Writestone Privacy Policy
Last updated: November 2, 2026
Writestone is a journal. What you write in it is yours. This policy explains what the app stores, where, who helps us run it, and how you delete it.
Writestone is made by Seyfettin Yıldırım, an independent developer in Türkiye (“we”, “us”). You can reach us at syfttny@gmail.com.
In short
- Your entries, photos and handwriting are stored on your device and backed up to Google Firebase under your account. Only your account can read them.
- We don’t show ads, sell your data or use your entries to train AI.
- Deleting an entry deletes it from the cloud too. Deleting your account deletes everything in it.
- A few companies help us run the app. They are listed below, with what each one receives.
What we collect and why
Your journal
What: the entries you write: title, text, formatting, and the question or journey an entry answers. Also the moods and activities you pick, your check-ins, the page style you choose (paper, handwriting font, ink, stamps), the photos you add and the handwriting you draw.
Why: to show your journal back to you, back it up, sync it between your devices, and work out streaks, recaps and insights from it.
Where:
- Entries are kept on your device and in Google Firebase (Cloud Firestore) under your account.
- Photos are kept on your device and in Firebase Cloud Storage under your account.
- Handwriting is stored inside the entry it belongs to.
Firebase security rules allow only your signed-in account to read or change any of it. We don’t look at your entries unless you ask us to help with a problem and give permission, or the law requires it.
Your account
When you first open Writestone, the app creates an anonymous account so your journal is backed up without signing up. If you sign in with Apple, Google or email, we receive your email address and, if you choose to share it, your name.
During setup you can tell us your goals, how much you’ve journaled before and when you’d like a reminder. These are saved in your profile to choose your questions and reminders.
Subscriptions
Purchases are made through the App Store or Google Play, and we never see your payment details. RevenueCat, our subscription service, receives three things to confirm your Writestone Plus access:
- your account ID
- an app-instance ID
- your purchase records
AI reflections and recaps (optional)
These features send something only when you use them. If you ask for an AI reflection or a weekly recap:
- The text of the entries involved goes over an encrypted connection to our server (Firebase Cloud Functions).
- Our server passes it to Groq, which writes the reply.
By default Groq doesn’t keep these requests. It may keep them for up to 30 days, only to fix errors or investigate abuse. We keep a count of how many reflections you’ve used, not their text. We never use your entries to train AI models.
Voice dictation
When you dictate, your phone’s own speech recognition turns your speech into text: Apple’s on iPhone and iPad, Google’s on Android, under their privacy terms. Writestone receives only the text. It never records or keeps your audio.
App lock
Face ID, Touch ID and fingerprint checks happen on your device, and we never receive biometric data. If you set a PIN, it is stored only on your device, hashed, in the system’s secure storage. Whether the lock is on is saved in your account settings.
Usage and crash data
Analytics: Firebase Analytics tells us how the app is used, for example that an entry was saved or a screen opened. It also receives:
- your device model, operating system, language and app version
- an app-instance ID
- an approximate location worked out from your IP address
Crash reports: Firebase Crashlytics sends crash reports with device and app details. Neither analytics nor crash reports ever include what you write.
Remote settings: Firebase Remote Config lets us adjust features without an app update.
We don’t use advertising identifiers, and we don’t track you across other companies’ apps or websites.
Invites
If you invite a friend, we create an invite code linked to your account and record when it is used, so both of you get your reward.
Handwriting fonts
Some handwriting fonts are downloaded from Google Fonts the first time you choose them. Google receives a normal web request from your device, including your IP address, to send the font.
This website
writestone.web.app is hosted on Firebase Hosting (Google), which processes your IP address to deliver the pages. The site sets no cookies and has no analytics, ads or trackers, and its fonts are served from the site itself. Your browser remembers only whether you closed the language suggestion, and that stays on your device.
Reminders and sharing
Reminders are scheduled on your device.
Pages, lines and cards you share are turned into images on your device. They leave it only when you send them through the system share sheet, to the place you choose. The app deletes its temporary copy shortly afterwards.
What we don’t do
- No ads or ad networks.
- We don’t sell or rent your data, and we don’t work with data brokers.
- We don’t track you across other apps or websites.
- We don’t use your entries to train AI models.
Who helps us run Writestone
These providers process data for us under their own terms and security commitments.
-
Google:
- Firebase Authentication, Cloud Firestore, Cloud Storage, Cloud Functions, Analytics, Crashlytics, Remote Config and Cloud Messaging
- Google Sign-In
- Google Fonts
- speech recognition on Android
See Firebase privacy and the Google Privacy Policy.
-
Apple: Sign in with Apple, App Store purchases, and speech recognition on iPhone and iPad. See the Apple Privacy Policy.
-
RevenueCat: subscription management. See the RevenueCat privacy policy.
-
Groq: AI reflections and recaps, only when you use them. See Groq privacy.
Your data may be processed in the United States and in other countries where these providers operate.
How long we keep it, and how to delete it
- Your journal and profile are kept for as long as your account exists.
- Deleting an entry removes it from your device and from our cloud storage, along with its photos and handwriting.
- Deleting your account (Settings › Delete Account) erases everything stored under it:
- your entries, photos and handwriting
- your security settings and profile
- the sign-in account itself
- A few records with no journal content can remain after you delete your account: your invite code, any invite you redeemed, and your AI usage count. Email us and we’ll remove them.
- If you remove the app without deleting your account, your backup stays in the cloud so you can restore it by signing in. Email us if you’d like it erased.
- Analytics and crash data are kept for a limited period and are never linked to the content of your journal.
Your rights
Depending on where you live (for example, under the EU and UK GDPR, Türkiye’s KVKK or California law), you can:
- access, correct, export or delete your data
- object to or restrict how it’s used
- withdraw consent you’ve given
Most of this is in the app. You can edit or delete entries, use Settings › Export my journal, and use Settings › Delete Account. For anything else, email syfttny@gmail.com and we’ll reply within 30 days. You can also complain to your local data protection authority.
Where the GDPR applies, we rely on these legal grounds:
- Providing the service you ask for: your journal, backup and subscription.
- Your consent: AI reflections, dictation, camera and photo access, and notifications. You can withdraw it at any time in the app or in your device settings.
- Our legitimate interests: analytics, crash reports and security, to keep the app working and improve it.
Children
Writestone isn’t directed to children under 13, or under the minimum age in your country, and we don’t knowingly collect their data. If you think a child has given us data, email us and we’ll delete it.
Security
Data is encrypted in transit and at rest by our providers. Firebase security rules limit access to your own account, and you can add an app lock. No method of storage or transmission is perfectly secure, but we work to protect what you trust us with.
Changes
If this policy changes, we’ll post the new version here with a new date, and tell you in the app if the change is significant.