Privacy policy

Version 6.1 · Effective date: 17 October 2026

1. In short

TAEONIA is a diary that runs on your device. We do not run a server for it, and we never receive what you write, photograph or record.

• There is no account and no sign-up. The app does not know who you are.
• There is no analytics, no usage counting, no advertising and no tracking.
• Entries and attachments are stored encrypted on the device. The keys are kept in the device’s own key store (Keychain on iPhone, Keystore on Android). The app lock cannot be turned off.
• The app does read your entries — on the device, and only there. To show topics, earlier entries that echo what you are writing, or to find a photo by a word, it works with your entries on your phone, by fixed rules or with a model that runs on the phone. Nothing of this is sent anywhere (section 6).
• The app talks to the network only through the store and the system: purchases, downloading a model you asked for, the store’s rating window, and on Android a check for a newer version (section 4).
• Copies, exports, the PDF book and time capsules are files that you create and keep yourself. We never receive them (section 9).
• If you delete the app and have no copy, the diary is gone. We cannot bring it back (section 10).
• The personal data that can reach us are the stores’ sales reports and the messages you send us (sections 12 and 13).

2. Who is responsible

Controller	Oleksandr Perov, sole trader (Einzelunternehmer) doing business as “Carrot”
Address	Zugspitzstraße 84, 85591 Vaterstetten, Germany
Contact, also for privacy	info@taeonia.com
Legal notice	https://taeonia.com/imprint
Supervisory authority	Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany

We have not appointed a data protection officer, because the law does not require one for a business of our size and kind.

What we are responsible for, and what we are not. We are responsible for the personal data that reach us: the sales reports from the stores (section 12) and your messages (section 13). The diary itself never reaches us. What the app does with it, it does on your device, for you; we take no part in it, cannot see it and cannot change it remotely. That is why this policy describes the app in such detail: so that you know what happens on your own phone.

Our website has its own privacy notice; this policy covers the app.

3. What you create in the app, and where it lives

Everything in this table stays on your device.

What	Where it is stored	How it is protected
Entry text and every earlier version of it; moods, notes in the margin, bookmarks, tags, templates, plans, answers from the introduction, Oracle questions, time-capsule records	the diary database in the app’s private storage	the whole database is encrypted
Photos, voice notes, video notes (up to 60 seconds, front camera and microphone)	files in the app’s private storage	each file is encrypted, from the moment it is recorded
Your own library: stickers and backgrounds you added, including stickers you made from a photo (section 6)	files in the app’s private storage	each file is encrypted
Drawings	inside the entry, as strokes	as the entry
Song links you paste into an entry	inside the entry	as the entry
What the app works out from your diary: the search index, topics, photo-search labels or vectors, transcripts of voice notes (section 6)	the same diary database	the same encryption; it can be rebuilt from the diary
The access-attempt journal and its photos, if you turn that feature on (section 7)	separate files in the app’s private storage	encrypted with a separate key — see section 7
A note of which wrong attempts you have already been told about (section 7)	the diary database	the same encryption
Encryption keys	the device key store (Keychain / Keystore), only on this device	no key is kept in the app’s files
Settings: appearance, language, which sections are shown, and a few dates	a separate unencrypted file	see section 8

Earlier versions of an entry are kept. When you edit an entry, the app adds a new version and keeps the previous one on the device. The app says so in its own privacy settings.

A deleted entry goes to the trash first and is deleted for good after 30 days. Deleting for good removes the entry, all its versions, its attachments and what the app derived from it.

Photo metadata is removed. Every picture — taken with the camera or chosen in the system photo picker — is redrawn from its pixels before it is stored. GPS coordinates, EXIF data and camera or device identifiers are not carried over.

4. What the app sends, and what it does not

The diary has no network client of its own: the app’s own code contains no web requests, no sockets and no connection to any server of ours. On Android the installable app does not even have the permission to use the internet. The app uses the network only through components of the store and the operating system, and only in these cases:

