Privacy Policy

Last updated: October 31, 2026

Balm is a self-help CBT journaling tool. It is designed around a simple principle: your personal writing stays private and on your device.

Who we are

Balm is published by an individual developer. There is no account system and no sign-in. We do not operate servers that store your journal.

Contact: vika.abr71@gmail.com

What data we process and where it lives

Your journal entries - on device only

• Everything you write - thought records, mood check-ins, and notes - is stored only on your device, in encrypted form (AES; the encryption key is held in the device Keychain).
• Your journal is never uploaded to us. We have no database of your entries and cannot read them.

AI thought suggestions - optional, off by default

• The "AI suggestions" feature is optional and turned off by default. It stays off until you explicitly enable it and confirm a consent screen.
• When enabled, and only when you tap to request a suggestion inside an exercise, the text of that single exercise is sent to an AI provider - Anthropic (Claude models) or Google (Gemini models), routed via OpenRouter - to generate one balanced-thought suggestion.
• We send only the fields of that one exercise (situation, automatic thought, evidence, thinking pattern), exactly as you wrote them. Balm does not attach an account identifier, a device identifier, dates, or any other entry from your journal - so leave out names you would rather keep private.
• The request is configured to require providers with zero data retention (no use of the text for training). Our thin relay does not log or store the request or response text.
• You can turn the feature off again at any time in Settings → AI thought suggestions. Turning it off revokes consent immediately.

Weekly reflection - optional, Premium, off by default

• The weekly reflection is optional, turned off by default, and part of Balm Premium. It stays off until you explicitly enable it and confirm a separate consent screen.
• When enabled, an anonymous summary of your week is sent to the same providers: counts, mood statistics, pattern categories, and a short note carried over from your previous reflection (that note is itself written by the AI from such a summary).
• We do not send the text of your entries, your name, or any identifier.
• You can turn it off again at any time in Settings.

Diagnostics - only with your permission, no journal content

• Balm asks whether it may send usage statistics and error reports, with two equal choices: "Allow" and "Don't allow". Until you choose, and if you choose "Don't allow", nothing is sent to PostHog or Sentry.
• Error reports: we use Sentry to receive reports about errors in the app so we can fix stability issues. Screenshots are not attached.
• Usage analytics: we use PostHog to understand which screens and features are used (for example, that the subscription screen was opened). Events never include the text or content of your entries.
• These tools receive technical data such as app version, iOS version, language, time zone, and a random identifier created on your device. That identifier is not linked to your name or email. They never receive your journal content.
• You can change your choice at any time in Settings → Your data → Anonymous statistics and error reports. Turning it off stops sending immediately and discards events not yet sent.

Subscriptions - anonymous subscriber ID

• Balm Premium is purchased through the App Store. We check your subscription status with RevenueCat: it receives the App Store purchase information it needs and works with an anonymous subscriber ID - not your name, email, or entries.

How your data is used

• Journal entries: to provide the app's core functionality on your device.
• AI suggestion text: solely to return one balanced-thought draft for that exercise; not retained.
• Diagnostics: solely to keep the app stable and improve usability.
• Subscription status: solely to unlock the Premium features you purchased.

We do not sell your data and do not use your journal content for advertising.

Your controls

• Export: export your full journal as a file at any time from Settings → Export journal, and keep your own copy. Export before changing iPhones: an iCloud backup does not move your journal, because its encryption key moves only with an encrypted backup on a computer.
• Delete: permanently delete all entries from Settings → Delete all data. This also stops statistics and error reports and erases your choice and the random identifier, so Balm asks again. Statistics and error reports already sent to PostHog or Sentry are not deleted this way. Deleting the app from your device also removes the on-device journal.

Legal bases (EEA/UK users)

Where GDPR applies, processing of journal content happens on-device under your control. Sending exercise text to the AI provider relies on your explicit consent (which you can withdraw). Diagnostics rely on your consent, which you can withdraw at any time in Settings. Checking your subscription status is necessary to provide the Premium features you purchased.

Children

Balm is not directed to children and is intended for adults.

Changes

We may update this policy. The "Last updated" date above will change when we do.

Contact

Questions about this policy: vika.abr71@gmail.com