--- title: "Privacy Policy · Inner Atlas" description: "How Inner Atlas collects, uses, protects, and lets you delete your personal information." url: "https://www.inneratlas.co.za/privacy" --- *Legal* # Privacy Policy **Effective date:** 4 October 2026 Inner Atlas is a private, reflective-journaling wellness app. This policy explains what personal information we collect, why, who processes it, how long we keep it, and the choices and rights you have. It is written to be read — if anything here is unclear, contact us (section 12). **Inner Atlas is a wellness tool, not therapy, and not a medical or crisis service.** It makes no diagnosis and provides no treatment. If you are in danger or crisis, please contact local emergency services or a crisis line — the app signposts resources but does not provide clinical care. ## 1. Who we are Inner Atlas is operated by **Inner Atlas (Pty) Ltd** (registration number 2025/557886/07), a company incorporated in South Africa and based in Cape Town. The company is the responsible party (data controller) for your information; its Information Officer for the purposes of the Protection of Personal Information Act (POPIA) is Matthew Ryan. Contact: matthew@inneratlas.co.za Address: 6 Avenue de l'Hermite, No. 3, Fresnaye, Cape Town, 8005, South Africa ## 2. What we collect, and why We collect only what the app needs to work. We do **not** run advertising, we do **not** track you across other apps or websites, and we do **not** sell your personal information. **Identity and account.** When you sign in with Apple, we receive an identifier for your Apple account and, if you choose to share it, your name and email address. You may use Apple's "Hide My Email" private relay; we work with the relayed address. We use this to create and secure your account and to contact you about the service. **Your content.** The heart of the app is what you write. We collect and store the journal entries, reflections, and notes you create; where you connect your calendar, the calendar events you choose to bring in, and, where you ask, the reminders the app adds back to a calendar on your device; and, if you import past journals by photographing handwritten pages, those photos and the text recognised from them. To read a photographed page, its image is sent to our transcription processor and read into text — see section 4. Because journaling often touches your mood and mental state, some of this is sensitive information — see section 3. We use your content solely to provide the service to you: to store it, to generate the reflective replies and summaries you ask for, and to organise it into the app's surfaces. Your content personalises **your** experience; it is not used to build a profile for anyone else. **Subscription.** If you subscribe, your purchase is handled entirely by Apple's In-App Purchase system. We receive your subscription status and history from Apple so we can unlock access. **We never receive or store your card or payment details** — those stay with Apple. **Age.** When you first use the app we ask your date of birth, to confirm you are old enough to use Inner Atlas and to determine whether parental consent is required (section 7). **Notifications and your device.** Many of the app's reminders — your morning, calendar, and evening nudges — are scheduled entirely on your device and never reach us. If you also turn on the notifications we send from our side, your device registers with Apple's Push Notification service, which gives us a delivery address (a token) for that install; we store it so we can send those notifications. The token identifies the install, not you, and carries none of your content. You can turn notifications off at any time in iOS Settings. **Technical information.** Like any online service, our servers process basic technical information when the app connects — most importantly your device's IP address — to keep the service secure, prevent abuse, and apply fair-use limits. We use it only for those operational purposes, we do not use it to build any advertising profile, and we keep no journal content in our server logs. **Our website.** If you visit inneratlas.co.za, we use our own privacy-respecting, first-party analytics to understand how the site is used. It is optional — you can turn it off at any time using the analytics preference control in the site footer — and it is never shared with third-party advertising networks. If you join our mailing list or email us, we store your email address and message so we can reply or send what you asked for. We do not collect audio recordings off your device: dictation uses Apple's on-device speech recognition. ## 3. Special personal information Reflections about your mental or emotional state, and anything you write that touches health or belief, are "special personal information" under POPIA. We process it only because **you** deliberately provide it in order to use the app for its purpose, and only to deliver the service to you (POPIA section 27). We do not use it for any other purpose, and we do not disclose it except to the processors named in section 4. ## 4. Who processes your data, and where To turn your writing into reflections and to organise it, the app sends your entry text to a small number of specialist AI processors acting on our instructions: **Fireworks AI** (generating replies, ranking relevant past entries when Voyage AI is unavailable, and — when you import a handwritten page by photograph — reading that page's image into text), **Voyage AI** (ranking relevant past entries), and **OpenAI** (a fallback for generation). A photographed page's image is sent to Fireworks only to transcribe it; it is held in memory for that single call and is not stored, by us or by the provider. Your content is sent to these providers **only to fulfil your request**, is **processed transiently** to do so, and is **not used to train their models**. These providers may be located outside South Africa, so using the app involves a cross-border transfer of your information (POPIA section 72); we require each provider to be bound by terms that protect your data to a comparable standard. We also rely on **Apple** for sign-in, for payments, and for delivering push notifications; on **Resend** to deliver account and parental-consent messages; and on **Cloudflare** to host and serve our website and to hold encrypted backups of our database. The servers that store your content are operated by us in **South Africa**; the encrypted database backups held by Cloudflare may be stored outside South Africa, which — like the AI processors above — is a cross-border transfer under POPIA section 72. We do **not** share your content with anyone