Rhythm Journal · Melaku Digital Inc. (Ontario, Canada) · Last updated: July 26, 2026
Your privacy is the foundation of Rhythm Journal. This policy explains, plainly, what information is involved when you use the app and this website, and how it is handled. It is written to align with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Quebec's Law 25.
Rhythm Journal is designed so that your journal stays on your device. We do not operate a server that receives or stores your journal entries. There are, however, a few limited situations where personal information is involved — when you email us for support, when your device or browser connects to our website, and when you choose to turn on an optional third-party AI feature. Those are described below, honestly and in full.
Your journal entries, moods, voice recordings and transcripts, drawings, photos, to-do and shopping lists, appointments, and scanned receipts are created and stored on your device. Melaku Digital Inc. does not operate any server that receives or stores this content, and we do not see it. It is stored using Apple's SwiftData framework and protected by iOS file-protection encryption. If you turn on iCloud sync, a copy is also stored in your own personal iCloud account (see below). Because there is no account and no registration, we have no ordinary way to identify you from your use of the app.
If you enable sync, iOS encrypts your data and stores it in your personal iCloud account under your Apple ID. Rhythm Journal acts only as a local coordinator — the data is handled by Apple's iCloud service under Apple's own terms and privacy policy, and your Apple ID credentials are never shared with us. Sync is off until you turn it on.
When you record audio, it is saved as a file on your device so the app can play it back, let you tap the transcript to jump to a moment, and re-transcribe it for better accuracy. This audio file is protected by iOS file-protection encryption, stays on your device (and in your personal iCloud only if you enable sync), is not sent to us, and is deleted when you delete the entry. Transcription runs on-device using Apple's Speech framework. You are responsible for obtaining any consent required by the laws of your area before recording other people.
On-device AI (Apple Intelligence): On supported devices, optional AI features such as reflections, summaries, and suggestions use Apple Intelligence. Apple designs these models to run on your device; in some cases Apple may route a request to Apple's Private Cloud Compute, which Apple operates under its own privacy commitments. In all cases this processing is handled by Apple's systems — not by a Melaku Digital server — and we do not receive your content.
Bring Your Own AI (off by default): You may optionally connect a supported third-party AI provider by entering your own API key. This feature is disabled by default; while it is off, no entry data is sent to any AI provider. If you turn it on and use an AI action:
Before your text is sent for the first time, the app shows a disclosure so your consent is meaningful. Because you supply your own key and account, your use of the provider is also governed by that provider's terms.
When you scan a receipt, the photo and the information read from it (such as store name, date, total, and line items) are processed on your device using Apple's Vision framework, which performs text recognition on-device. Receipt images and the parsed data are stored only on your device, and in your personal iCloud if sync is enabled, and are not sent to us. Receipt information is treated as private financial data: if you enable the app lock, opening the receipt list requires Face ID / Touch ID. Camera and photo-library access are used only to add receipt images.
If you contact us — by email at admin@rhythmjournal.app or through the contact form on our website — we receive the information you send, which typically includes your name, email address, the topic you select, the contents of your message and any attachments, and standard technical email metadata (such as message headers). We use this only to understand and respond to your request, and we do not use it for advertising or sell it. Our email is hosted by our web and email hosting provider (Hostinger). We keep support correspondence for up to 24 months after your request is resolved (longer only where necessary for legal, security, or unresolved-complaint reasons), and then delete it. Please don't include sensitive personal information in a support email unless it's necessary for your request.
This website is hosted by a third-party hosting provider (Hostinger). Like most websites, the hosting infrastructure may automatically process limited technical information in order to deliver and secure the site — for example your IP address, browser and device type, the date and time of access, the pages or files requested, an approximate region inferred from your IP address, and security or error logs. We do not use advertising cookies, analytics tools, or behavioural tracking on this site. This technical information is processed by the host for operation and security of the site and is subject to the host's own practices.
Depending on the features you enable and your device configuration, the app may connect to Apple services for iCloud synchronization and Apple Intelligence processing (including Apple's Private Cloud Compute where applicable), and to a third-party AI provider you deliberately connect. The Rhythm Journal app contains no advertising, behavioural-tracking, third-party analytics, or third-party crash-reporting SDKs, and does not track you across other apps or websites.
The app may request: Microphone (to record audio for transcription, processed on-device); Speech Recognition (for on-device transcription); Photo Library (to add photos to entries); Camera (to scan receipts and documents, processed on-device); and Face ID / Touch ID (to lock the app and individual private entries). You can revoke any permission at any time in iOS Settings.
You must be at least 14 years old to use Rhythm Journal. It is not directed at children under 14, and we do not knowingly collect personal information from them. Quebec's Law 25 restricts collecting personal information from a minor under 14 without parental or guardian consent. If you have not reached the age of majority where you live, a parent or legal guardian should review this policy with you. Cloud-based third-party AI features are unavailable to minors unless the selected provider permits their use and any required parental or guardian consent has been obtained.
Under PIPEDA and Quebec's Law 25, you have rights to access, correct, and delete personal information an organization holds about you, and to ask about how it is handled. For your journal content, you already hold and control it directly on your device (and in your own iCloud), so you can access, edit, export, or delete it yourself at any time. For the limited personal information described above — support emails and website technical logs — you may contact our Privacy Officer to make a request. We aim to acknowledge requests within 10 business days and will respond within the period required by applicable law.
Melaku Digital Inc. has designated a Privacy Officer responsible for our compliance with applicable privacy laws. You can reach the Privacy Officer at:
Privacy Officer
Melaku Digital Inc.
PO Box 62066, North York, ON M4A 2W1, Canada
admin@rhythmjournal.app
Your journal data remains on your device for as long as you keep it. Deleting an entry removes it from the app and, where iCloud sync is enabled, from your synchronized devices through Apple's synchronization process. Uninstalling the app removes its local data, but may not remove data stored in your iCloud — to delete iCloud data, follow the steps on our Support page. Support emails are kept for up to 24 months after your request is resolved (longer only where necessary for legal, security, or unresolved matters), then deleted. Website access and security logs are retained by our hosting provider (Hostinger) according to its documented operational and security practices; you may contact our Privacy Officer for current information about the applicable retention period.
Some service providers involved in operating this website, our email support, optional iCloud synchronization, Apple Intelligence processing (including Apple's Private Cloud Compute where applicable), and the optional third-party AI feature may process or store information outside Canada. Information processed in another country may be subject to the laws and lawful-access requirements of that jurisdiction. Melaku Digital Inc. remains responsible for personal information under its control and uses service providers only for the limited purposes described in this policy. For details, see the privacy documentation of Apple (iCloud and Apple Intelligence), Hostinger (website and email hosting), and any AI provider you choose to enable.
We may update this policy from time to time. If we make a material change — particularly one that affects what information is collected, how it is used, or who it is shared with — we will provide notice through the app or website. Where the law requires it, we will obtain fresh consent before using personal information for a materially different purpose.
Questions about this privacy policy? Email admin@rhythmjournal.app.