Privacy Policy
Last updated: May 25, 2026.
This page explains what holystic.ai collects, what we do with it, and the rights you have over your data. Where the language gets legal, we try to also say what it actually means in practice.
What we collect
From you, when you sign up
- Email address. Used to identify your account and verify it's you. Authentication is handled by Clerk; we never see your password because there isn't one — we use email-code sign-in.
From you, when you use the app
- Profile choices: Christian tradition, the values you select, and a free-text description of the digital life you're living toward.
- Goals: short descriptions of behaviors you're trying to practice or limit.
- Reflections: the slider positions and the free-text journal entries you submit each day, along with the AI-generated response.
- Feedback: if you submit feedback on a reflection response, we store what you wrote.
Automatically, while the app is running
- Standard server logs: timestamps, IP address, the HTTP request path, and the response status. These are kept for a short window for operational debugging.
- Crash and error diagnostics (no personal content) — only the type of error and the part of the app that produced it.
We do not collect your screen-time, your app usage, your location, your contacts, or any biometric data. We don't track you across other apps or websites. There are no advertising SDKs in the app.
How we use it
The data above is used to provide the service: to identify you when you sign in, generate reflections tailored to your tradition and goals, and let you see your history. We don't sell it, share it with advertisers, or use it to target you outside the app.
AI processing of your reflection text
When you submit a reflection, the text you wrote and the sliders you set are sent to OpenAI's API to generate the response. OpenAI processes this content under their business terms, which (as of this writing) commit them to not train their public models on data sent through the API and to delete it after processing. We send only the content of the reflection itself, plus the corpus items the engine retrieved as context — never your name, email, or account identifier.
Where it's stored
Your data is stored in a managed Postgres database hosted by Fly.io in the United States.
Free-text fields you provide — journal entries, goal descriptions, and the "what you're living toward" statement — are encrypted at rest using envelope encryption: each user has a personal 256-bit data encryption key (DEK), and that DEK is itself wrapped by a global key (KEK) that lives only in our server's runtime environment, never in the database. The cipher is AES-256-GCM with a fresh random IV per stored value. A copy of the database alone is not enough to recover plaintext — an attacker would also need the KEK from our server's environment. Identifiers and timestamps are stored unencrypted so the application can function.
Rows that were written before envelope encryption was deployed (2026-05-25) remain in unencrypted form for now; new writes use the scheme above.
How long we keep it
As long as your account is active, your data is retained. When you delete your account from the Settings screen, your profile, goals, reflections, and responses are marked deleted immediately and permanently removed after a 30-day grace period during which deletion can be reversed by contacting support. Feedback rows you submitted may be retained anonymized (with all links to your account severed) for service-quality purposes.
Server logs are kept for 14 days, then deleted automatically.
Your rights
- Export. Settings → Data → Export your data produces a JSON file containing your profile, goals, reflections, responses, and feedback. You can save this to your Files app, email it to yourself, or move it to another service.
- Edit. Profile, goals, and tradition can be edited at any time from Settings. Past reflections can be deleted individually.
- Delete your account. Settings → Data → Delete account. This starts the 30-day deletion window described above.
- Ask us a question. support@holystic.ai — we read these.
Children
holystic is intended for adults. We do not knowingly collect data from children under 13. If you believe a child under 13 has created an account, please contact support and we will remove the account.
Changes to this policy
We'll update the "Last updated" date at the top of this page when anything changes. Material changes — like a new category of data we collect, or a new service we send data to — will be flagged in the app before they take effect.
Contact
Holystic.ai LLC
support@holystic.ai