About this policy. This document is written in two voices. The italic summary at the top of each section says what the clause actually means in plain language. The clause itself, in plain prose underneath, is the binding text. If anything in the summary conflicts with the clause, the clause governs.
This policy explains what data InnerVisions collects from you, why, what we do with it, who we share it with, where it lives, and what control you have. It is written by Metaxu Pty Ltd (ACN 698 120 400) trading as InnerVisions ("InnerVisions", "we", "us", "our").
Before the detail, here is what InnerVisions promises about your data. These are not aspirations. They are reflected in the architecture and in the rest of this policy.
1. We do not sell your data. Not to advertisers. Not to data brokers. Not to anyone.
2. We do not train AI models on your data. Not our own. Not third parties'. Your entries are processed to provide features you've asked for, and that is all.
3. Your private content is encrypted with AES-256-GCM at rest. The encryption key is stored as a server-side secret in our edge function environment. It is never sent to your device or to any third party. Your journal content is not readable in plaintext from our database. Decryption happens only inside our own server code, only to deliver features you have requested, and only by authorised personnel under documented circumstances.
4. You can see, export, and delete everything. Your profile is visible to you. Your data is exportable. Deletion is real and we cannot reverse it.
The rest of this document is how those commitments are kept.
Two categories: what you give us, and what we observe so the product works. We keep both as small as we can.
Information you provide directly:
Information we collect automatically:
What we do not collect:
To run the service, keep it secure, and improve it. Nothing else.
We use your data only for these purposes:
We do not use your data for advertising, profiling for sale, behavioural targeting, or any purpose outside running the service for you.
Real encryption, real access controls, real key isolation. The technical details matter, so we're sharing them.
Encryption at rest. Your private content is encrypted using AES-256-GCM (authenticated encryption with a 32-byte key). The fields currently encrypted include: journal entries, sparks, notes, chat messages with Discuss, starred insights, client notes (in any future Practitioner feature), Guide artifacts, seed profile input, and session data.
Key isolation. The encryption key is stored only as a server-side secret within our Supabase edge function environment. It is never transmitted to your device, included in API responses, or shared with any third-party service including OpenAI.
Server-side decryption. Decryption happens only inside our edge functions and only to deliver a specific feature you have requested. Ciphertext and encryption metadata are stripped from API responses before they reach your device.
Key versioning. Encrypted rows are tagged with a key version identifier (encryption_key_id) so we can rotate keys in the future. Our current production key is AES-256-GCM, rotated from a prior AES-192 key in April 2026.
Encryption in transit. All connections between your device and our infrastructure are encrypted using HTTPS/TLS. Both Supabase and Vercel enforce TLS at the network layer.
Access controls. Access to production systems is limited to authorised personnel and gated by per-user authentication. We do not browse user content. Any access to decrypted user content for support, debugging, or compliance is logged and requires a documented reason.
What this means in practice. Your journal is not readable in our database without explicit decryption. To read a specific entry, an authorised person on our team would need to deploy code that decrypts that entry using the production key – an event that is logged and auditable. The system is built this way deliberately.
A note on what this is and isn't. This is not zero-knowledge or end-to-end encryption. We hold the production encryption key on the server, which means we have the technical capability to decrypt your content. The protection here is enforced by architecture and process – by the fact that decryption requires authorised code execution, that any such access is logged, and that we have built the system to make casual or unauthorised access impossible – not by mathematical impossibility. We are being transparent about this because the difference matters. Products that genuinely cannot read your content (Signal-style messaging, some password managers) operate on different architecture. InnerVisions does not.
Your content is sent to OpenAI to run AI features. OpenAI does not train on your data and does not retain it. We do not train on your data either.
What goes to OpenAI. When you trigger an AI feature – voice transcription, MeaningMaker, Pattern Review, Discuss, Guide artifact generation, or any future AI feature – the relevant decrypted content is sent over an encrypted connection to OpenAI's API for processing. The response is then encrypted and stored against your account.
OpenAI's data practices. OpenAI's API is configured not to train on the data we send, and is subject to OpenAI's published Enterprise Privacy commitments and API data usage and retention policies (including any abuse-monitoring exceptions documented in those policies). We rely on these commitments and policies as part of our processing arrangement with OpenAI. OpenAI's policies may evolve; we will update this section if material changes affect how your data is handled.
