal text and related context, questions and conversations, and attached images to OpenAI and Anthropic through their commercial APIs. These features include analysis, organization, Route, Ask and search, including embeddings used for retrieval. When you share an entry in Sessions, we send its text to OpenAI to moderate the content. In multilingual sessions, we may also send it to OpenAI for translation. Voice recordings are sent to OpenAI for transcription. Derived context can include summaries and information extracted from your entries. We do not send Locked entries or writing kept in Burn mode to an AI provider.

You can decline or withdraw AI permission without that action deleting your account or entries. Antia requires permission for its AI service. The updated app keeps server-data export, account deletion and sign-out available when you decline. You can manage permission in AI privacy choices. Withdrawal stops new AI transfers; it cannot recall a request already sent. A server export does not include pending captures or Locked entries stored only on your device.

Protection by our AI providers. We use OpenAI and Anthropic through their commercial APIs, governed by their commercial terms and incorporated Data Processing Addenda (DPAs). These agreements require confidentiality, processing under documented instructions, appropriate security safeguards, assistance with data rights, and contractual protections for subprocessors. For the personal data we send to these AI providers, these obligations provide protection equivalent to the confidentiality, security and restricted-use protections described in this policy.

OpenAI's Services Agreement provides that OpenAI will not use our content to develop or improve its services unless we explicitly agree, and we have not enabled that sharing. Anthropic's commercial terms prohibit training models on customer content from these services. Provider retention depends on the service and applicable terms, including exceptions for legal requirements and abuse prevention; this policy does not promise zero retention, identical retention periods at every provider, or recall of prior transfers. The backup-deletion period stated below describes Antia's own backups, not a universal deletion deadline for AI providers.

You can read the OpenAI Services Agreement and OpenAI DPA, and the Anthropic Commercial Terms and Anthropic DPA.

Third-party processors

  • OpenAI and Anthropic — commercial AI processing as described in the AI processing and permission section above.
  • AWS — infrastructure, storage, and database.
  • Stripe — payment processing.
  • PostHog — product analytics.
  • Sentry — mobile crash and error reporting.
  • Gmail / SMTP — transactional email (sign-in, password reset).

Private entries and providers. Locked entries are never decrypted or sent to AI providers. Infrastructure providers store Locked entries only in encrypted form; they do not receive your vault keys. Burned writing never leaves your device and is not sent to any provider.

Where your data goes

Our service providers (including OpenAI, Anthropic, AWS, Stripe, PostHog, Sentry, and our email provider) are based in the United States, so your data is transferred outside the EU/EEA. EU law requires appropriate safeguards for these transfers. Where a provider is certified under the EU-US Data Privacy Framework (and its UK Extension), we rely on that certification. For providers not covered by an adequacy mechanism, contractual safeguards are required. For OpenAI and Anthropic, DPAs are incorporated into our commercial API agreements and include provisions for international transfers, including Standard Contractual Clauses where applicable. We continue to review and document the contractual safeguards for our other providers. You can ask us about the safeguards for any provider at privacy@antia.io.

How antia analyzes your memories

To build your Route and make your memories searchable, antia automatically analyzes what you write — pulling out themes, people, places, and dates, and sensing the emotional tone of a memory, then assembling these into your life model. This is a form of automated profiling, carried out only to provide features you have asked for.

antia does not make automated decisions that produce legal or similarly significant effects about you — it does not decide anything for you; it organizes and reflects your own writing back to you. You can review and edit anything antia infers, and delete any memory or your whole account at any time.

Human review of AI-generated content

Some of what antia generates is shown to you only after a person has checked it. For example, the rare commemorative cards the app may compose (such as an anniversary of your first entry) are reviewed by an authorized member of the antia team for tone, accuracy, and safety before they can ever appear in your app. During the beta, this review is performed by antia's founder.

During the beta, this also happens in the background: the app generates and reviews candidate cards even though no cards are shown to anyone yet — so the system is proven safe before it ever turns on. The rules below apply to that background review too.

