Privacy Policy — Phoenix

What Phoenix is

Phoenix is a personal life-design application: a private journal, life-area tracking, commitments, and related reflection tools. It is operated by Jonathan Mitchell Anderson (“we”, “us”).

Data we store

Account data: your e-mail address, display name, and a password hash if you sign up with a password. If you sign in with Google, we receive your Google account’s e-mail address, name, and profile picture URL, and we store an identifier linking your Phoenix account to that Google account. We do not receive or store your Google password.
Content you create: journal entries, commitments, life areas, relationships, reflections, autobiographical milestones, and any other information you enter in the application.
Payment and subscription data: when you purchase Foundation or subscribe to Architect, transactions are processed by Stripe, Inc. We store your Stripe customer identifier, subscription identifier, subscription status, billing interval (monthly or annual), renewal dates, invoice history, and upgrade inquiry submissions. We do not receive, process, or store your credit card number, expiration date, or security code (CVC); all cardholder credentials are submitted directly to and stored by Stripe under PCI-DSS Level 1 compliance.
Technical data: server logs containing request metadata (time, path, status, IP address) kept for operating and securing the service.

Where it is stored

Data is stored in a PostgreSQL database hosted in Toronto, Canada (Fly.io). It is not sold, and it is not shared with third parties except as needed to operate the service (hosting, payment processing) or when the law requires it.

Third-Party Data Processors & Model Providers

We partner with a strictly limited set of infrastructure and service providers:

Payment processing: Stripe, Inc. processes checkout sessions, recurring subscription billing, the Customer Portal, and statutory sales tax calculations.
AI & LLM model providers: If and only if you explicitly enable AI-assisted reflection features (such as pattern detection, AI synthesis, or Wisdom Coach), designated entry excerpts are transmitted to third-party artificial intelligence model providers: Anthropic, PBC (Claude models) and OpenAI, LLC (GPT models). Data transmitted to model providers is processed transiently for real-time inference and generation; per our enterprise agreements, your personal reflections and entries are never used to train or fine-tune public foundation models. If you do not consent to AI features or keep them disabled, no journal entries or reflections are ever transmitted to AI model providers.

How Google sign-in data is used

Google account information is used only to create and authenticate your Phoenix account. We request the openid, email, and profile scopes and nothing else. Phoenix’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Data Retention & Statutory Requirements

In accordance with Canadian federal (Canada Revenue Agency) and Quebec provincial statutory tax requirements (DEC-0142 D-K), financial and transaction records (including invoice identifiers, payment dates, amounts, and currency) are retained for seven (7) years following the end of the taxation year to which they relate.

When an account is closed or deleted, these statutory accounting records are retained in pseudonymised form, unlinked from your personal identity, while all personal reflective writings, notes, and application content are permanently erased.

Your control

Your journal is private to your account; nothing is published or shared unless you explicitly choose to. You can export your full data inventory at any time from Settings › Export (/settings/export).

From Settings you can close your account (your identity is erased; content is retained, no longer linked to you — records we are required to keep are retained for seven years) or delete your account and all of its data outright.

Deleting your account outright does not happen immediately. We keep the account, unchanged, for up to seven days after you ask — in case the request was a mistake — during which you can cancel and keep your account by signing back in. After seven days the account and everything in it are permanently deleted; the only thing kept afterwards is a content-free record of when it happened and how many rows were removed, containing no names or text.

Contact

Questions about this policy or your data: admin@richereverydayineveryway.com