1. Data controller and privacy officer
The data controller for personal data is Olyra Mind, represented by Marie-Pier Fillion.
Marie-Pier Fillion is designated as the person in charge of the protection of personal information for Olyra Mind. She is the contact for privacy questions, exercising your rights and complaints concerning your personal information. Email her at hello@olyra.app, with the subject “Privacy — attention Marie-Pier Fillion”. This Quebec designation does not, by itself, appoint a data protection officer or a representative in the European Union or the United Kingdom.
2. Data collected
We only collect the data necessary for the service to function:
- Account identifiers: email address, hashed password, account creation date.
- Journal content: text, titles, mood, energy, stress, sleep, photos, covers and associated prompts. Content may include sensitive information and information about third parties. Dictation sends the audio you provide to a transcription service.
- Profile data and AI reflections: name, optional photo, address preference, motivations, personal note, excluded topics, portrait elements, reviews and translations of generated text.
- Technical data: quota counters, error and request logs, connection and device information. Technical providers may process your IP address; we do not guarantee systematic anonymization.
- Communications: messages sent to support and user feedback.
3. Purposes of processing
Each category of data is used for specific purposes:
- create and secure your account;
- provide the journal service and its associated features;
- generate AI insights and personalized summaries;
- ensure security, prevent fraud and spam;
- respond to support requests;
- improve the service overall, without using your private content for advertising purposes.
4. Legal bases
Applicable requirements depend on the processing and jurisdiction. In Quebec and Canada, we must respect necessity and consent requirements, including express consent where required for sensitive information. Where the GDPR or UK regime applies, providing the service may rely on contract performance, security on an assessed legitimate interest, and some operations on a legal obligation. Processing health data or other special categories also requires a condition permitted by law, such as valid explicit consent. Accepting general terms or acknowledging this policy does not, by itself, constitute consent to all AI processing. A separate, specific choice must be obtained where required; policy wording does not replace that mechanism.
5. Data sharing
We do not sell your personal information or share it for cross-context behavioral advertising. Disclosures necessary to provide the service, including to AI providers, are described below:
- Technical providers: Lovable Cloud for hosting, accounts, the database and files; Lovable AI Gateway and the model providers used for analyses, translations and transcription. The current code uses Google and OpenAI models, among others. Requests may contain your entry text and the context needed for the requested result.
- Paddle.com: as our reseller and Merchant of Record, Paddle handles payments, billing, tax and purchase-related requests. Payment data is processed directly by Paddle.
- Professional advisors: lawyers, accountants, as part of their duties.
- Competent authorities: only when required by law.
6. Data retention
Data needed for your journal is retained while you use your account. Settings let you delete entries, your portrait or your account. Deletion in the app does not guarantee immediate removal of every copy: backups and technical logs may remain under provider rules and legal obligations. Lovable Cloud documents daily database backups retained for up to approximately 14 days; these do not include stored files. Exact retention of logs, residual files and data sent to AI still needs confirmation. Drafts may remain on your device until removed locally.
7. Your rights
You can access, correct, export or request deletion of your data from the app settings. To exercise your rights or ask a question, write to us at hello@olyra.app.
Quebec and Canada. Depending on applicable law, you can request access and correction, withdraw consent subject to legal or contractual restrictions, and request other measures provided by law, including portability where applicable. Withdrawal may prevent provision of the affected features. You may complain to Quebec’s Commission d’accès à l’information or the competent Canadian or provincial authority.
European Union, European Economic Area and United Kingdom. Where the GDPR or UK regime applies, you may request access, correction, erasure, restriction or portability, or object to certain processing, subject to their conditions. You may withdraw consent without affecting the lawfulness of earlier processing and complain to your supervisory authority. These rights are not all absolute and are not all available through app buttons.
United States and other countries. Depending on your location and laws applicable to the service, rights of access, correction, deletion, copying, consent withdrawal or appeal may exist. Well-being information may fall under specific consumer health data laws, including in Washington State, even when California CCPA thresholds are not met. Contact us with a request; we will verify your identity proportionately and explain our response and applicable remedies.
Making a request. Send your request to our privacy officer, identifying the right you wish to exercise. Do not send your password or your entire journal. Proportionate identity verification may be necessary; an authorized agent may act where permitted by law. We will respond within the deadlines and procedures required by applicable law and explain any refusal and available remedies. Where required by law, exercising your rights will not result in discriminatory treatment. Withdrawing consent may make the affected feature unavailable without removing your other statutory rights.
