Privacy policy

Who we are

TRIALBORN is operated by Joel Goodwin Prentiss. This policy applies to the app and its support service. Updated September 27, 2026. For privacy questions or requests, use the contact option on our Support page.

Quiz and journal information

Your optional name or nickname, intention, quiz answers, and progress are saved locally. Quiz results are calculated on your device. The quiz profile is not encrypted by the app.

Journal entries include your writing, mood, prompt, archetype, and dates. Entry contents are encrypted with AES-GCM in the local database. The key is stored in the same database, and entry identifiers remain outside the encrypted contents. This protects stored entry contents but is not a separate password-protected vault. Each signed-in account has its own local encrypted journal and key. The signed-out journal is a shared local partition. This account separation does not protect against someone with access to the device, app code or stored session.

We do not upload quiz answers or journal entries to our servers or send them to an AI service. The assessment does not require an account. Web checkout requires email sign-in so membership can be linked to a stable account. Native store purchases use the store account and support anonymous purchases. An optional native email account links membership using a verified Supabase account ID; it does not synchronize journals. There is no journal cloud sync or server recovery service. Your operating system may handle device backups or migration separately.

Trial assignments, unique prompt IDs, completion dates and timestamps are stored on this device to keep unfinished trials and avoid repeats. This progress ledger contains no journal writing and is not encrypted. A separate local record keeps up to three initial completion IDs for each account (or anonymous use) on this device. It is not exported or synchronized. Local journal deletion does not renew this allowance; clearing app storage or reinstalling can reset it. Reminder preferences (on/off, preferred time and timezone) are stored locally. Email reminder delivery is not connected; saving a preference does not send or schedule reminders. No push notifications are requested.

Local ownership: journal writing, drafts, moods, trial history, current assignments, quiz/profile data and reminder preferences are separated by account on this device. Signing out opens the shared signed-out journal; signing back in restores that account’s local journal if it remains on the device. Older device-global journals stay in the signed-out partition. We do not guess their owner. To copy older writing into an account, deliberately export while signed out, sign in to the intended account, and import that backup. Existing entry IDs are not overwritten. No journal is uploaded.

Free profile email unlock

On the web, you can complete the quiz anonymously and see your archetype and summary. The normal web result flow asks for an email address. If capture fails, you can continue to the free result without email. Our Cloudflare endpoint sends your email and final Crown, Shield or Hammer archetype to Brevo to create a contact or request a result email; changing an existing contact requires verified mailbox ownership. Quiz answers and journal writing are not sent. Capturing an email does not create an authenticated account or grant paid access.

Ongoing Trial Born insights, prompts and updates require a separate, unchecked opt-in. If you select it, Brevo records the consent, timestamp, wording version and nurture audience membership. Existing opt-outs and blocklists are preserved. You can unsubscribe from marketing without losing your account or result. For a new contact or a verified owner, leaving the box unchecked records marketing and nurture permission as false and removes nurture audience membership. Entering an existing contact’s email without verifying ownership leaves its preferences unchanged. Missing permission is treated as no permission. A prior opt-out is not reversed through this form.

We recognize the browser unlock for 30 days and prefill membership sign-in using the locally saved email. Signed-in accounts bypass capture. Entering an existing contact’s email does not change that contact’s profile, mailing lists or email preferences; those changes require verified mailbox ownership. If optional email capture fails, you can continue to your free result without email. The result-email link works for 30 days and reveals only the archetype breakdown to anyone with that link; it does not sign them in. Cloudflare stores a keyed email fingerprint, archetype, random link token, attempt time and sending status to prevent duplicate delivery. It stores no raw email in this delivery ledger. Expired delivery records are removed after 90 days. A separate operational record stores a random capture ID, a keyed email fingerprint used to find and erase the record on account deletion, timestamps, archetype, consent decision, capture and sending status, and whether usage measurement was allowed, declined, suppressed by DNT/GPC, unavailable, or unknown. It contains no email address, IP address, quiz answers or journal text and is removed after 90 days, together with linked consent decisions and nurture schedule details. Cleanup runs every five minutes. Separate minimal records containing only a provider contact identifier, email purpose and timestamp preserve withdrawals and prevent an expired nurture series from restarting. These remain until verified contact or account deletion; they contain no archetype, capture identifier, quiz answers or journal text. Unsubscribe-link hashes and their preference status are retained to keep unsubscribe links working until verified contact or account deletion. When usage measurement is allowed, its random capture ID may also accompany the matching PostHog event to diagnose delivery gaps. Optional result-capture measurement respects this preference. Necessary server-side subscription lifecycle processing is separate, as described below. Brevo retains contact and email-delivery records under its service policies.

