Privacy Policy

Last updated: 19 October 2026

1. Who is responsible for your data

Enodo is operated by Ilia Elistratov, an individual developer based in Türkiye. For any privacy question or request, contact us at hello@getenodo.com.

2. What we collect

• Account data: your email address (used to create and secure your account).
• Your Content: the text of your reflections, journal entries, and anything you add in the App.
• Technical data: basic device and usage information (e.g. app version, device type, interactions) needed to run and improve the App.
• Payment data: handled by Apple or, on the web, by Whop. We do not see or store your card details; we may receive limited transaction status (e.g. whether a subscription is active).

3. Why we process your data, and our legal basis

• To provide the App (create your account and save your reflections) — legal basis: performance of our contract with you.
• To process what you share with AI (generate reflections, insights, and summaries), including any sensitive information it contains — legal basis: your explicit consent (see "Your consent" below).
• To keep the App secure and working and to improve it — legal basis: our legitimate interests.
• To communicate with you about your account (e.g. password reset, essential notices) — legal basis: contract / legitimate interests.
• To understand how the App is used through pseudonymous product analytics (see PostHog below) — legal basis: our legitimate interests. You can object at any time by writing to us.

Your consent. Before you create an account, the App asks for two separate consents, each with its own checkbox: to our Terms of Use and this Privacy Policy, and to AI processing of what you share. We record which consent you gave, for which version of these documents, and when.

What you write may reveal sensitive information, such as details about your health, mental wellbeing, or relationships. We process it only to provide the App, and the explicit consent you give to AI processing covers it.

You can withdraw your consent at any time by deleting your account in the App or by writing to us. Because Enodo's features depend on AI, withdrawing it means we can no longer provide the App to you: we stop processing your content and delete your account and data, except the record of your consents (see section 8). Withdrawal does not affect processing that took place before it.

4. Where your data is stored

Your account and Your Content are stored on our backend infrastructure provided by Supabase. Unlike some device-only apps, Enodo stores your reflections on secure servers so features can work across sessions and devices.

5. AI processing

We send your content to AI providers only after you have given your explicit consent (see section 3). When you use AI features, the relevant text is sent to one of our AI providers — Anthropic, OpenAI or Google — which processes it solely to generate the response you requested and returns it to the App. Any single request is handled by one provider only.

• Your content is not used to train their models. Neither provider trains on data submitted through their API by default.
• Providers keep API requests only for a limited time to detect abuse — up to 30 days by default — and then delete them, unless longer retention is required by law or to investigate a violation of their usage policies.
• We do not sell your content and do not use it for advertising.

6. Who we share data with (service providers)

We share data only with providers that help us run the App, under their own privacy terms:

• Supabase — data storage and authentication.
• Anthropic, OpenAI and Google — AI processing.
• Apple — payment processing for in-app subscriptions.
• Whop — payment processing for web subscriptions. You enter your payment and billing details directly with Whop; we send it only your plan and a pseudonymous account identifier, and receive back the status of your subscription. See Whop's Privacy Policy.
• PostHog — product analytics. We send pseudonymous usage events (such as onboarding steps and feature usage) — not the content of your reflections. We ask PostHog not to look up your location from your IP address.
• Sentry — error monitoring. When something breaks, it receives technical details of the failure (the error type, a short message and where in the code it happened) along with a pseudonymous account identifier, so we can find and fix it. It never receives the content of your reflections.
• Resend — email delivery and receiving (such as password resets, account notifications, and messages you send us at hello@getenodo.com).
• Cloudflare — bot protection when you sign in or create an account (Turnstile). It receives technical signals from your browser, such as your IP address and device characteristics, to tell people apart from automated scripts. It never receives your reflections. See Cloudflare's Turnstile Privacy Addendum.

We do not sell your personal data to anyone.

7. Your rights

Depending on where you live (including under the EU GDPR and Türkiye's KVKK), you can:

• access a copy of your data;
• correct inaccurate data;
• delete your data ("right to be forgotten");
• export your data;
• object to or restrict certain processing;
• withdraw consent where processing is based on it.

To exercise any of these, contact us at hello@getenodo.com.

8. Deleting your account and data retention

You can delete your account at any time in the App. When you do, we delete Your Content and account data from our active systems within a reasonable period. Some minimal records may be kept where required by law (e.g. accounting or fraud prevention). We also keep the record of the consents you gave (which consent, for which version of these documents, and when, linked to a pseudonymous account identifier) after your account is deleted, as proof of your consent.

9. International data transfers

Our providers may process data outside your country, including in the United States. Where required, such transfers rely on appropriate safeguards (such as Standard Contractual Clauses).

10. Children

Enodo is intended for users 18 and older. We do not knowingly collect data from children. If you believe a minor has used the App, contact us and we will delete the data.

11. Security and encryption

Your reflections and other personal entries are encrypted using AES-256, both in transit and at rest. The encryption key is stored separately from the database in a secure vault, so if someone gained access to the raw database, they would see only unreadable data. Access between users is isolated, so one user cannot read another user's entries.

Your entries are decrypted only automatically, inside our secure server functions, and only to perform the actions you requested (such as generating an insight or sending text to the AI). We do not read your entries and we do not access them manually.

Please note: because AI features require your text to be processed on our servers, Enodo is not end-to-end encrypted — full end-to-end encryption would make AI-generated insights impossible.

No system is 100% secure, but we apply reasonable technical and organizational measures to reduce risk.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will update the "Last updated" date above and, for material changes, notify you in the App or by email.

13. Contact

For any privacy question or request: hello@getenodo.com.