We designed this review to see as little as possible:

  • The review tool shows only the generated card itself — which can include a short excerpt (a couple of sentences at most) that the AI quoted from one of your entries — never your full journal, your account, or anything beyond the card under review.
  • One exception is scoped differently: when you keep a card on your Route (a reflection you chose to hold onto), an authorized administrator supporting or troubleshooting your Route can view that kept card — including its short quoted excerpt — together with the account it belongs to. Supporting your Route requires seeing your Route; this view is not anonymous, and we say so here rather than pretend otherwise. It is used only for support and troubleshooting, and every access is logged like any other review.
  • Every review access is logged, with who looked and when.
  • Reviewers are bound by confidentiality. Review is used to decide whether a card is shown and to improve the safety of the system that generates them — never for advertising, profiling, or anything unrelated to the feature.
  • The same rules apply to any human review of other AI-generated reflective content before it is shown to you.

Our legal basis is our legitimate interest in making sure AI-generated content shown to you is safe and faithful to your words (Art. 6(1)(f)), alongside providing the service you asked for (Art. 6(1)(b)). Where an excerpt reveals sensitive content, this processing relies on the explicit consent you give at sign-up (Art. 9(2)(a)), which specifically names human review of AI-generated content. If you have questions about human review, contact privacy@antia.io.

Locked and Burned entries are never reviewed. Human review applies only to entries you allow us to process. Locked entries are excluded entirely — they are encrypted with a key we do not hold, are never decrypted by us, and are never shown to any reviewer. Burned writing never reaches us at all, so there is nothing to review.

Your rights

Under EU/UK data protection law you have the right to:

  • Access & get a copy of your data — export everything from Settings → Export Data: your memory text and metadata, your voice recordings and photos, your Ask and reflection conversations, and your Route / life-model data.
  • Correct anything that's wrong — edit any memory, reflection, or metadata directly in the app.
  • Delete your data — delete individual memories in the app (recoverable for 30 days, then permanently removed), or erase your whole account and all associated data from Settings → Delete account (immediate and permanent). You can also email privacy@antia.io and we'll confirm within 48 hours.
  • Restrict or object to certain processing, including our use of your data for analytics and the legitimate interests described above.
  • Take your data with you (portability) in a structured, machine-readable format.
  • Withdraw your consent at any time where we rely on consent (including the explicit consent for your sensitive content). This does not affect anything we did before you withdrew it.

To exercise any of these, use the in-app controls above or email privacy@antia.io. We'll respond within one month.

You can also complain to a data protection authority. Because antia has no establishment in the EU, the one-stop-shop does not apply, and you can lodge a complaint with the supervisory authority where you live (in Spain, for example, the Agencia Española de Protección de Datos — AEPD, www.aepd.es).

Data retention

We keep your account data while your account is active. Deleted memories are recoverable for 30 days, then permanently removed — during that window they are kept only so you can undo the deletion, and they are not included in your data export. When you delete your account we erase your data from our live systems immediately; copies in our encrypted backups are overwritten on our normal backup rotation, within 14 days. We keep limited payment records for as long as tax and accounting law requires.

Locked entries are kept as encrypted data for as long as you choose to keep them. When you delete a Locked entry, or delete your account, we remove it from our live systems immediately; any encrypted copies that remain in our routine backups become permanently unreadable once the related key material is deleted, and age out of those backups on the same backup rotation described above (within 14 days). Burn keeps no content at any time — we retain only the dated burn record, which is deleted with your account. Recovery codes are never stored by us in any form.

Security

Encryption at rest (AES-256) and in transit (TLS 1.2+/1.3), Argon2 password hashing, refresh-token rotation, and AWS WAF protection. We never store plain-text passwords.

Contact

Privacy questions or data deletion requests: privacy@antia.io

Children

antia is for adults and is not intended for anyone under 16. You must be 16 or older to create an account, and we ask you to confirm this at sign-up. If we learn that someone under 16 has created an account, we will delete it. If you believe a child has signed up, please contact privacy@antia.io.

This policy describes what antia actually does today, checked against how the app is built. antia is beta software: features will evolve, and this policy will evolve with them — material changes are published here and, where required, put to you for fresh consent. The one detail still to be added is our registered mailing address, marked above; everything else stated here is in effect now.