• Purchases. On iPhone, Apple’s purchase system (StoreKit) contacts Apple from inside the app when you buy or restore TAEONIA Horizon, when you start the free 14-day Trial and when you manage the subscription, and it may do so when the app checks whether Horizon is active. On Android, the app asks the Google Play Store app on the same phone, and the Play Store contacts Google. Nothing from your diary is part of it (section 4a).
• Models you ask for. Speech recognition (about 190 MB) and, on Android, photo search (about 95 MB) need a model. When you turn the feature on, the App Store or Google Play downloads it. The app sends nothing with this request except what the store needs to deliver the file.
• Updates on Android. After you have opened the diary, the app asks the Google Play Store on the phone, once per launch, whether a newer version exists. The question contains only the app’s name and installed version number. The Play Store checks with Google and may pass on information about the device and the app version under Google’s own privacy policy. If you agree to update, the Play Store downloads and installs it. On iPhone the app asks no such question.
• Ratings. At most once per version of the app, after a calm moment — closing an entry you have published, or leaving the page of a copy of the diary you have just made — the app may ask the system to show the store’s rating window: on iPhone through Apple’s StoreKit, on Android through Google Play’s in-app review, which the app requests from the Google Play Store app on the same phone. The store decides whether the window appears and draws it; if you rate or review the app, your rating or review goes to Apple or Google. The app does not learn whether the window appeared or what you answered, and sends nothing itself; on Android it is the Play Store that contacts Google. Nothing from your diary is part of it. To remember the version in which it last asked, the app keeps that version number in its settings file (section 8).
• Links. The terms of use and this policy (on taeonia.com, pages without analytics), the website of the time-capsule format, and a song link from an entry open in your browser or in the app that handles the link, such as Spotify. From that moment that app or website connects under its own rules and learns what any website learns from a visit, such as your IP address. Our addresses carry no identifier and nothing from your diary. A song address is part of your entry: when you open it, the service it points to learns that this song was opened. Before a song address is saved, the app removes the tracking parameters that sharing usually adds. “Rate TAEONIA” (More → About) opens the app’s review page in the App Store or in Google Play (on a phone without the Play Store app, in the browser); its address names only the app, and the store then connects under its own rules. “Share the app” hands the address https://taeonia.com to the system share sheet; where it goes is your choice.

The app does not use analytics, crash reporting services, advertising, advertising identifiers or tracking, does not create an account, and does not ask for your name, email address or phone number. It does not access your contacts, location, calendar, call history or health data, and on iPhone it asks for no access to your photo library: a picture is chosen in the system picker, which hands over only the picture you select.

One qualification, so that this section is exact: the app is built with React Native, and that framework, like any mobile platform, includes general-purpose modules, networking among them. TAEONIA’s own code uses none of them, and on Android the missing internet permission makes them unusable.

4a. Purchases: TAEONIA Horizon

The diary is free. TAEONIA Horizon is its optional paid part, sold as a monthly or yearly subscription or as a one-time purchase. The list of what Horizon opens is on the Horizon screen in the app; the terms of use describe the purchase itself.

• The store takes the payment — Google Play or the App Store, under its own terms and privacy policy. We do not receive your card, your name, your email address, your Google account or your Apple ID.
• What the app learns is only the state of the purchase, from the store on the device: whether Horizon is active, and whether it is a subscription or a one-time purchase; on iPhone, also the date on which you obtained the free 14-day Trial. The app does not read, keep or log order numbers, receipts or account identifiers. Apart from the start of the trial (below), it keeps no copy of a purchase: it asks the store each time.
• The 14 days. On iPhone, “Try 14 days” obtains the free “14-day Trial” from the App Store: a purchase at no charge, made in the App Store’s own window, which Apple records for your Apple ID like any other purchase (section 12). It starts no subscription and never turns into a paid plan. The trial runs from the date of that purchase and belongs to your Apple ID: deleting the app or “Delete all data” does not start a new one, and “Restore purchases” brings it back. On Android the trial is not a store purchase: the app writes the time it began into its settings file (section 8), and nothing is sent. On both platforms the app also writes the start into the diary database, so that it travels inside your encrypted copy and restoring a copy does not start a new trial. In the settings file the app also keeps the latest time it has seen on this phone, so that turning the clock back does not extend the trial.
• Cancelling and refunds happen in the store. Deleting the app does not cancel a subscription.

5. Device permissions

The app asks for a permission when you first use the feature that needs it, not at start-up. Declining it switches off only that feature.

Permission	When it is asked for	What it is used for
Camera	when you take a photo or record a video note; when you turn on “Photo on a wrong PIN” (never from the lock screen)	photos and video notes that are encrypted immediately; the photo described in section 7
Microphone	when you start a voice note or a video note	audio that is encrypted as it is recorded
Notifications	when you turn on a reminder or save a plan with a reminder	a local reminder with a fixed line of text and nothing from your diary
Face ID / Touch ID / Optic ID (iPhone), fingerprint or face (Android)	when you turn on quick unlock	see below

Biometrics are an optional faster way to unlock. The app never receives your biometric data: the system tells it only “confirmed” or “not confirmed”.