Delete local data clears the browser record, but does not delete Brevo contacts or invalidate an email link. Contact trialbornapp@gmail.com for contact or result-link deletion. We retain contacts only while needed for the profile service, consent records and related support, subject to applicable retention obligations.

Your membership account

When account sign-in is enabled, Supabase Auth and Resend (our email delivery provider) process your email address, account ID, sign-in codes and session/security information to authenticate you. A session token is stored on your device to keep you signed in. We do not send your quiz answers or journal writing to Supabase.

RevenueCat receives a stable account identifier and the checkout email to associate web purchases with your account. RevenueCat Billing uses its connected Stripe gateway to process payment and billing information. Card details are entered in the payment provider’s checkout, not stored by TRIALBORN.

We keep account records while needed to provide your membership and handle support or legal obligations. You may request account deletion at trialbornapp@gmail.com. Account deletion does not itself cancel subscriptions or erase payment records subject to retention requirements. Signing out hides your account’s local journal; the shared signed-out journal remains available. Use local deletion for the partition you intend to erase.

Website hosting

Cloudflare hosts and delivers our website. It processes technical request information such as IP address, requested URL, browser information, and security signals to provide delivery and protect its network. For members who choose Trial Born emails, our Cloudflare backend stores limited contact, consent, archetype, membership and activity records. We do not send assessment answers, mood or journal writing to this backend. Limited operational logs record generic integration errors, without message contents or credentials.

Purchases and RevenueCat

For native app purchases, Apple or Google processes payments through your store account. RevenueCat processes a generated app identifier, purchase receipts or tokens, product and subscription status, paywall interactions, and technical information such as device type and operating system. We use this information to validate and restore access, operate the paywall, and understand purchase activity. Network services receive connection information when responding to requests.

Your optional quiz name, answers, and journal are not sent as RevenueCat customer attributes. We do not receive full payment card details through the app. The app contains no advertising SDK. We do not sell private journal entries or use private journal writing for marketing. RevenueCat purchase and paywall analytics are part of the service.

Native RevenueCat identity is either a generated anonymous identifier or trialborn:<Supabase UUID> after verified sign-in. Your email is not used as that identity. Purchase status and transaction history are processed independently of local journal storage and optional client analytics.

Sharing and backups

You decide when to share a result, prompt, or an excerpt of your writing. Share an excerpt lets you review and edit up to 280 characters before choosing a destination; your original entry is unchanged. Journal writing is never included automatically. Opening an X or Threads composer transmits the reviewed text in its link even if you do not publish. Other destinations process what you choose to share under their own policies.

Export creates a readable JSON file containing your entries, including writing, moods, trial IDs, completion history and current trial assignments. Import reads a file you select and saves valid entries locally. Neither action uploads your journal to us. Native export and sharing create temporary files in the app cache. Temporary files are account-scoped so sharing destinations can finish reading them. They remain until overwritten, removed by scoped local deletion, or cleared by the operating system. Older unscoped cache files belong to the signed-out partition. Copies you save elsewhere remain under your control.

Email and support

If you contact support, we and our email provider receive your email address, message, and any attachments you send. We use these to answer your request, resolve issues, and handle privacy requests. Do not send passwords, payment card details, or private journal exports. We do not automatically subscribe support contacts to marketing emails.

We retain support correspondence only as needed to resolve requests, handle related follow-ups or disputes, and meet legal obligations. We review information for deletion when it is no longer needed. Transaction records may be retained by us, RevenueCat, or the stores for purchase administration, fraud prevention, disputes, and legal requirements. Deletion requests are assessed against these purposes.

Your controls and rights

Settings → Delete Local Journal Data erases only the current account’s local journal, key, profile/quiz, trial progress, reminder preferences and temporary export/share files. When signed out, it erases only the shared signed-out partition. Other accounts’ local partitions are preserved. It does not renew the initial free allowance. Export first to keep a readable backup. Deleting an individual reflection retains its trial completion record. Clearing all app storage or uninstalling may remove every local partition; there is no cloud journal recovery. Operating-system backups, where available, may restore older data and local allowance records.

Local deletion does not cancel a subscription, erase store transaction records, or delete RevenueCat's purchase records or SDK identity. Use store subscription settings to cancel billing. Contact support to request access, correction, or deletion of records held outside your device. The Support screen can show your purchase support ID to help locate an anonymous purchase record.

Depending on where you live, you may also have rights to portability, restriction, objection, withdrawal of applicable consent, or a complaint to your local privacy authority. Where applicable, processing is based on providing the service you request, legitimate interests in reliable support and purchase administration, compliance with law, and consent where required. We may need limited information to verify a request.

