Privacy Policy

Last updated · October 20, 2026

1. Who we are

Snowball is a personal habit-tracking and reflective-journaling app for iOS. It is operated by JL Labs LLC, a Michigan limited liability company based in Troy, Michigan, USA. If you have questions about this policy or your data, contact us at support@trackwithsnowball.app.

This Privacy Policy explains what personal information we collect, why we collect it, who we share it with, how we protect it, and the choices and rights you have.

2. Plain-language summary

• What Snowball is for: tracking habits and writing short, private journal entries and reflections, with AI-generated “recap” letters that look back on your week or month.
• The most sensitive data you give us is your journal content (typed text and, if you use voice journaling, the audio you record). We encrypt journal entries and recap letters at rest with a per-user encryption key.
• We use a small number of trusted service providers to run the App: Supabase (database, authentication, and server functions), Apple and Google (sign-in), Deepgram (voice-to-text), Anthropic Claude (cleaning up transcripts and writing recap letters), PostHog (analytics), Resend (emailing you your data export), and Expo (app infrastructure and notifications).
• We do not sell your personal information, and we do not use your journal content to advertise to you.
• You can export or delete your data at any time. From Settings you can email yourself an export of everything Snowball stores about you, and deleting your account permanently removes your habits, journal entries, recaps, and other associated records from our database.

This summary is for convenience only; the full policy below governs.

3. Information we collect

3.1 Information you provide

• Account and identity information. When you sign in with Apple or Google, we receive your name (Apple, on first sign-in, if you choose to share it) and email address. If you sign in with a one-time email passcode, we receive your email address.
• Journal content. The text you write in your journal entries, including answers to your selected reflection prompts. If you use voice journaling, we process the audio recording you make in order to transcribe it into text; the audio is processed in memory and discarded after transcription — we do not store your recordings.
• Habit data. The habits you create (names and settings) and your completion logs (which habits you marked complete, and when).
• Onboarding responses. Optional answers you give during onboarding, such as your motivations, the struggles you identify with, an “identity” statement, and a description of your typical day. These can be skipped.
• Preferences. Your notification preferences and reminder times, and whether journaling is enabled.

3.2 Information collected automatically

• Device time zone. We store your device’s time zone so reminders and weekly/monthly windows line up with your local day.
• Usage and product analytics. We use PostHog to understand how the App is used. This includes screen views, in-app actions (for example, creating or completing a habit, submitting a journal entry, or viewing the subscription screen), app lifecycle events, and touch interactions. Analytics are associated with a user identifier; we do not send your email or name to our analytics provider, we do not use session replay, and we never send your journal text, habit names, or reflection answers.
• Notifications. Daily habit and journal reminders are scheduled on your device — no token is stored for those. If you keep “Recap ready” notifications enabled (you can turn them off in Settings), the App registers a push notification token that we store and use solely to notify you when a new recap letter is ready. The token is removed when you sign out, and our log of sent notifications records the recap type and period only — never the recap content.

3.3 Payment and subscription information

Snowball offers paid features through Apple In-App Purchase. Apple processes your payment; we do not receive or store your full payment card details. We store subscription status and transaction identifiers necessary to provide paid features.

3.4 Information we do not collect

We do not intentionally collect precise geolocation, contacts, photos, or health-app data. We do not require a password (authentication is handled by Apple, Google, or a one-time email passcode).

4. How we use your information

• Provide the core service — store and display your habits, logs, and journal entries across your sessions.
• Transcribe voice journals — convert your recorded audio into editable text.
• Generate recap letters — produce personalized weekly/monthly reflections from your journal entries and habit history.
• Send reminders — deliver the habit and journal notifications you opt into.
• Operate, secure, and improve the App — including analytics, debugging, and preventing abuse.
• Communicate with you — for account, security, and support purposes. Sign-in passcode emails are delivered by Supabase, our authentication provider.
• Comply with legal obligations and enforce our Terms of Service.

We rely on the following legal bases where applicable (e.g., GDPR/UK GDPR): performance of a contract (providing the App you signed up for), consent (optional onboarding answers and voice journaling), legitimate interests (securing and improving the App, including analytics), and legal obligation.

5. Third-party service providers

We share limited data with the providers below strictly to operate the App. Each is bound by its own terms and privacy commitments. We do not sell your personal information, and we do not permit these providers to use your data for their own independent purposes beyond providing their service to us.

