Candid
Privacy Policy
Last updated: 10 July 2026
Candid (“the app”, “we”, “us”) is a private journalling app published by CoachAI Ltd (United Kingdom). This policy explains what we collect, why, who processes it, and the choices you have. It is written to meet UK GDPR / the Data Protection Act 2018 and equivalent frameworks. The data controller is CoachAI Ltd, contactable at contact@coachai.uk.
The short version
- Your journal entries and conversations are private to your account and protected by row-level security — no other user can read them.
- We do not sell your data, show ads, or track you across other apps or websites.
- To provide the AI “Confidant” features, the content you choose to write or talk through is sent to our AI processor (Anthropic) to generate replies, weave entries, and write margin notes. It is not used to train models.
- You can delete your account and all associated data at any time from Settings → Delete account.
What we collect
| Data | Examples | Why |
|---|---|---|
| Account info | Email address; display name | Create and secure your account; sign-in |
| Your content | Journal entries, moods, margin notes, Confidant chat messages | The core journalling functionality; stored so you can read them back |
| Subscription info | Subscription/entitlement status, RevenueCat app-user id | Unlock and manage the paid features |
| Device tokens | Push notification token (only if you enable reminders) | Send the daily reminder you asked for |
| Diagnostics | Crash reports and error diagnostics (only if enabled) | Find and fix bugs |
| Usage counters | A per-day count of AI requests | Rate-limiting and abuse prevention |
We do not collect your location, contacts, photos, health data, or browsing history. Biometric unlock (Face ID / fingerprint) is handled entirely on your device by the operating system — we never receive or store biometric data.
Legal bases (UK/EU GDPR)
- Contract — to provide the app you signed up for.
- Legitimate interests — security, abuse prevention, and fixing crashes.
- Consent — push notifications and optional crash reporting. You can withdraw consent at any time in your device settings.
Who processes your data
- Supabase — authentication, database, and backend hosting.
- Anthropic — AI processing of content you submit to the Confidant. Used to return a response, not to train models.
- RevenueCat — subscription management.
- Sentry — crash and error diagnostics (only if enabled).
- Apple / Google — sign-in and subscription payment processing. We never receive your full payment details.
Each provider acts as our processor under a data-processing agreement and only handles data as needed to deliver its part of the service.
AI processing, in plain terms
When you use the Confidant (chat, talk-it-through, weaving, or automatic margin notes), the relevant text — which may include recent journal entries used as context — is sent to Anthropic’s API to generate a reply. This is essential to those features. If you would rather not have content processed by AI, use the plain “Write it yourself” / “Jot a line” paths and do not use the Confidant.
Storage, retention, and security
- Your content is retained until you delete it or delete your account.
- Access is scoped to your account by row-level security on every table.
- Data is encrypted in transit (HTTPS/TLS) and at rest by our hosting provider.
Your rights
Subject to applicable law, you can access, correct, export, or delete your data, and object to or restrict certain processing. The fastest route to erasure is Settings → Delete account. For other requests, contact contact@coachai.uk. You may also complain to the UK Information Commissioner’s Office (ICO) or your local data protection authority.
Children
Candid is not directed to children under 13, and we do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, contact contact@coachai.uk and we will delete it.
International transfers
Some providers may process data outside the UK/EEA. Where they do, transfers are covered by appropriate safeguards (e.g. Standard Contractual Clauses / UK Addendum).
Changes
We may update this policy; material changes will be reflected by the “Last updated” date above and, where appropriate, notified in-app.
Contact
CoachAI Ltd — contact@coachai.uk