Privacy Policy

Skiá is a personal time-based journaling app operated by MIDAMULTIMEDIA, LLC ("we", "us"). This policy explains what we collect, why, and the control you have over it. Questions: reflexskia@gmail.com.

What we collect

• Account info. When you sign in with Google we receive your email address, your name, your profile photo URL, and your Google account identifier. We do not receive your Google password.
• Your journal. The entries you create — activity labels, reflection notes, categories, ratings, emotion words, and start/end times.
• Settings and personalization. Your theme, your day start/end hours, any goals you create (including their free text), any context notes you write about an app or website, your chosen AI tone, your custom emotion words, and your title merges. See Storage & security — unlike your entries, these are stored unencrypted, and your title merges contain the activity names you typed.
• A device identifier. Each installation generates a random identifier so a timer you start on one device can be recognized and kept in sync on your others. It is generated by the app, is not an advertising identifier, and is not used for tracking or shared with anyone.
• Usage analytics. Basic, pseudonymous information about how you use the app — when you open it, and which features you open (such as Patterns or Export). This never includes the content of your entries (no reflection text, rating value, label, or category) and is tied only to your account identifier.
• Voice dictation (optional). If you use the microphone button to dictate, your speech is sent to your phone's built-in speech recognition service. See the Voice dictation section below — this is the one case where audio leaves your device.
• Screen time (optional, Android). If you grant usage access, Skiá reads which apps you used and for how long. This stays on your device — see the Screen time section below for the one exception.
• Web time (browser extension only, optional). If you install the Skiá browser extension and turn on "Web time", it records how long the active tab's website domain is in focus (for example x.com — 19m) so you can see your own daily web-time totals. It records the domain and duration only — never full URLs, page titles, page content, or your browsing history. It is off by default, tracks only the active tab, and never runs on incognito windows or when you are signed out.

We do not use third-party advertising or analytics/tracking SDKs, and we do not collect your location, contacts, photos, or health or fitness data. The only usage analytics we collect are the pseudonymous ones described above.

How we use it

• To provide the core service: storing your journal and syncing it across your devices.
• To understand which features are used and improve the app, using the pseudonymous usage analytics described above — never the content of your entries.

We do not sell your data or use it for advertising.

Voice dictation

Skiá's microphone button uses the speech recognition service built into your phone. Skiá itself never records, stores, or transmits audio — but the service your phone provides does, and it is important you know where that audio goes:

• Android. Your speech is sent to Google's speech recognition service and processed on Google's servers, under Google's privacy policy — not ours.
• iOS. Your speech is handled by Apple's speech recognition. On the newest iOS versions Apple processes it on your device; on older versions it is sent to Apple's servers, under Apple's privacy policy — not ours.

We do not receive the audio, and neither Google nor Apple receives your journal — only the words you speak while dictating. Dictation is available by default: you can turn it off in Settings, or simply type instead, and no audio is captured unless you press the microphone button.

Screen time & app usage

If you grant usage access on Android, Skiá reads which apps you used and for how long, so it can show your real phone behavior next to what you logged.

• This is optional, off by default, and granted by you in Android's Settings. You can disconnect it in the app at any time, which also deletes the local copy.
• Your app usage — which apps, for how long, and when — stays on your device. We do not upload it.
• One exception: if you create a goal about a specific app or website (for example "quit Instagram"), the name of that app or website is saved with your goal on our servers, so the goal works across your devices. Concretely, that means the app's package name (for example com.instagram.android) or the website's domain (for example instagram.com) — stored unencrypted. No usage times are uploaded with it.
• The only other way this data leaves your device is if you export it to a CSV file.

Storage & security

Your data is stored with our cloud database provider (Supabase), and all data is transmitted over HTTPS.

What is encrypted. The content of your entries — labels, reflection notes, categories, ratings, and emotion words — is encrypted on your device (AES-256-GCM) before it is stored, as are the website domains recorded by the browser extension. Entry timestamps are stored unencrypted so the app can order and filter your timeline.

What is not encrypted. Your account info and your settings — including goals, context notes, custom emotion words, and title merges — are stored unencrypted with your account. Note that title merges contain the activity names you typed, and a goal about an app or website contains that app or website's name. We intend to encrypt these as well; until we do, this policy tells you plainly that they are not.

Important: this is not end-to-end encryption. We retain the ability to decrypt your entries so that data export and future features can work. Treat anything you log as readable by the service.

Sharing with others

We share data only with the providers needed to run the app:

• Google — for sign-in; and, on Android, for speech recognition if you use dictation (see Voice dictation above).
• Apple — on iOS, for speech recognition if you use dictation (see Voice dictation above).
• Supabase — for authentication and database hosting.
• An AI provider of your choosing — only if you connect one yourself. Off by default; see Connecting your own AI below.

We do not share your data with anyone else, and we do not use your entries to train any AI model — not ours, not anyone's.

Connecting your own AI

Skiá can connect to an AI assistant that you choose — for example Claude, in the Claude app or on claude.ai. This is off by default. Nothing is sent to any AI unless you set the connection up yourself.

Connecting is your consent. When you approve the connection screen, you are telling us to let that assistant read your journal. From then on, while the connection is active, it can read your entries, reflections, ratings, and the timestamps around them — whatever it needs to answer what you ask it.

What this means in practice:

• Read-only. A connected assistant can read your journal. It cannot add, change, or delete anything.
• Only your own data. A connection is tied to your login and can only ever reach your account. It cannot see anyone else's journal, and no one else's connection can see yours.
• Their rules apply, not ours. Once your entries reach the AI provider you picked, that provider's privacy policy and terms govern what happens to them — including whether they train on your data. Some do, some don't, and some differ by plan. We have no control over this and no agreement with them on your behalf. Check their policy before you connect.
• You can stop it at any time. Disconnect in your AI client and access ends immediately. That stops future reads; it does not reach into the AI provider and erase what was already sent — for that, use their controls.

We do not receive payment or data from any AI provider for this, and we do not choose the provider for you.

Retention & deletion

We keep your data until you delete it. You can permanently delete your account and all entries at any time in the app: Menu → Settings → Delete account. This removes your account and every entry immediately and cannot be undone. See our account deletion page for details, or to request deletion if you can't access the app.

Children

Skiá is not directed to children under 13, and we do not knowingly collect data from them.

Changes

We may update this policy; the effective date above will change when we do.

Contact

reflexskia@gmail.com