Terms of Use & Privacy Policy

By downloading, accessing, purchasing, or using the App, you agree to these Terms of Use. If you do not agree, do not use the App.

Apple's Licensed Application End User License Agreement (the “Apple Standard EULA”) also applies. These Terms supplement the Apple Standard EULA. If they conflict, the Apple Standard EULA controls to the extent of the conflict. Apple is not responsible for the App or its support.

You must be at least 13 years old to create an account or use the App on your own. If you are under the age of legal majority where you live, your parent or legal guardian must review and agree to these Terms for you. The App is not directed to children under 13.

An App Store age rating describes the type of content in an app; it does not replace these eligibility rules or applicable privacy law.

Subject to these Terms and the Apple Standard EULA, Wind Down Studio grants you a personal, limited, revocable, non-exclusive, non-transferable license to use the App on Apple-branded devices you own or control as permitted by Apple's usage rules.

You may not copy, sell, rent, sublicense, distribute, reverse engineer, interfere with, or attempt unauthorized access to the App or its services, except where applicable law expressly permits it.

Current versions of One Year use Sign in with Apple or Sign in with Google for accounts and cross-device sync. You are responsible for maintaining control of the Apple or Google account you sign in with and your devices, and for activity through your account.

Some people using an older version may continue in a legacy iCloud mode without creating a One Year account. Features and storage behavior may differ between legacy and current versions.

Please contact us promptly if you believe your account or journal has been accessed without authorization.

You keep ownership of the journal entries, moods, images, voice recordings and their transcripts, drawings (“doodles”), and other content you add to One Year (“Your Content”). You give Wind Down Studio a limited permission to host, process, encrypt, transmit, restore, and otherwise handle Your Content only as needed to operate, secure, support, and improve the App as described in the Privacy Policy.

You are responsible for Your Content and for making sure you have the right to store it. Do not use the App to store or transmit unlawful content, infringe another person's rights, introduce malicious code, attack the service, or attempt to access another user's data.

One Year includes an export tool so you can download your journal, including available text, mood, image, voice-recording, and drawing content. You should keep exports of anything you cannot afford to lose.

One Year may offer free features and paid weekly, monthly, or annual subscriptions, as well as a one-time lifetime purchase. Available plans, prices, features, currencies, eligibility, and promotions can vary by location and over time. The terms displayed by Apple when you confirm a purchase control that transaction.

Subscriptions automatically renew unless you cancel through your Apple account before the renewal date. Apple charges your Apple account and manages billing, renewal, cancellation, and refunds. Deleting the App or your One Year account does not automatically cancel an Apple subscription.

If Apple offers you a free or discounted trial, its length and eligibility will be shown before purchase. Unless you cancel before the trial ends, it converts to the paid subscription shown at checkout. Promotional and introductory offers may change or end.

You can manage or cancel Apple subscriptions and request a refund from Apple.

We may add, change, suspend, or discontinue features as One Year evolves. We work to keep the App available and your data safe, but uninterrupted access, error-free syncing, or permanent availability is not guaranteed.

Features may depend on Apple services, iCloud, Supabase, Cloudflare, internet access, device compatibility, or other third-party services outside our control. Apple Intelligence features also depend on an eligible device and Apple's on-device model availability.

Some features work with Apple's Siri, Spotlight, Shortcuts, and Apple Intelligence. Those features are provided by Apple, depend on your device, region, language, and settings, and Apple's terms and privacy policy apply to them.

You may stop using the App at any time. Signed-in users can delete their account from One Year's settings. Account deletion removes the active One Year backend account and associated synced journal data, but it does not cancel an Apple subscription or necessarily delete records Apple, RevenueCat, Meta, or another provider must retain under its own legal obligations.

We may suspend or terminate access if you materially violate these Terms, threaten the service or other users, or if required by law. Where practical, we will give notice and a chance to export Your Content first.

One Year is a personal journaling tool. It is not medical, mental-health, legal, financial, or other professional advice, and it is not an emergency service.

To the fullest extent permitted by law, the App is provided “as is” and “as available,” without warranties of merchantability, fitness for a particular purpose, non-infringement, availability, or data preservation. Nothing in these Terms excludes warranties or consumer rights that cannot lawfully be excluded.