On Android the app also has permissions that are granted at installation without a question and give no access to your data: biometric unlock (USE_BIOMETRIC), short vibrations of the Oracle (VIBRATE), the Google Play purchase window (com.android.vending.BILLING), and three permissions added by Google’s Play Asset Delivery library so that Google Play can download a model you asked for (FOREGROUND_SERVICE, FOREGROUND_SERVICE_DATA_SYNC, RECEIVE_BOOT_COMPLETED). Android also adds an internal permission that keeps the app’s own system messages inside the app.

The app does not have the internet permission and does not ask for location, contacts, calendar, call history, the photo library, storage or an advertising identifier.

6. What the app works out on the device

Several features read your entries or photos. They all run on your phone, inside the app, and send nothing anywhere. None of them uses a model that writes text, none of them assesses your health, mood or personality, and none of them makes a decision about you.

• Search keeps an index of your entries so that you can find words.
• Topics. The app counts the words in your entries: it sets aside very common words, reduces words to their stem and matches them against a small built-in list of areas of life. This is plain counting by fixed rules, without a model. It runs while the diary is open, with or without Horizon. You see the result as topics on an entry and, with Horizon, under “Noticed” on the home screen. Turning “Noticed” off or putting a topic away in the settings hides it; it does not stop the counting.
• Echoes of past entries (Horizon). While you write, the app takes up to three characteristic words from your draft, searches your earlier entries for them and shows a short excerpt. Nothing is stored.
• “You wrote” (Horizon). The app looks for phrases of intention, such as “I want to…”, in entries from three to fourteen days ago and shows them to you again. Nothing is stored.
• Photo search works only with photos you added to the diary, never with your phone’s gallery.
  • On iPhone (iOS 17 and later) it uses the image classification built into iOS. It is on without a separate switch: while the diary is open and the app is on screen, the app labels your diary photos on the device. No download is needed. On iOS 16 the feature is not available.
  • On Android it is off until you turn it on. Then Google Play downloads a model that turns pictures and your search words into numbers on the phone and compares them. Turning it off deletes the model and these numbers.
• Stickers from a photo (Horizon; iPhone with iOS 17 and later, and Android phones with a 64-bit ARM processor). “Make from a photo” in My library opens the system photo picker, which hands over only the photo you choose. The photo is processed on the phone, in the app’s memory: on iPhone by the subject lifting built into iOS (Apple’s Vision framework), on Android by a small image-segmentation model that comes inside the app, so nothing is downloaded. It separates the subject from the background and does not identify people or name objects. Nothing is written to a file and nothing is sent. Only the finished sticker (at most 512 pixels) is saved, encrypted, in your own library; the photo itself is not kept, and if you leave the app before saving, the work is discarded.
• Speech recognition (Horizon). After you ask for it, the store downloads a speech model (English and German). It turns a recorded voice note into text on the phone; it does not listen live. The audio stays as an attachment. A transcript you already have stays readable without Horizon.
• The Oracle gives random answers. Its filter reads only the question you type into the Oracle, not your entries. A question it turns down is not saved; questions it answers are kept in the diary.

Search index, topics, photo labels or vectors and transcripts are stored encrypted in the diary database. They are not part of a copy (section 9), because the app can rebuild them; transcripts are rebuilt when you tap “Transcribe” again.

7. Wrong PINs, and the photo on a wrong PIN

The PIN counter is always on. For every wrong PIN, the app counts the attempts in a row and stores the time of the last one and the time until which the next attempt is paused, so that guessing gets slower. This record is encrypted on the device and contains no digits that were entered.

“Photo on a wrong PIN” is a TAEONIA Horizon feature (the trial counts as Horizon). It is off by default. You turn it on in the settings; the app then asks for the camera, and if you decline, the feature stays off.

