PofunaPrivacy Policy
2026-11-03
Pofuna is a personal reflection app. This policy explains what information is processed and how to manage your choices.
Information we process
Registration uses your first name, last name, email and password. Supabase handles authentication; your password is not added to journal entries. Your records include situations, thoughts, mood and energy ratings, pattern notes, screening results and support cards. These entries may contain health or other personal information you choose to write.
Purpose and storage
We use information to operate your account, store and sync your records, provide requested features and protect the service. Reflections not yet uploaded remain on your device. After you sign in to a verified account and accept the in-app privacy terms, eligible local records can sync to your account. Language, appearance and reminder preferences are stored on your device.
Supabase and OpenAI
Supabase processes account and cloud records, including support cards. AI help is separate and optional. With permission, written chat shares your messages and related reflection context; field help shares the related reflection text; standalone card help shares your card draft with OpenAI. Opening card creation from a reflection with AI permission enabled automatically prepares suggestions from that reflection. Sharing is for suggestions and safety checks. Account details are not added to the text; personal information within your writing is included. Suggestions may be incorrect. You can turn off written AI help in Settings.
Reporting AI responses
If you choose to report an AI response, the app previews up to 2,000 characters from that selected response only. Choosing to prepare an email opens an editable draft addressed to support; you decide whether to send it. The response may contain private information. Review the draft and remove anything you do not want to share before sending. Your entire conversation is not sent automatically. If you send the email, its contents and your email address are processed through support to review the report and respond if needed. This is not an emergency response channel.
Choices and deletion
Disabling AI in Settings stops new sharing; it does not undo earlier requests. Delete my data removes exercise records while keeping your account. Delete entire account removes the authentication account and associated app records. You may be asked to prove account ownership. Offline devices reconcile earlier records with deletion information when they reconnect.
Logs, backups and international processing
Account and reflection records remain in the active database while your account is open or until you delete them. Delete my data and Delete entire account remove the relevant records from the active database. Provider security logs and backup copies may remain longer under provider security policies and applicable law, so deleting active records does not mean earlier AI requests or backups are erased at the same time. Infrastructure providers may process information outside your country.
Technical error and crash reports (Sentry)
We use Sentry to find and fix problems such as the app failing to open, crashing or encountering a technical error during an operation. Reports may include the error type and a fixed technical error code, code file/function/line information, app version, platform, event time and limited technical operation steps. Your reflections, AI replies, audio, transcripts, mood and screening data, name, email, account ID and persistent device ID are not included. Your real IP address is not added to error events, and IP-based location enrichment is disabled; the provider can technically see the network address when establishing the internet connection. Screenshots, screen recording, session replay, automatic interaction tracking and performance tracing are disabled. Reports are not used for advertising, user profiling or matching against your account records.
Basis, retention and your rights for technical reports
This limited technical error processing relies on our legitimate interest in maintaining the app’s reliability and security. It is separate from optional PostHog usage analytics and does not change that choice. Our Sentry project uses the European Union data storage region; provider support and security operations may involve international transfers. The current Developer plan retains individual error events for 30 days. Grouped issue summaries and provider backups may remain longer; this does not guarantee every copy is erased on the same day. Because account identifiers are not sent, deleting your account does not automatically locate and erase Sentry reports. To object or request erasure under applicable law, contact the support address on this page. An approximate error time and app version may help locate a report; do not send private reflections or your password.
Optional usage analytics
Usage analytics stays off until you choose to enable it. If you opt in, screen opens, onboarding and reflection-step completion, subscription-screen and purchase interactions, help requests, connection error categories and response times are processed in PostHog’s EU region. Measurements also include language, platform, event timestamps and limited counts. We use these to understand what helps and where the app needs improvement. Your reflections, suggestion text, audio and transcripts, mood ratings, screening answers and results, name and email address are not sent to PostHog. Session recording and automatic text capture are disabled.
Identifiers used for analytics
Before sign-in, analytics uses a random technical identifier stored on your device. After sign-in, it uses a pseudonymous identifier derived from your account ID; earlier events collected with your permission may be linked to it. These measurements are therefore not fully anonymous. Your raw account ID, name and email address are not attached to PostHog events. We do not use an advertising identifier, and location enrichment is disabled.