To the fullest extent permitted by law, Wind Down Studio and its members, employees, and service providers will not be liable for indirect, incidental, special, consequential, exemplary, or punitive damages, or for lost data, revenue, profits, goodwill, or opportunities arising from the App.

To the fullest extent permitted by law, Wind Down Studio's total liability arising from the App or these Terms will not exceed the greater of the amount you paid for One Year during the 12 months before the event giving rise to the claim or US $100. These limitations do not apply where prohibited by law.

These Terms are governed by the laws of the State of Delaware, without regard to conflict-of-law rules. Any dispute that cannot be resolved informally may be brought in the state or federal courts located in Delaware County, Delaware.

If the law where you live gives you mandatory consumer protections or the right to bring a claim elsewhere, this section does not take those rights away. These Terms do not require arbitration or waive participation in a class action.

If a provision of these Terms is unenforceable, it will be limited to the minimum extent necessary and the remaining provisions will remain in effect. Our failure to enforce a provision is not a waiver. You may not transfer these Terms without our consent; we may transfer them as part of a merger, financing, reorganization, or sale of the App or our business.

We may update these Terms as the App, law, or our practices change. We will post the updated date here and provide additional notice in the App when a change is material. Continued use after the effective date means you accept the updated Terms to the extent permitted by law.

Wind Down Studio, LLC is the controller of personal information covered by this Policy.

Account and authentication data

When you create an account with Sign in with Apple, we receive an Apple-provided account identifier and authentication credentials. Depending on the information Apple includes and your Apple privacy choices, Supabase may also receive your email address or Apple private relay email address.

When you sign in with Google, Google shares your Google account identifier, email address, name, and profile picture link with us (through Supabase), as shown on Google's consent screen. We use these only to create and secure your account.

We also process account creation and last sign-in timestamps.

Your journal data

We process the content you choose to save: text, images, voice recordings and their transcripts, drawings, moods, entry dates, plant layouts, timestamps, deletion status, and related sync metadata.

If a photo you add carries a location, One Year keeps an approximate version of it (rounded to about 1 km). It is used only for searching your memories on your device, and for nothing else: it is not included in exports or used for analytics.

Journal text, image files, voice recordings, transcripts, drawings, and photo locations are encrypted before they are stored on our current backend. Entry dates, mood values, file paths, attachment types and positions, plant layouts, and operational timestamps are currently stored as unencrypted metadata so syncing and garden features can work.

For legacy users who have not migrated, journal data may remain on the device and in the user's private Apple iCloud/CloudKit container rather than our current backend. Voice recordings and drawings are not synced for legacy users.

Purchases and entitlement data

Apple and RevenueCat provide transaction, product, subscription, trial, renewal, cancellation, receipt, entitlement, anonymous purchaser identifier, device, and attribution information needed to offer paid features, validate purchases, restore access, prevent fraud, and measure subscription performance. We do not receive your full payment card number.

Usage, analytics, and diagnostics

We use PostHog to process a pseudonymous account or device identifier, app and device information, feature interactions, paywall and purchase activity, settings choices, and diagnostic errors. Some events can include the date of a journal entry, a selected mood value, character count, whether an entry contains a photo or mood, and subscription-access status. We do not intentionally send journal text or journal images to PostHog.

We use Sentry to receive crash reports, error reports, and reports of the app freezing. These include your pseudonymous account identifier, app and device information (such as model and iOS version), and technical details of the error. We configure Sentry not to collect screenshots, screen contents, or network request details, and we do not intentionally send journal content to it.

The App also sends an aggregate numerical change when a memory is planted or removed so we can show a total community memory count. That request does not include the journal entry, account ID, mood, or image, although the network provider may process standard request information such as an IP address.

Advertising conversion data

We use Meta tools only to measure whether advertising led to app activity or purchases, not to read or target ads based on journal content. The Meta SDK and RevenueCat attribution integration may process device identifiers, a Meta anonymous identifier, app activation, campaign attribution, purchase, subscription, and conversion events.

Device permissions and local data

If you choose, the App accesses the camera, your photo library (to attach photos, and to save photos you take with One Year's camera), the microphone (to record voice notes), speech recognition (to turn a voice note into text), notifications, and Face ID or other device authentication. Photos and camera images you attach become part of Your Content.