When it is on:

• The journal. Every wrong PIN creates a record in “Access attempts”: a random identifier, the time of the attempt and whether a photo exists. The record contains no digits, no location and no data about the device. A cancelled PIN entry, a failed Face ID or fingerprint and a successful unlock are not recorded.
• The photo. From the third wrong PIN in a row, the app takes one photo with the front camera for this series of attempts; if the app is restarted during a series, it may take one more. It does not show a preview and uses no flash. The photo is small (about 480 × 640 pixels), has the date and time written into the image and carries no other metadata. If the camera does not work, the attempt is recorded without a photo. The app does not recognise faces.
• What the person at the phone notices. The system’s camera indicator is not hidden. On iPhone with iOS 18 or later, the app turns off the shutter sound where the system allows it; where it does not, the sound plays. On iOS 16 and 17 the system decides whether a sound plays. On Android the app plays no sound; some phones may add one of their own.
• How it is protected. Each record is a separate encrypted file. Its key does not depend on your PIN or biometrics: it becomes available once the phone has been unlocked after starting up. These files are therefore protected less strongly than your entries. That only someone who knows the PIN sees the photos is ensured by the app’s screens, not by the encryption. The number of files — that is, of recorded attempts — can be seen without the key. The app tells you this when you turn the feature on.
• Where you see it. Only after the diary is unlocked. If wrong attempts were recorded since you were last told, the app shows a window once after you unlock: “While the diary was locked”, with their number and the time of the last one; “View” opens the records. The records and photos are under Settings → Access attempts. There is no sharing or saving from there. So that the window does not repeat, the diary database keeps the time of the newest attempt you have been told about (section 3); it is not part of a copy.
• How long it is kept. Until you delete it: one record or the whole history (without a confirmation question), with “Delete all data”, or by deleting the app. There is no automatic deletion. Turning the feature off, or the end of Horizon, does not delete existing records; you can still open and delete them.
• The journal and the photos are not part of copies, exports or system backups, and are never sent.

The photo may show another person. Whether to use this feature is your decision; if other people use this phone, or it is a work phone, tell them. We never receive these photos or records.

8. The one unencrypted file: settings

The theme and the language have to be known before you unlock the diary, because the lock screen is drawn before any key is available. That is why the app keeps its settings in a separate file without encryption. Every value is limited to 64 characters by the file’s own structure, so that no diary text can end up there.

The file contains only:

What	Values
appearance: theme, light or dark, the theme for each, typeface, text size, line spacing	names and sizes
interface language	a language code
which sections are shown — such as “On this day”, topics, mood in the calendar, writing prompts, the Oracle’s history, introduction and sound — and how the gallery is laid out	shown, hidden and similar words
whether a one-time offer or introduction has been shown	shown, hidden
whether screen protection is on, and whether the photo on a wrong PIN is on	short words
your acceptance of the Oracle’s rules: the time you accepted them, a fingerprint of the version of the rules, and its language	a time and short codes
a marker that “Delete all data” was started and not finished	a fixed word
TAEONIA Horizon: on Android, the time the trial began; on both platforms, the latest time the app has seen on this phone (section 4a)	one or two times
the version of the app in which the store’s rating window was last requested (section 4)	a version number, such as 1.1.27

No entry text, no keys, no entry identifiers. These times, the language and the photo-on-a-wrong-PIN switch can still say something about you: for example, roughly when the app was last open on this phone.

The file is not included in system backups: on iPhone it is kept in the diary’s own folder, which is excluded from iCloud Backup and from backups to a computer, and on Android it is not backed up. Outside this file, the system’s own settings storage keeps a few switches without any personal content, so that they are known before the app has started: on Android, whether screen protection is on and whether the notifications permission has been asked for; on iPhone, only whether screen protection is on. On iPhone this one value is included in iCloud Backup and in backups to a computer.

9. Copies, exports, moving and time capsules

These are files that you create. The app makes them on the device and hands them to the system’s save or share dialog; it sends them nowhere itself. We never receive them.

Copy of the diary (free). Before creating it, the app asks for your PIN. The copy is one encrypted file, protected by a 25-character recovery code that the app shows once; every copy gets a new code. You choose where to save it. If you lose the code, the copy cannot be opened, and we cannot help.

Automatic copies (Horizon). You choose a folder and an interval (1, 3, 7 or 30 days) and how many copies to keep. The app writes them only while it is open. Their code is shown to you once and kept in the device key store, on this device only. If the folder is synchronised by another app — for example iCloud Drive or Google Drive — the encrypted copies go to that service; the app warns you about this. When Horizon ends, automatic copies stop and the files stay.

What a copy contains: entries with all versions, attachments (photos, audio and video, encrypted), moods and margin notes, bookmarks, tags, templates, plans, answers from the introduction, Oracle questions, time-capsule records, the PDF-book shelf, “My Life”, hidden topics, where imported entries came from, and the time the Horizon trial began. What it does not contain: drafts, settings of reminders and of automatic copies, your own sticker and background library, the access-attempt journal, its photos and the note of which attempts you have been told about, the settings file (section 8), and what the app can rebuild (search, topics, photo search, transcripts).

