← Back to home

Privacy Policy

Effective Date: March 22, 2026

What Went Right Today? is designed to be a private, simple reflection tool. This policy explains what data is collected, how it is used, and how it is handled.

Information we collect

Account information

We use third-party authentication providers, such as Google and Apple, to allow you to sign in securely. Those providers process identity information as part of authentication. When you sign in, we receive the information needed to create and manage your account, which may include your name, email address, profile image, and provider account identifier, depending on the provider and your permissions.

If you choose to sign in with Apple, you may have the option to hide your email address. In that case, we receive a private relay email address provided by Apple instead of your personal email address.

This is used to:

  • create and manage your account
  • allow you to sign in securely
  • display your profile information inside the app

Reflections you write

Reflections you create in the app are stored so they can be displayed back to you.

  • Reflection content is treated as private
  • Sensitive reflection content is encrypted in storage using application-layer encryption
  • Reflection content is decrypted only when needed to provide requested functionality, such as viewing, exporting, restoring, or deleting reflections
  • Reflection content is not used for analytics, advertising, or shared with third parties

Usage and operational data

We collect limited technical and usage information necessary to operate and secure the app, such as:

  • request metadata, such as timestamps, browser or user agent, referrer information, and page or screen requests
  • security-related data, such as IP address, security events, audit events, and rate-limiting information
  • performance and reliability data, such as browser and device characteristics, performance metrics, and approximate geographic information derived from network requests

This data is used only for:

  • maintaining service reliability
  • protecting against abuse
  • securing accounts and investigating incidents
  • maintaining system integrity
  • understanding overall app usage at a high level

We do not use this data to profile you or analyze your personal reflections.

How your data is used

Your data is used only to:

  • provide and maintain the app
  • allow you to access your reflections
  • improve reliability and performance
  • enforce security measures

We do not sell your data or use your reflections for advertising.

Google and Apple process identity information when you use them to sign in. We do not sell or disclose your data to Google, Apple, or any other authentication provider beyond what is required for authentication, and we do not provide them with your reflection content.

Data retention and deletion

  • Reflections you delete are removed from your main history immediately
  • Deleted reflections can be restored for up to 30 days
  • After 30 days, they are permanently deleted

If you request account deletion, your account remains usable during a 14-day grace period and you may cancel from Settings before processing begins. Final deletion removes your user account, linked Google or Apple authentication account records, active sessions, saved reflections, and account settings directly tied to the user. See account deletion instructions.

Limited records may be retained when reasonably necessary for security, fraud prevention, legal compliance, auditing, and system integrity. Retained records cannot restore deleted reflections or recreate the deleted account.

Data security

We take reasonable measures to protect your data:

  • data is encrypted in transit
  • sensitive reflection content is encrypted in storage using application-layer encryption
  • access to data is limited to what is necessary to operate the service

Third-party services

We use third-party services to operate the app, including:

  • Google (for authentication)
  • Apple (for authentication)
  • Vercel (for hosting, analytics, and performance monitoring)

These providers may process data as necessary to provide their services. Vercel Analytics and Vercel Speed Insights help us understand application usage, improve reliability, and monitor performance. These services may receive information such as page or screen requests, browser and device characteristics, performance metrics, referrer information, and approximate geographic information derived from network requests. Authentication and analytics providers do not receive your reflection content from WWRT.

Open-source software licenses and required attribution are available in our third-party software notices.

Your control

You can:

  • edit or delete your reflections at any time
  • restore deleted reflections within the retention window
  • delete your account
  • request a copy of the data associated with your account

Data access requests

You may request a copy of the data associated with your account. This may include account information, reflection data, and other data we retain to operate and secure the service.

Changes to this policy

We may update this policy from time to time. Updates will be reflected on this page with a revised effective date.

Contact

If you have questions about this policy, you can contact us at: privacy@whatwentright.app