Speech recognition runs only on your device. If your device can't transcribe your language on its own, the recording is kept without a transcript; your voice is not sent to us or to Apple for transcription.

When you pick a photo, One Year reads the location stored with it, if any. If you have given One Year full access to your photo library, it may also look at photos taken around the day of an older journal photo, on your device, to find where that photo was taken. One Year never asks for library access for this, and nothing from your library is uploaded except photos you add.

Apple performs biometric authentication; we receive only the success or failure result, not your biometric data. Reminder preferences and journal-lock settings are stored on your device. Reminders and other notifications, including occasional “look back” notifications that suggest a search from your own journal a couple of evenings a week, are created and scheduled on your device, and the journal words they use never leave it. We do not send push messages to you from our servers.

On-device features, Siri, and Spotlight

Search. One Year's search, including finding memories by what's in their photos, by people, places, and dates, runs entirely on your device using models built into the App. Your searches and the search index are not sent to us or anyone else.

Apple Intelligence. On supported devices, optional features use Apple's on-device Foundation Models: writing prompts based on recent entries, and tidying up voice-note transcripts. The App does not send this content to Wind Down Studio, PostHog, or an external AI model for these features.

Siri, Spotlight, and Apple Intelligence. On iOS 27 and later, One Year adds your memories (the day, its text, its voice-note words, its mood, and a small cover image) to the private, on-device index that Spotlight, Siri, and Apple Intelligence use to find your own content, and lets Siri open, add to, or create memories when you ask. This index is managed by iOS on your device, is unreadable while your device is locked, and is cleared when you sign out. Journal Lock does not remove memories from this index. You can turn this off for One Year in iOS Settings (Apps ▸ One Year ▸ Siri / Siri & Search, or Settings ▸ Apple Intelligence & Siri). How Apple processes requests you make to Siri or Apple Intelligence is described in Apple's privacy policy.

Support communications

If you contact us, we process your email address, the content of your message, and any account identifier or diagnostic information you choose to include so we can respond.

• Provide accounts, syncing, restore, export, and widgets.
• Encrypt, secure, maintain, and troubleshoot the App.
• Process purchases and provide paid features.
• Understand feature use and improve performance and design.
• Measure advertising conversions and campaign effectiveness.
• Respond to support and privacy requests.
• Prevent fraud, abuse, security incidents, and violations of these Terms.
• Comply with law and enforce our legal rights.

Where the EEA, United Kingdom, or similar law applies, our legal bases are: performing our contract with you to provide One Year; our legitimate interests in securing, supporting, improving, and measuring the App; consent where required for device permissions or advertising measurement; and compliance with legal obligations. You may withdraw consent at any time, without affecting processing that occurred before withdrawal.

We do not sell journal entries or journal images. We disclose information only as described below:

• Apple: authentication, iCloud for legacy users, device permissions, App Store purchases, subscriptions, refunds, Siri, Spotlight, and Apple Intelligence features you use, and platform services.
• Google: if you choose Sign in with Google, to authenticate you.
• Supabase: account authentication, database, encrypted journal content, unencrypted sync metadata, and server functions.
• Cloudflare: encrypted photo and voice-recording storage, delivery through signed URLs, and the aggregate planted memory counter.
• PostHog: pseudonymous product analytics, feature flags, and diagnostics.
• Sentry: crash, error, and app-freeze diagnostics.
• RevenueCat: purchase validation, entitlements, subscription analytics, and conversion attribution.
• Meta: app activation and advertising conversion measurement. This disclosure may be considered “sharing,” targeted advertising, or cross-context behavioral advertising under some privacy laws even though we do not sell information for money.
• Legal and safety recipients: if reasonably necessary to comply with law, protect users, investigate abuse or security incidents, or establish and defend legal claims.
• Business transfers: in connection with a merger, financing, reorganization, acquisition, or sale, subject to appropriate confidentiality and notice.

You can review the providers' policies at Apple, Google, Supabase, Cloudflare, PostHog, Sentry, RevenueCat, and Meta.

Current accounts use a unique data-encryption key to encrypt journal text, images, voice recordings, transcripts, drawings, and photo locations with AES-GCM before backend storage. The account key is encrypted under a service master key and is provided only to an authenticated device. Image objects are kept in private storage and accessed with short-lived signed URLs. We also use transport encryption, account-scoped access controls, and platform security features.

