Privacy policy

Who we are

Ponder is made by Yuvraj, an independent developer. "We" in this policy means Yuvraj. Questions about your data go to support@yuviatic.com.

Your journal

Your days live on your phone: the score, the topics you tapped, your answers and your notes. When Ponder backs them up to our server, each day is encrypted on the phone first, with a key that never leaves it. Our server stores only that sealed copy, which no one can read without your key, including us. What stays readable is the date of each day and when it last changed, so your phones can sync and, if you use Buddy, so a shared streak can be counted.

Getting your journal back on a new phone. On Android, Google's Block Store can keep a copy of your key in your Google backup, only when the phone says that copy is end-to-end encrypted (it needs a screen lock). You can also save a recovery code. Our server keeps your key only sealed under that code, so we never see the code or the key. If you lose your phone and your recovery code, no one can open your journal again, including us.

Your account

Ponder makes an account the first time you open it, without asking you to sign up. It has a random id and is linked to a random id for this install. If you choose to sign in with Google, our sign-in provider, Clerk, receives your Google account's email address and name, and our server keeps the email with your account so you can sign in again.

Our server also keeps the name you give Ponder (to greet you, and to tell your buddy who did what), which companions you've met, and what your companions wear and what you've bought for them with sparks.

Voice notes

When you speak instead of typing, your words are recognised on your phone. The recording is kept with that day on your phone and is never uploaded. It is deleted with the day, or when you clear the phone or delete your account.

The questions Ponder writes

To write your check-in questions, Ponder sends a few short lines from your recent days to our AI provider, Anthropic, at that moment: for the last seven days, the date, the score, the topics you tapped and the first 120 characters of the note, and the start of yesterday's answer. We don't keep them. Our server records only that a question was written, how long it took and how much it cost, never the words. Anthropic handles them under its own terms.

Buddy

Buddy is for two people who choose to pair, by one of them typing the other's code. From the day you pair, your buddy sees:

• that you checked in, your shared streak, and your score for each night;
• what you do with your shared companion: what you put on it, buy or wish for, and the hugs you send.

Your buddy never sees your answers, your topics, your notes or your voice. To share your scores, your phone sends them to our server, which can read them: unlike your journal, they aren't encrypted. While Buddy is paused, nothing new is shared. When either of you ends Buddy, the shared scores are deleted for both of you.

To tell you what your buddy did, our server keeps your phone's push notification token and sends notifications through Expo's push service and Google's Firebase Cloud Messaging. They carry your buddy's name and what happened, never anything from a journal.

Usage analytics and crash reports

These are on by default. Settings → Privacy → Share anonymous usage turns both off.

• Usage analytics (PostHog): which screens open and which steps happen, as counts and ids, under your account's random id. Never your journal, your name or your email, and nothing records your screen.
• Crash reports (Sentry): what went wrong, in the app or on our server, without your journal, what was sent to the server, the AI's prompts, or your personal details.

Who else is involved

We use these services to run Ponder. Each gets only what it needs for its job.

We don't sell your data, use it for advertising, or share it with anyone else, unless the law requires it.

Keeping and deleting

• Settings → Delete my account and journal deletes your account and everything our server holds for it at once, and clears the phone.
• Starting fresh (offered when a phone can't open your journal) deletes the sealed copy on our server.
• If you only uninstall Ponder, your sealed journal stays on our server so you can restore it later. Delete your account first if you don't want that.
• Usage events and crash reports are kept by PostHog and Sentry under their own retention periods.

You can ask us what we hold about you, or ask us to correct or delete it, by email. If you can't open the app any more, write to us and we'll help.

Children

Ponder isn't meant for children under 13, and we don't knowingly keep data about them. If you think a child has used Ponder, email us and we'll delete it.

Changes

When this policy changes, the date at the top changes. If a change affects what we keep or who can read it, Ponder will tell you in the app first.