Last updated 16 October 2026
The Way of Life is a private space for reflection. What you write in it is yours. This policy explains exactly what we collect, why, who else ever sees it, and how to get rid of it.
This service is operated by THEWAYOFLIFE LTD (company number 17385267), a company registered in England and Wales, referred to here as "we" or "us". We are the data controller for the personal data described below.
1. The short version
- You can use the app without giving us your name or email.
- We do not sell your data, and we do not run advertising.
- Your reflections are sent to AI providers to generate your reflections back to you – never to train their models.
- You can export what you have written and chosen, and delete everything, at any time. The reflections the AI writes stay in the app, on the Journal tab.
2. What we collect
Information you give us
- Account details. If you create an account: your email address, and if you sign in with Google or Apple, the basic profile information they return (name, email, and a provider identifier). You can also use the app anonymously, in which case we hold no contact details at all.
- Your reflections. Category alignment, daily and weekly check-in answers, intentions, journal entries, saved memories, and any free text you write.
- Voice recordings. If you use the voice features, audio you record is sent for transcription and then discarded; the resulting text is saved as part of your reflections.
- Dictation. If you use the microphone button in a writing box, your phone's own speech recognition (Apple on iPhone, Google on Android) turns what you say into text, under Apple's or Google's own terms. We do not receive the audio, only the resulting text, which is saved like anything else you write.
Information collected automatically
- Basic usage events. Anonymous, aggregate-level events such as "a reflection was completed" – used to understand whether features work, not to build a profile of you.
- Technical data. Standard server logs from our hosting provider (IP address, device/browser type, timestamps), retained briefly for security and diagnostics.
- Error reports. If something crashes, diagnostic information about the failure.
- Reports you make. If you report an AI reflection, the text you reported, your reason and your account identifier, so we can review it. We keep it with your account, and we are alerted that a report has arrived (the alert contains none of it).
- Your country. Worked out from your IP address, so we can show you crisis support numbers for the right country. We store the country only – never your IP address, and nothing more precise than the country itself. You can change it yourself at any time on the Account screen.
We do not collect: your precise location (we work out your country only – see above), your contacts, advertising identifiers, or data from other apps. We do not track you across other websites.
3. Special category data – and why we ask your permission
Reflections about your mood, wellbeing, relationships and inner life can reveal information about your mental health. Under the UK GDPR this is special category data (Article 9) and gets stronger protection than ordinary personal data.
Our lawful basis for processing it is your explicit consent (Article 9(2)(a)). We ask for it in the app, before you write anything, as two separate choices with nothing pre-selected: (1) saving your writing to your account, which the app needs in order to work, and (2) sending it to AI providers to write your reflections, which is optional. We record what you chose and when. We rely on consent rather than "legitimate interests" precisely because this data is sensitive and the choice should be yours.
You can withdraw each choice at any time. To stop AI processing, switch off AI Reflections in Your Data. Nothing is sent to any AI provider from then on, and the app carries on as a private journal and wheel. To withdraw consent to saving, delete your account, which erases the underlying data. Withdrawing consent does not affect processing that already happened lawfully before you withdrew it.
4. Why we process it
| Purpose | Lawful basis |
|---|---|
| Saving your reflections so they are there next time | Explicit consent (special category data) for what you write, given in the app; contract for the account itself |
| Generating AI reflections and prompts from what you write | Explicit consent (special category data), switchable off at any time in Your Data |
| Transcribing voice input into text | Explicit consent, switchable off at any time in Your Data |
| Sending reminder notifications you switched on | Consent – withdraw by turning them off |
| Keeping the service secure and diagnosing faults | Legitimate interests – running a reliable service |
| Processing subscription payments | Contract |
5. Who else processes your data
We use a small number of providers to run the service. Each acts as our processor under contract, handles data only on our instructions, and none of them are permitted to use your reflections for their own purposes or to train AI models on them.
| Provider | What they handle |
|---|---|
| Supabase | Database and authentication – where your account and reflections are stored |
| Vercel | Application hosting and server logs |
| Google (Gemini AI) | AI text generation for reflections and guided sessions |
| Groq | Voice transcription |
| Google / Apple | Sign-in (if you choose it), push notification delivery, app store payment processing, and your phone's built-in speech recognition for dictation (if you use it) |
| RevenueCat | Subscription status – receives a pseudonymous user identifier, never your reflections |
| Sentry | Crash and error diagnostics |
Some of these providers process data outside the UK, including in the United States. Where that happens, transfers are protected by the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or an applicable adequacy decision.
6. Your privacy controls inside the app
The app's Your Data screen gives you switches controlling which categories of your reflections may be sent to AI providers. Anything you switch off is still saved for you – it simply never leaves our systems for AI processing. With everything switched off, reflections are generated from your wheel (alignment, purpose and vision for each area) and your inner-tension scores alone – the one part of a reflection that always runs, regardless of what is switched off.
7. How long we keep it
- Your reflections and account: until you delete them. There is no automatic expiry – the point of a journal is that it persists.
- Voice audio: discarded immediately after transcription; only the text is kept.
- Server and error logs: typically 30–90 days.
- After account deletion: your data is erased from our live systems immediately.
8. Your rights
Under UK GDPR you have the right to:
- Access your data – use Export as CSV in the app for an immediate copy of what you have written and chosen. The reflections the AI has written for you are not in that file; you can read them in the app on the Journal tab. To ask about anything else we hold about you, email us.
- Delete your data – use Delete account in the app, which is immediate once you confirm, or the web deletion form if you no longer have the app, which asks you to click a link sent to your email first before it deletes anything. Either way, once carried out it cannot be undone.
- Correct anything inaccurate. Saved memories can be edited directly in the app at any time. Daily and weekly reflections cannot currently be edited in place – if one needs correcting, email us and we will fix or remove it.
- Withdraw consent at any time. Switch off AI Reflections in Your Data, or delete your account.
- Object to or restrict processing, and to data portability (the CSV export of what you have written and chosen is a portable format).
- Complain to the Information Commissioner's Office at ico.org.uk if you think we have handled your data badly. We would rather you told us first so we can fix it.
9. Security
Data is encrypted in transit (HTTPS/TLS) and at rest. Access to the production database is restricted, and database-level row security rules mean one account cannot read another's data. No system is perfectly secure, but we take this seriously – it is the whole premise of the app.
10. Children
The Way of Life is for people aged 13 and over. The app asks you to confirm your age before you can use it, and if you say you are under 13 it does not let you continue. We do not knowingly collect data from children under 13. If you believe a child has provided us with personal data, contact us and we will delete it. For people aged 13 to 17 we apply the ICO's Children's Code: the AI is optional and off unless you turn it on, and nothing is shared for advertising.
11. Changes to this policy
If we change this policy materially, we will update the date at the top and – where the change affects how we use your reflections – tell you in the app before it takes effect.
12. Contact us
Email contact.thewayoflife.app@gmail.com.
THEWAYOFLIFE LTD, registered in England and Wales, company number 17385267. Registered with the Information Commissioner's Office, registration number ZC234852.