Providers, security, and children

Our purchase and support providers may process information in countries other than yours, subject to their service terms and applicable safeguards. We do not sell your quiz or journal data. We may disclose records when legally required or to protect legal rights. No storage or transmission method is guaranteed to be completely secure.

TRIALBORN is designed for adults and is not directed to children under 18. We do not knowingly collect children's information through support. Contact us if you believe a child has sent us personal information so we can address it.

Policy changes

We may update this policy to reflect changes in the app or applicable requirements. We will update its date and provide additional notice where required. The privacy policies of stores, RevenueCat, and destinations you choose to share with also apply to their services.

Funnel events

The app emits named events inside the browser. If you sign in and choose Trial Born practice and value emails, we also send your email address, account identifier, optional first name, archetype result, checkout activity, subscription state, last active time, prompt IDs and completion times, and a limited referral category to our retention backend. Brevo processes contact attributes and selected events to deliver and measure your emails. Assessment answers and journal contents are excluded.

You may receive onboarding guidance, unfinished-checkout reminders, useful content, and occasional reminders to return. Email links use campaign labels so we can measure returns to the app. Brevo may record delivery, opens, clicks, bounces and unsubscribe activity. Open measurements may be affected by mailbox privacy features.

Choosing email is optional and off by default. Withdraw your choice in Account email preferences or with the unsubscribe link. This stops practice and marketing emails without cancelling membership or preventing sign-in and billing emails. The older daily reminder time preference is separate and remains local; it does not start daily delivery.

We keep contact and activity records while needed to operate the requested email service, measure recent engagement, and resolve support issues. We retain a limited unsubscribe record to avoid sending unwanted emails. Contact trialbornapp@gmail.com to request access, correction or deletion. Local data deletion alone does not remove server email records.

Optional product measurement

When product measurement is configured, you can allow it in the app and turn it off in Settings. PostHog processes a random device identifier, a pseudonymous account or purchase identifier after sign-in, acquisition campaign labels, referrer domain, device/platform information, archetype result and named usage events such as quiz progress, journal completion and checkout steps. Assessment answers, your optional name, email, mood, sign-in codes and journal writing are excluded. Automatic click capture and session recording are disabled.

Analytics identifiers and campaign labels are stored on your device after you allow measurement. We honor browser Do Not Track and Global Privacy Control signals for this optional measurement. Declining it does not prevent you from using the app.

RevenueCat subscription lifecycle records are processed separately to operate and measure subscriptions. These use a pseudonymous purchase identifier, subscription status, product, price and timestamps. Disabling optional product measurement does not stop purchase validation or billing records. Network providers receive connection information when handling requests. PostHog processing is configured in the United States.

Contact support to request access or deletion of records held outside your device. Turning off measurement or deleting local data does not erase records already received by providers. We retain measurement records only as needed to understand product performance and resolve measurement or support issues.

When you consent and DNT/GPC do not suppress measurement, anonymous native activity can be linked to a RevenueCat-derived anonymous identifier. On sign-in, PostHog links the current anonymous journey to trialborn:<Supabase UUID>. Logout and account switches reset client identity so separate authenticated accounts are not joined. No email or private writing is included. Declined events are not replayed. Separately, RevenueCat webhooks send subscription lifecycle events to PostHog for billing and service measurement. Declining optional client analytics does not stop this necessary subscription processing.

Account deletion

Account deletion is available through Settings → Delete my Trial Born account when account services pass readiness checks. If sign-in or deletion is unavailable, contact trialbornapp@gmail.com. New sign-in requires verified deletion configuration and recorded deletion evidence, but does not depend on live availability of marketing or analytics providers. Session identity and pending account deletion are still checked. An accepted request blocks further account activity, records a deletion tombstone, and queues removal of associated first-party profile/retention records and Supabase, Brevo and PostHog data with retries. Acceptance does not mean every provider has finished. Contact support for completion status.

Deleting your account is separate from cancelling a subscription. Cancel Apple or Google Play subscriptions in that store, and web subscriptions through Manage subscription or your billing email. Account deletion does not automatically cancel billing. Financial and subscription records remain with billing providers where required. Minimal suppression and deletion audit records are retained to prevent unwanted email and reject old sessions. Historical billing records and purchase aliases require retention review; contact support about these records.

After backend acceptance, the app clears only the deleting account’s local journal, key, quiz/profile, trial progress, allowance and temporary exports on the initiating device. Other accounts and the shared signed-out partition remain. Local cleanup retries after interruption. Export important writing first. Deleting from one device cannot erase local writing on other devices or copies saved in other apps.