Restoring and moving to another phone. You choose a copy in the system file picker and enter its code — also when you set up the app (“I have a copy”). To move the diary to a new phone, create a copy, move the file there yourself and restore it.

Export (free). Markdown (every entry with all its versions) or Word (the current text). The export contains text only and is not encrypted; the app asks for your PIN first and writes a warning into the file. You either save the file or send it through the share sheet; the app warns that this hands your unencrypted diary to another app or company.

The PDF book (Horizon). A PDF with your entries and photos (and frames from videos), not encrypted. The app asks for your PIN and warns you on screen; the file itself carries no warning page. It is saved or sent in the same way.

From the moment an export or a PDF book is saved or sent, the app no longer protects it. It cannot delete, recall or track it.

Import. The app can read files from Day One, Journey, Diarly, MyDiary and plain text or Markdown, which you choose in the system file picker. It works without the network. Location and weather from Day One and Journey are discarded. Temporary files are kept in a private folder that is excluded from system backups and deleted afterwards — as for exports.

Time capsule (free). You choose a letter, entries, a period or the whole diary, and an opening date. The app creates a 25-character paper code (shown once), asks for your PIN and seals everything into one encrypted file that cannot be opened before the date. Sealing works offline. You save the file yourself; an optional PDF card contains neither the text nor the code. The capsule is opened outside the app: the recipient opens the page inside the file in a browser. That page then contacts public services that we do not operate — the drand time-lock network (api.drand.sh, drand.cloudflare.com) and arweave.net — which see what a website sees from a visit, such as the IP address.

10. Deleting data — and deleting the app

In the app you can delete an entry (it goes to the trash for 30 days), delete it from the trash at once, and delete an attachment on its own.

“Delete all data” asks you to type DELETE and enter your PIN. It deletes the keys, the diary database, attachments, the access-attempt journal, temporary files, scheduled reminders and the settings file. It does not delete files you saved outside the app — copies, automatic copies, exports, PDF books, capsules — nor the models downloaded by the store; a model is removed by turning its feature off or deleting the app. Screen protection returns to its default, on.

Deleting the app deletes the diary and its keys. The same happens if the phone is lost, broken or reset. Only a copy you made yourself can bring it back; we have none.

A forgotten PIN cannot be reset. The PIN takes part in the encryption; without it the diary cannot be decrypted. A copy is opened with its own code, not with the PIN.

A TAEONIA Horizon purchase is not deleted with the app. It belongs to your store account and comes back with “Restore purchases” on a device of the same platform. On iPhone the same applies to the free 14-day Trial: deleting the app or “Delete all data” does not start a new trial.

11. System backups

The diary is excluded from system backups on both platforms. On Android, app backup is switched off and every app folder is excluded from cloud backup and device-to-device transfer. On iPhone, the folders of the diary, attachments, keys, the access-attempt journal and temporary files are marked as excluded from backups, and keys are kept for this device only. Your diary therefore does not appear in an iCloud or Google backup. The settings file is excluded too; on iPhone only the screen-protection switch, kept in the system’s settings storage, is backed up (section 8).

12. What Apple and Google receive

Apple and Google run the stores and the operating systems under their own privacy policies, as independent controllers; we have no influence on what they process. In connection with TAEONIA, they learn, among other things:

• that you installed and updated the app;
• your purchases of TAEONIA Horizon, including subscriptions, renewals, refunds and Family Sharing, and on iPhone the free 14-day Trial;
• that a model was downloaded for the app (App Store or Google Play);
• on Android, when the app asked about a newer version (section 4);
• that the app asked for the rating window, and your rating or review if you leave one (section 4);
• if you have allowed it in the system settings, crash and usage reports that the system shares with app developers. We embedded no reporting tool; the app writes no entry text, no attachments, no keys and no file paths to its logs.

What we receive from the stores. Apple and Google give us reports on sales, so that we can keep our accounts, pay taxes and handle refunds and complaints. These reports come to us from Apple and Google, not from you. They contain details of each sale, such as the product, the date, the price, the currency and the country or region. On iPhone they may also list the free 14-day Trial, at a price of zero. We use them only for these purposes, and cannot link them to any diary. Legal basis: the performance of the contract and our legal obligations (Art. 6(1)(b) and (c) GDPR). We keep them for as long as German tax and commercial law requires. We may also see the de-identified crash and usage reports described above.