Your analytics choice and deletion requests
Declining analytics does not restrict the app’s features. You can change your choice in Profile → Privacy. Turning it off stops new measurements and discards events not yet sent. This does not automatically erase records already received by PostHog, nor does deleting your app account. To have those records deleted too, contact the support address on this page. Once we verify account ownership, we arrange deletion of the related analytics records. You do not need to share your private reflections or password. The current PostHog plan’s one-year analysis window does not mean records are permanently erased at the same time.
Subscriptions and purchases
Purchases are made through the App Store on iOS and Google Play on Android. We use RevenueCat to validate subscriptions, manage access and voice balances, restore purchases and understand sales. This involves an account-linked user identifier, product and transaction identifiers, purchase history and subscription status. Pofuna does not receive your payment card number or bank details. Your reflections, mood ratings and screening results are not sent to RevenueCat. Transaction records that must be kept by law may remain for the required period after account deletion.
Notifications and tracking
Daily reminders are optional local notifications. By default, notifications do not contain your private card text. If you explicitly enable card text, the selected sentence may appear on the lock screen. Disable reminders in the app or device settings. This release uses no advertising networks or marketing tracking.
Rights and contact
Depending on applicable law, you may have rights to access, correct or erase information and request details about processing. Contact the publisher shown on this page. The app is not professional care or an emergency response service.
Optional depression symptom screening
When a signed-in user aged 18 or older completes PHQ-9, the latest score, date, questionnaire language, daily-life impact and support flag are stored in their Supabase account. A new screening replaces the previous result. Individual answers are sent to the server for scoring but are not stored in the database or shared with OpenAI. The account holder can view the result and remove it from the active database through Delete my data or Delete account. It is not a diagnosis.
Optional voice reflections
Before a voice reflection starts, we explain how your audio and transcript are processed; your choice is remembered on your device and can be reset. Microphone audio and an automatic transcript are processed by OpenAI to run the conversation and prepare an editable draft. Pofuna does not store raw audio. If you accept the updated notice explaining account storage, the full transcript submitted for draft preparation is saved to your Supabase account with speaker roles and timestamps. The text is retained even if draft preparation fails, so transfer problems can be investigated; it is not added to product analytics or application logs. Older app versions that do not show this updated notice do not save transcripts to this table. “Delete my data” or deleting your account removes these transcripts from the active database. If you separately confirm “Transfer text and continue”, the transcript is also saved as part of your written chat; deleting that chat removes this copy. OpenAI session recording is disabled (store: false). This does not override the provider’s safety-related processing and retention policies. If you leave without preparing a draft or transferring text, the transcript remains only temporarily in device memory. A draft you approve is saved as a regular reflection. To limit misuse and costs, we retain account-linked session identifiers, consent version, start and closure times, and request counts; these are deleted when the account is deleted. You can mute the microphone or end the call. Audio transmission stops when you leave the app. Voice sharing is initiated separately for each call; enabling written AI help does not start a voice call.
Optional Google Analytics on the website
On the www.pofuna.com marketing website, Google Analytics 4 loads only after separate permission for website analytics. Before consent, or if you decline, the Google measurement tag does not load and no analytics requests are sent. With permission, it can measure page visits, the referring site’s domain only, basic browser/device information and approximate country/region. URL query parameters and fragments are excluded. Form text, mood-demo choices, app health records, journals, account IDs and email addresses are not included. Analytics cookies can link visits in the same browser, so measurement is not fully anonymous. Advertising personalization and Google Signals are disabled, and automatic enhanced interaction measurement is not used. Analytics cookies expire after 30 days; user/event-level retention is limited to 2 months and is not extended by new activity. Aggregate standard reports may have different retention. Google can technically see the network address when establishing a connection and may process data outside your country. Your website analytics choice is stored in this browser for 180 days. A necessary preference cookie may also store your withdrawal to keep measurement off. Withdraw permission with the “My cookie choices” footer button: new measurement stops, accessible Analytics cookies are removed and the page reloads. Withdrawal does not automatically erase data already received; contact support about related requests. The mobile app’s PostHog permission is separate.
Supabase Privacy · OpenAI Privacy · PostHog Privacy · RevenueCat Privacy · Sentry Privacy · Google Privacy