8. Security
Connections to remote services use HTTPS and application data is subject to account-based access controls. Journal files and avatars are stored in non-public spaces. Olyra does not provide end-to-end encryption or individual encryption of text before storage. People with authorized administrative access to the project can therefore view stored data. Infrastructure encryption at rest, key management and contractual safeguards must be confirmed with providers; this notice does not promise that the operator cannot read your content. No measure guarantees absolute security.
9. Cookies and similar technologies
Olyra uses browser storage for your login session, preferences and writing drafts. Sign-in and payment services may use their own necessary cookies. Drafts are not individually encrypted on your device: avoid sharing a browser profile with another person. You can clear this data in browser settings, which may sign you out and remove drafts. This notice does not claim that an analytics-cookie consent mechanism is already implemented.
10. Changes
This policy may evolve. Significant changes will be notified within the app or by email.
11. Contact
For any privacy question or complaint, contact Marie-Pier Fillion, the person in charge of the protection of personal information for Olyra Mind, at hello@olyra.app.
12. AI processing and private-mode limits
AI features require the processed content to be readable by the services generating responses. Memory and cross-entry context have authorization controls; you can disable memory and withdraw sources. The ‘private’ setting does not encrypt an entry or hide it from administrators. In the version currently reviewed, some manual writing-prompt or action requests may still send a private entry’s text to AI. Avoid these commands for text you do not want transmitted.
Request retention and non-use for training depend on provider terms and are not certified here. Processing may take place outside Quebec or Canada. Exact locations, the complete subprocessor list and transfer safeguards must be documented and assessed before a wider launch.
13. Crisis situations
Olyra is not an emergency service and does not provide diagnoses. Journal entries are not requests for emergency assistance: the service does not guarantee crisis detection, real-time human review or automatic alerts to loved ones or emergency services. In Canada, call or text 9-8-8 for a suicide crisis; in immediate danger, call 9-1-1. Elsewhere, use local emergency resources.
14. International use and transfers
Quebec’s private-sector personal information protection law governs our activities in Quebec. PIPEDA may also apply, including to interprovincial or international commercial data flows; other provincial laws may be relevant. The GDPR does not automatically apply because someone from the European Union visits the site: its territorial scope depends on factors including an establishment, offering services to people in the Union, or monitoring their behavior there. The United Kingdom has its own regime. This notice does not claim automatic worldwide compliance.
Providers may process data outside Quebec or Canada. Exact countries and contractual safeguards are not yet fully confirmed. Before information is communicated outside Quebec, the law requires a privacy impact assessment, adequate protection and a compliant written agreement. Where the GDPR or UK regime applies, transfers must also rely on a mechanism permitted by that regime, such as an applicable adequacy decision or appropriate contractual safeguards. This notice does not certify that those assessments and mechanisms have already been finalized: validation remains necessary before a wider international launch.
Paddle handles payments and sales-related tax obligations as our reseller. This does not transfer Olyra Mind’s obligations concerning your journal, privacy, consent or local consumer protection laws to Paddle.
GDPR and UK regime. Where these regimes apply, each processing activity must have an appropriate lawful basis. Text, mood measures or inferences may reveal health data or other special categories: processing them also requires a permitted condition for those categories, separate from contract performance alone. Explicit consent, where used, must be specific, informed, freely given and withdrawable. Accepting this policy does not authorize transfers to third countries: an adequacy decision must cover the recipient concerned, or permitted safeguards must be implemented with required assessments and supplementary measures. EU and UK transfer mechanisms are not interchangeable. You may ask our privacy officer for information about applicable safeguards; their implementation and any representative or data protection officer requirements remain to be validated before a launch targeting these territories.
United States. Applicability of the CCPA as amended by the CPRA and other state laws depends on their individual criteria; we do not claim that they all apply or that their thresholds exclude every obligation. Where provided by law, you may request access, correction, deletion or a copy of your data, limit certain uses of sensitive data, opt out of certain uses or appeal a decision on your request. We do not sell your personal information or share it for cross-context behavioral advertising. This statement does not exclude disclosures to providers needed for the service, including AI, which must comply with applicable rules. Certain consumer health data laws, including Washington’s My Health My Data Act and Nevada’s law, may cover well-being information or inferences and require separate notices, consent, deletion and provider-processing safeguards. Their applicability and required mechanisms remain to be assessed; this policy does not certify that a specific notice and all such mechanisms have already been implemented.