else, and we do not disclose it for advertising or sale. ## 5. How we protect it Your data is encrypted in transit (TLS/HTTPS). Your journal content is also encrypted at rest at the application level: each account's entries are stored as encrypted values under keys that the database itself does not hold in readable form, so someone who obtained a copy of the database alone could not read your journal text. This is **not** end-to-end encryption. Because the service reads your entries to generate reflections and to support you, our authorised personnel and the processors in section 4 can access entry content to operate the service — we are minimal and careful about who can, rather than able to claim that no one can. On your device, cached content is protected by iOS file protection and is excluded from iCloud backup; sign-in tokens are held in the Keychain and do not sync to other devices; the app hides your content in the multitasking switcher; and you can turn on an optional Face ID or passcode lock. We keep no journal content in crash reports or analytics. ## 6. How long we keep it, and deleting your account Your content stays until you delete it or delete your account. You can **delete your account and all of its data from within the app** at any time — deletion actually erases your data, it does not merely deactivate it, and you never have to export or keep a copy first. You can export your data if you want to, but exporting is never required in order to delete. **One thing survives account deletion, and we want to be plain about it:** a one-way, irreversible code derived from your Apple sign-in records that your free trial has been used. It contains **none of your content** — no entries, and no time beyond the fact itself — and it exists only to prevent the free trial being reset by repeatedly deleting and recreating an account. We keep it indefinitely for that purpose. Deletion protects your data; it is not a way to claim the free trial again. ## 7. Children Inner Atlas is not for children under 13, and we do not knowingly allow them to create an account. If you are between 13 and 17, we ask for a parent or guardian's email address so we can obtain their consent (POPIA section 35). That address is used for one purpose only — to send a single consent request — and for nothing else; we store only a non-reversible fingerprint of the consent link, not the link itself, and we mask the address when it is shown back in the app. An unanswered consent request expires and is removed. **In the United States, Inner Atlas is for people 16 and over.** A person aged 13 to 15 on an Apple Account set to the United States App Store cannot use it, with or without a parent's consent. A 16- or 17-year-old needs a parent or guardian's consent (section 10). ## 8. Your rights You may ask us to access, correct, or delete your personal information, and you may object to or restrict certain processing. Deletion is built into the app (section 6); for anything else, contact us (section 12). You also have the right to complain to the **Information Regulator (South Africa)** at inforegulator.org.za. If you are outside South Africa, you may have additional rights under your local data-protection law, and we will honour them where they apply. ## 9. What we do not do We do not sell your personal information. We do not use it for third-party advertising. We do not track you across other companies' apps or websites. We do not use your journal content to train our own or anyone else's models beyond generating your own reflections as described in section 4. ## 10. If you are in the United States This section applies when your Apple Account is set to the United States App Store. It adds to the rest of this policy; where they differ, this section governs for you. **16 and over.** In the United States, Inner Atlas is for people 16 and over, and a 16- or 17-year-old needs a parent or guardian's consent. Where state law asks Apple to check ages (Texas and Louisiana today), we use the age range Apple shares with us, and the parent gives consent through Apple. For those accounts we also keep Apple's identifier for your download of the app, because it is the only thing Apple names when a parent withdraws consent; when that happens, we stop the account from being used. Everywhere else in the United States, we ask for the parent's email address, as section 7 describes. For a person under 18, the app reminds them every hour that they are talking with an AI, and suggests a break after three hours of continued use. **You are talking with an AI.** Inner Atlas's replies are written by AI, not by a person. The app reminds you of this at the start of each conversation session and again after three hours of continued use. **Your health information.** What you write about your mood, your mental and emotional state, or your health is health information, and so is what Inner Atlas works out from it. We ask for your consent to collect it separately from every other consent, on the "Before you write" screen. We use it only to provide the service you asked for. We share it only with the processors named in section 4, to provide that service. We never sell it, and we never use it for advertising. Our [Consumer Health Data Privacy Policy](https://www.inneratlas.co.za/consumer-health-data) explains this in full, and it is the policy that applies to you under Washington's My Health My Data Act and similar state laws. **Your rights.** You can see, export, correct and delete your information, and you can withdraw your consent. Deleting your account in the app deletes your information and withdraws your consent. For anything else, write to us (section 12); we answer within 45 days. If we decline a request, you can ask us to reconsider by replying to our answer, and if you are still not satisfied you can contact your state's Attorney General. We will not treat you differently for using any of these rights. **Crisis support.** Inner Atlas is not a crisis service. If you are in danger, call or text **988** (the 988 Suicide & Crisis Lifeline) or call **911**. Our [crisis safety protocol](https://www.inneratlas.co.za/safety) explains what the app does when what you write suggests you may be at risk. ## 11. Changes to this policy If we change this policy materially, we will update the effective date and, where the change is significant, tell you in the app. Continuing to use Inner Atlas after a change means the updated policy applies. ## 12. Contact us Questions or requests about your privacy, or to reach the Information Officer: **matthew@inneratlas.co.za**, or by post to Inner Atlas (Pty) Ltd, 6 Avenue de l'Hermite, No. 3, Fresnaye, Cape Town, 8005, South Africa.