Provider policies: Supabase · Apple · Google · Deepgram · Anthropic · PostHog · Resend · Expo

6. How AI processing works with your data

Snowball uses two AI providers, both invoked server-side from our backend — never directly from the app, and never with your account credentials:

• Deepgram receives only the audio you record for a voice journal entry and returns text.
• Anthropic (Claude) receives the raw transcript text from that audio and returns a cleaned-up version, and receives your journal text and habit history for a recap period and returns a recap letter.

We send these providers only the content required to perform the task, and we do not attach your name or email to those requests. These providers act as our processors and are contractually restricted in how they may use the data:

• Anthropic does not train its models on content sent through its commercial API, and automatically deletes API inputs and outputs from its systems within 30 days, except where longer retention is required by law or by its safety enforcement.
• Deepgram is instructed not to use your audio or transcripts to improve its models. Under that setting, Deepgram keeps them only for as long as it takes to process the request; it retains request metadata and usage logs, which contain no audio or transcript text, for up to 90 days.

Voice journaling is optional — if you prefer, type your entries and no audio is ever created. Recap letters are generated from your stored journal and habit data as part of the core product.

7. How we protect your data

• Encryption in transit. Data moves between the App, our backend, and our providers over encrypted (HTTPS/TLS) connections.
• Encryption at rest for your most sensitive content. Your journal entry answers and recap letters are encrypted in our database. Each user has an individual data encryption key, which is itself encrypted (“wrapped”) by a master key stored in a separate secrets vault. Only our secured server role can decrypt this content to provide it back to you; the encryption keys are not accessible to ordinary application or client access.
• Access controls. We use row-level security so that users can access only their own records, and we restrict server-only data (such as recaps and subscription records) to privileged backend processes.
• No system is perfectly secure. While we work to protect your information, we cannot guarantee absolute security.

8. Data retention

• Account and app data (habits, logs, journal entries, recaps, preferences) is retained until you delete it or delete your account.
• Voice audio is processed in memory to produce your transcript and is not stored on our servers.
• Data exports you request are delivered by email through Resend, which retains the message and its attachment for 30 days.
• Analytics data is retained by PostHog for one year. It is not automatically deleted when you delete your account, but you can ask us to delete it (see Section 9).
• Push notification receipts are cleared by Expo after 24 hours.

Our database provider does not currently keep automated backups of our database. When you delete content or your account, it is removed from our live database and no separate backup copy is kept by us.

9. Your rights and choices

Depending on where you live (for example, under GDPR/UK GDPR or the CCPA/CPRA), you may have the right to access, correct, export, delete, or restrict the processing of your personal information, and to withdraw consent.

• Access. You can view your entries, habits, and history in the App.
• Correction. You can edit or update your journal entries, habits, and preferences in the App.
• Deletion. You can delete individual entries in the App, and you can delete your entire account, which permanently removes your associated data — habits, habit logs, journal entries, reflection history, recaps, and subscription records — from our primary database.
• Portability. From Settings you can email yourself an export of your data — journal entries with the prompts you were shown, habits and completion logs, recap letters, and your profile. We also offer the export before you delete your account.
• Analytics. Product analytics is integral to operating the App and does not currently offer an in-app opt-out; it never includes your journal content, habit names, or reflection answers.
• Exercising your rights. Contact us at support@trackwithsnowball.app. We will respond within the time required by applicable law, and we will not discriminate against you for exercising your rights.

10. Data location and international transfers

We are based in the United States, and our database and backend are hosted by Supabase in the United States (AWS East US, Ohio). Our other providers may also process data in the United States and other countries. If you access Snowball from outside the United States, your information will be transferred to and processed in countries whose data-protection laws differ from your own. Where required, we rely on appropriate safeguards for these transfers, such as the Standard Contractual Clauses incorporated in our providers’ data processing agreements.

11. Children’s privacy

Snowball is not directed to children, and we do not knowingly collect personal information from children under 13 — or, where you live, under the age at which a child may consent to data processing without a parent (16 by default in the EU/EEA, lower in some countries). If you believe a child has provided us personal information, contact us and we will delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date and, where appropriate, provide additional notice in the App. Your continued use of Snowball after an update means you accept the revised policy.

13. Contact us

JL Labs LLC · Troy, Michigan, USA
Email: support@trackwithsnowball.app · or use our support page.