This design is not a zero-knowledge system: because Wind Down Studio operates the service master key, we can technically recover an account's encryption key when necessary to operate, secure, restore, or comply with law. No security method is perfect, and we cannot guarantee that unauthorized access or loss will never occur.

We keep your active account and synced journal data until you delete the account or the information. We do not maintain a separate backup archive of journal content. When in-app account deletion succeeds, active Supabase account and database records are deleted and the account's photo and voice-recording files are removed from Cloudflare R2.

Product analytics and diagnostic data (PostHog and Sentry) are retained for up to 12 months. Support communications are kept only as long as needed to resolve the request and maintain reasonable business records. Purchase, tax, fraud-prevention, security, and legal records may be kept for the period required by law or reasonably necessary to establish or defend legal claims.

Service providers may retain limited records under their own legal obligations or standard deletion cycles. Deleting your One Year account does not delete data controlled independently by Apple or cancel an Apple subscription.

Wind Down Studio is based in the United States, and our providers may process information in the United States and other countries where privacy protections may differ from those where you live. Where required, we rely on recognized safeguards such as adequacy decisions, standard contractual clauses, or provider data-protection terms for international transfers.

You can:

• Edit or delete individual journal entries and images in the App.
• Export available journal content from settings.
• Delete your One Year account and synced content from settings.
• Change camera, photo, notification, and biometric permissions in iOS Settings.
• Change microphone, speech recognition, and photo-library access in iOS Settings.
• Turn off Siri, Spotlight, and Apple Intelligence access to One Year in iOS Settings.
• Manage or cancel subscriptions in your Apple account.
• Contact us to request access, correction, deletion, portability, restriction, or objection where applicable.
• Object to or opt out of Meta advertising conversion measurement by emailing us with the subject “Privacy Opt-Out.”

Depending on where you live, you may have rights to know or access information, correct it, delete it, receive a portable copy, restrict or object to processing, withdraw consent, and appeal a denied request. You may also have the right to opt out of the sale or sharing of personal information, targeted advertising, or certain profiling, and to receive equal service without discrimination for exercising a right.

We do not sell personal information for money. Meta conversion measurement may be treated as “sharing” or targeted advertising in some jurisdictions. To exercise a right, email hi@wndn.studio. We may need to verify your request. You may use an authorized agent where applicable. If you are not satisfied with our response, you may appeal by replying to our decision and may complain to your local privacy or data-protection authority.

One Year is not directed to children under 13, and we do not knowingly collect personal information from a child under 13 without legally valid parental consent. If you believe a child under 13 has provided personal information, contact us so we can investigate and delete it. Users under the age of legal majority must use the App with permission from a parent or legal guardian.

We may update this Policy as One Year, our providers, or applicable law changes. We will update the effective date above and provide additional in-app notice when a change is material. Where required, we will ask for consent before using information for a materially new purpose.

For privacy questions or requests, contact:

Search runs on your device. It uses these data sets and models, trimmed and compressed to fit on a phone:

• Place names from the GeoNames geographical database, licensed under CC BY 4.0.
• Photo label names from the Open Images Dataset by Google, licensed under CC BY 4.0.
• Words for photo labels in other languages from Wikidata (CC0) and from the Unicode CLDR emoji names, © 1991–2026 Unicode, Inc., used under the Unicode License v3.
• The TinyCLIP photo model, © Microsoft Corporation, MIT License.
• The multilingual-e5-small text model, © Microsoft Corporation, MIT License.
• The Snowflake Arctic Embed text model and word list, © Snowflake Inc., Apache License 2.0.

The App includes this open-source software:

• Supabase Swift, © 2021 Supabase, MIT License.
• RevenueCat Purchases, © 2024 RevenueCat, Inc., MIT License.
• Sentry, © 2015 Sentry, MIT License.
• PostHog, © 2023 PostHog, MIT License.
• Facebook SDK for iOS, © Meta Platforms, Inc. and affiliates, used under its license and the Facebook Platform Policy.
• swift-clocks, swift-concurrency-extras and xctest-dynamic-overlay, © Point-Free, Inc., MIT License.
• swift-crypto, swift-asn1 and swift-http-types, © Apple Inc., Apache License 2.0.

Each project's page links to its full license text.