Privacy Policy

Last updated: October 2026

Inner Anchor is built by a solo founder, not a corporation with a legal department. This policy is written in plain language because you deserve to actually understand it.

Inner Anchor runs in a web browser, a desktop app, and mobile apps for iOS and Android.

The short version: your tasks, journals, and purpose lines are yours. We do not sell them or use them for advertising. We process them only to run the app for you, and we do not read them for any other purpose.

What we collect

Account information

When you create an account, we collect your email address and, if you set one, a password. We store a one-way hash of the password, so we cannot read it. If you sign in with Google or Apple, you may have no password at all. We also store the full name, nickname, and avatar you set on your profile, and the account data that Google or Apple sends us.

Sign-in with Google or Apple

When you sign in with Google or Apple, we receive a provider account ID, your email address, whether the email is verified, and your name. Google also sends a profile picture. For Apple, we keep an encrypted refresh token when Apple provides one, so we can revoke the app’s access when you delete your account.

Devices

When you sign in, we record a device ID that the app creates and keeps, the platform, the device name, the model, the OS version, and the app version. We also record the IP address, city, and country on the device enrollment at each sign-in and refresh. Each session stores its IP address and user agent. The web app sends the browser name and OS details as the device name, model, and OS version. The desktop and mobile apps send only the platform and app version.

Your content

Your tasks, journal entries, Compass Entries and the purpose line, Papers and their reflections and anchor moments, Schedule Entries and their notes, daily intentions, Focus Sessions, bookmarks, reading positions, reading time, and reading days are stored on our servers so they sync across your devices. This content is yours. We do not sell it or use it for advertising. We process it only to run the features you use, and we do not read it for any other purpose. We do not train models on it. We do not share it with anyone except the service providers listed below, who process it for us.

Books

The EPUB and PDF books you upload, and their covers, are stored in a private Cloudflare R2 bucket. The app reaches them only through short-lived signed URLs. R2 encrypts them at rest.

Analytics (events only, never content)

We use PostHog to understand how features are used so we can improve the product. We collect event names, counts, durations, route data, and the plan and interval of a subscription. We never send the text of your tasks, journals, purpose lines, or any other freeform content to analytics. Element text and attributes are masked before an event leaves the app, and session replay is off.

Specifically, we never transmit:

• Task names or descriptions
• Journal text
• Purpose line text
• Any freeform content you write

After you sign in, the app identifies you by your user ID, and your email is stored as a person property in PostHog. The landing site never identifies a visitor. PostHog stores a cookie and an entry in local storage, described under Cookies and local storage.

Chat and support

We use Crisp for live chat in the web app and the desktop app. It is not in the mobile app or on this site. If you message us, Crisp stores that conversation. We use it only to help you.

Email

We use Resend to send account and service emails, including verification and password reset codes, password change notices, new-device sign-in notices, Privacy Guard alerts, and Schedule reminder and overdue notices. We do not send marketing email unless you opt in. We will never sell your email address.

What we don’t collect

We don't use session replay, keylogging, screen recording, or any form of content surveillance. We don't run experiments on you without telling you. We don't have ads, so there are no ad trackers.

Third-party services

We do not share data with advertisers, data brokers, or any party not listed above.

Cookies and local storage

We use an HTTP-only cookie that holds your refresh token, which keeps you signed in. Your access token stays in memory. PostHog stores a cookie and an entry in local storage. Before you sign in, it holds an anonymous ID that connects a visit on the landing site to the app. After you sign in, it is tied to your user ID, and your email is stored as a person property. Crisp sets cookies for the chat widget on the web and desktop apps. The web and desktop apps also set a cookie that remembers whether the sidebar is open. We do not use advertising cookies.

Storage on your devices

The mobile app keeps your refresh token, session email, and device ID in the OS secure store (Keychain on iOS and Keystore on Android).

The desktop app keeps an OS-encrypted refresh token, a device ID, your window positions and sizes, and crash state. If the OS encryption is not available, the refresh token is kept only in memory for the session.

The web app keeps the device ID, your theme, and your profile choice in localStorage. The web and desktop apps also keep a cache of book files and covers so a book opens without downloading again.

Data storage and security

Your data is stored on Google Cloud Platform. All traffic between your app and our servers is encrypted in transit with TLS. Journal entries, Paper reflections and anchor moments, and Schedule titles, notes, and event payloads are encrypted at rest with AES-256-GCM. Task titles, purpose statements, and the Paper context band are not encrypted at rest. Uploaded books and covers sit in a private R2 bucket under R2’s encryption at rest. Passwords are hashed using standard one-way hashing. Access to production systems is limited to the founder.

We're a small team (currently one person), and we take security seriously within that context. We don't claim to be Fort Knox, but we follow standard security practices and don't cut corners where it matters.

Data export and deletion

You can delete your account in the app under Settings, then Account. The account enters a 30-day grace period and keeps working until the period ends. You can cancel the deletion from the banner that appears on every page. If you want the account removed at once, choose the permanent option in the delete dialog and type DELETE. We refuse deletion while a live recurring subscription exists, so cancel the subscription first. On mobile, the Account screen opens these settings in a browser sheet.

To export your data, email support@useinneranchor.com and we will handle your request.

Retention

We keep daily database backups in Cloudflare R2 for 30 days, monthly backups for 12 months, and yearly backups permanently. Pre-deploy database dumps are kept for 7 days. API logs are kept in Grafana Cloud for about 14 days. A deleted task or journal entry can be undone for 10 seconds. We purge an account once its 30-day deletion grace ends.

Backups taken before encryption at rest may hold plaintext copies of content. A backup that already holds your data keeps it until its retention period ends. Deleting your account removes the key that protects encrypted content, so that content cannot be read from those backups. Records held by our providers, such as invoices at Polar, stay for the period the law or the provider requires.

Children

Inner Anchor is not for anyone under 16. You must be at least 16 years old to create an account. We don't knowingly collect data from children. If you believe a child has created an account, contact us and we'll delete it.

Changes to this policy

If we make meaningful changes, we'll update this page and note the date at the top. For significant changes that affect how your data is used, we'll notify you by email.

Contact

Questions about your data? Email support@useinneranchor.com.