13. If you write to us

If you write to info@taeonia.com, we receive your email address, the name your email program shows, your message with any attachments, and the technical data of the delivery. We use them only to answer you and to handle your request, for example about a purchase. We do not build a profile, do not add you to a mailing list and do not use your message for advertising. You are not obliged to write to us.

• Legal basis: Art. 6(1)(b) GDPR where your message concerns a purchase or a contract, otherwise our legitimate interest in answering messages sent to us (Art. 6(1)(f) GDPR).
• Who receives and sends the mail: Mailgun Technologies, Inc. receives mail for taeonia.com in its EU region and forwards it to our mailbox; our replies are also sent through Mailgun. Mailgun does this on our behalf, under its data processing terms.
• Where we keep it: in our own mailbox on a server we rent from Zomro (Podaon SIA, Latvia) in a data centre in the Netherlands. We run the mailbox ourselves; Zomro provides the server on our behalf under a data processing agreement (Art. 28 GDPR).
• Transfer to the USA: Mailgun is a US company; although it handles our mail in its EU region, access from the USA cannot be ruled out. Mailgun Technologies, Inc. is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Art. 45 GDPR). The mailbox itself stays in the EU.
• How long we keep it: we delete the conversation once your matter is settled, and at the latest twelve months after the last message — unless the law requires us to keep it longer, for example correspondence about a purchase that tax law requires us to keep; then we delete it when that period ends.

Please do not send us the content of your entries. We cannot do anything with it, and a text that existed only on your phone would then exist in two more places.

14. Your rights

Your diary. We hold none of it, so we cannot show, correct or delete it for you — you do that in the app. You can see everything, edit it (the previous version stays), delete it, and take it with you as an export or a copy.

What we hold — the sales reports and your messages. If the GDPR applies, you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on our legitimate interest (Art. 21). We make no automated decisions about you (Art. 22). Write to info@taeonia.com; we answer within one month. Because we cannot link a sales report to a person by ourselves, we may ask you for details of the purchase, such as an order number.

You can also complain to a supervisory authority, in particular in the country where you live or work (Art. 77 GDPR). The authority responsible for us is the BayLDA (section 2).

Canada. You can ask for access to and correction of the personal information we hold. The person in charge of the protection of personal information, also under Quebec law, is Oleksandr Perov, owner, info@taeonia.com. You can also contact the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d’accès à l’information.

Australia. You can ask for access to and correction of the personal information we hold at info@taeonia.com. If you are not satisfied with our answer, you can contact the Office of the Australian Information Commissioner (oaic.gov.au).

New Zealand. You can ask for access to and correction of the personal information we hold (information privacy principles 6 and 7 of the Privacy Act 2020). Our privacy officer is Oleksandr Perov, info@taeonia.com. If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner (privacy.org.nz).

California and other US states. We do not sell or share personal information and do not use it for targeted advertising. You can make a request about the information we hold at info@taeonia.com.

15. Children

TAEONIA is meant for people aged 13 and over and is not directed at children. The app does not ask for an age, contains no advertising and sends us no data from anyone. Purchases go through the store’s own window, where the store’s parental approval applies. If a child has written to us, a parent or guardian can ask us to delete the message.

16. What we do not promise

The app is designed to protect the diary on a lost or stolen locked phone. That protection has limits:

• it assumes a phone that receives security updates and is not rooted or jailbroken;
• it does not protect against someone who has your unlocked phone and your PIN;
• a malicious keyboard is outside the app’s control, and so are screenshots on iPhone. While “Screen protection” is on (it is on by default), on Android the system blocks screenshots and screen recording of the app; on iPhone the app covers its window while the screen is being recorded or mirrored and in the app switcher, but iOS does not let an app block an ordinary screenshot. No app can stop someone from photographing the screen with another device;
• the access-attempt journal is protected less strongly than your entries (section 7);
• an export, a PDF book and anything you send through the share sheet are not encrypted; copies in a synchronised folder are encrypted, but they are with that service;
• encryption is not a backup: without a copy, losing the phone or the PIN means losing the diary;
• no app can guarantee that data can never be read, and we do not claim that.

17. Changes to this policy

This policy describes the current version of the app. If a version handles data differently, we update the policy before that version is released and publish it at https://taeonia.com/privacy with a new effective date. A change that widens the data the app handles is also announced in the app. Earlier versions are available on request at info@taeonia.com.