Privacy Policy

Chronicle is run by Waffol, a sole trader based in the Netherlands. Waffol is the data controller for the personal data described here. Contact: martgeluk11@gmail.com.

Account. Your email address and login details. Sign-in is handled by our hosting provider's authentication service; Chronicle itself never sees or stores your password. If you use Google sign-in, we receive your email address and basic profile from Google. Basis: performing our agreement with you (art. 6(1)(b) GDPR).

Journal. Your answers, the journal pages made from them, your day grade, and photos you attach. Basis: performing our agreement with you. Where you choose to write about sensitive matters, see below.

Settings. Language, theme, custom questions and their order, reminder times and time zone. Basis: performing our agreement.

Reminders. If you turn on notifications, your browser's push address for that device and a short log of which reminders were sent, so you don't get the same one twice. Basis: your consent, which you can withdraw by turning notifications off.

Archive purchase. Whether your account has archive access. Payment itself happens at PayPal; we only see what PayPal shows the recipient (name, email, amount). Basis: performing our agreement, and legal bookkeeping obligations (art. 6(1)(c)).

Legal acceptance. Which version of these documents you accepted and when. Basis: legal obligation / our legitimate interest in being able to show this.

Technical data. Your IP address is used briefly to guess your country so we can suggest a language, and by our hosting provider for security and abuse prevention. Chronicle does not keep it in your account. The guest trial uses a signed cookie so it can be used once a week. Basis: legitimate interest in a secure, usable service (art. 6(1)(f)). We do not use advertising or analytics trackers.

A diary can contain health, beliefs, relationships, political views or other special categories of data. We never ask for these in forms. If you choose to write about them, you do so explicitly and voluntarily (art. 9(2)(a) GDPR), and we process them only to store and show your journal and to produce your page. You can delete any page, or everything, at any time.

An email address is required to make an account; without it we cannot provide the journal. Photos, reminders, custom questions and the archive are optional — Chronicle works without them.

The evening questions and your journal page are produced with an AI model. There is no automated decision with legal or similarly significant effect on you. Details are in the AI & MCP Notice.

Lovable Cloud (hosting, database, file storage and sign-in, built on Supabase). Lovable's AI gateway and Google (Gemini) for generating questions and pages. PayPal, as its own controller, for payments. Google, for Google sign-in if you choose it. Browser push services (for example Google, Apple, Mozilla) deliver notifications if you turn them on.

Some of these providers may process data outside the EU/EEA, especially in the United States. Where that happens it relies on the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

Account, journal, photos and settings: until you delete them or delete your account. Reminder log: kept with your account and removed on deletion. Legal acceptances: kept while your account exists. Payment records may be kept by Waffol for up to 7 years where Dutch tax law requires it.

When you delete your account in Chronicle, your entries, photos, settings, notification devices, reminder log, archive status, acceptance records and login are removed straight away from the live system. Our hosting provider's backups may still contain copies for a limited period until they rotate out; these are not used to restore your data.

Only you. Every entry and photo is tied to your account and the database refuses requests for another person's rows. Photos are in private storage and are opened through short-lived links. Administration tools cannot open anyone's journal pages, answers or photos.

Data is sent over encrypted connections and access is restricted per account. No system is perfect; if a breach affects you we will tell you and the authority where the law requires.

You have the right to access, correct, delete, restrict and receive a portable copy of your data, to object to processing based on legitimate interest, and to withdraw consent at any time (this does not affect what happened before).

You can download a copy and delete your account yourself on the "your data" page in Chronicle. Edit or delete single pages in the book. For anything else, email martgeluk11@gmail.com — we answer within one month.

You can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the authority in the EU country where you live.

Chronicle is meant for people aged 16 and over. Chronicle does not check ages. If you are younger, please only use it with permission from a parent or guardian.

When this policy changes meaningfully, the date above changes and Chronicle asks you to read and accept the new version the next time you open it.