We do not train models on your data. We do not train our own models on your content. We do not provide your content to any third party for the purpose of training their models.
AI model evolution. The AI models we use evolve over time. We may switch to or add additional AI providers in the future. If we do so in a way that materially changes how your data is processed, we will update this policy and notify you.
Limits. AI processing has technical limits, can be wrong or inappropriate, and is not a substitute for professional advice (see ToS Section 5).
InnerVisions builds a structured "profile" of you over time – themes, symbols, communication style, life context. You can see it all, edit it, and turn it off.
What the profile is. As you use InnerVisions, the service builds a structured representation of you across time: recurring themes, symbols that reappear, your communication style, life context, and other patterns. This profile is used to give features continuity (so Pattern Reviews feel personal, Discuss remembers what came before, the Guide can speak to what's actually been arising for you).
On-by-default consent. When you complete the Seed Profile step in onboarding, profile memory is enabled by default. We have made this choice because continuity is core to the service. You retain full control:
When profile memory is disabled, no new profile updates occur and no profile context is injected into AI features.
Right to explanation and human review (GDPR Article 22 and equivalent). If you are in a jurisdiction with rights regarding automated decision-making – including the EU, UK, California, and others – you have the right to:
To exercise these rights, contact privacy@innervisions.app (see Section 19).
What the profile is not. Your profile is not a clinical diagnosis, a personality assessment, a behavioural score, or a categorisation of you against other users. It is a personal index of what has appeared in your own material.
We record how you use the app so we can fix bugs and improve the product. Your actual journal content is masked from these recordings.
Analytics. We use PostHog for product analytics. PostHog records anonymised events about how you use features – for example, "user created an entry", "user viewed Pattern Review" – to help us understand usage patterns, find bugs, and prioritise improvements.
Session replay. PostHog also offers a session replay capability that records UI interactions on screen. We use session replay for diagnostic purposes – to understand bugs, friction points, and crashes.
Content masking. Decrypted journal content shown on screen is masked in session replays via the ph-no-capture mechanism. This means session replays show that you were typing in an entry, but not what you typed. The same applies to other rendered decrypted content (Guide artifacts, profile content, chat messages).
Configuration intent. Our session replay configuration is set to not intentionally capture decrypted journal, chat, or profile content. If a content-masking failure were ever to occur, we would treat it as a security incident under our breach notification process (Section 12).
Your control. You can disable analytics and session replay for your account at any time from your settings.
Data residency. PostHog stores analytics data on its own infrastructure, separate from your encrypted journal content.
The third-party services we rely on to run InnerVisions. Each one is bound by a data processing agreement with us.
InnerVisions uses the following subprocessors. Each holds only the data needed for its function, and is contractually required to handle that data in line with applicable privacy law.
| Subprocessor | Purpose | Data handled | Location |
|---|---|---|---|
| Supabase | Database, authentication, edge function runtime, file storage | All account, content (encrypted), and metadata | Sydney, Australia |
| OpenAI | AI processing for transcription and content generation | Decrypted entry content during feature requests (zero-retention basis) | United States |
| Vercel | Application hosting, edge delivery | Application code, request routing, no persistent content storage | Global edge network |
| Stripe | Subscription billing and payment processing | Email, customer ID, payment method (held by Stripe, not us), subscription state | United States / Ireland |
| PostHog | Product analytics and session replay (content masked) | Anonymised event data, masked session recordings | EU or US (depending on configuration) |
| Resend | Authentication and transactional email | Email address, message content limited to auth and service notifications | United States |
We will update this list when subprocessors change. If we add a new subprocessor that handles content data, we will notify you by email at least 14 days before the change takes effect.
Your encrypted journal lives in Sydney. Some processing happens elsewhere – OpenAI and Stripe in particular. We've structured this in line with privacy law.
Your encrypted journal content is stored in Australia (Supabase, Sydney region). However, some processing occurs in other countries:
Under Australian Privacy Principle 8, we take reasonable steps to ensure overseas recipients of your personal information handle it in line with the Australian Privacy Principles, through our data processing agreements with each subprocessor.
For EU/UK users, transfers of personal data outside the EEA or UK rely on Standard Contractual Clauses (or equivalent UK provisions) where the destination country is not deemed adequate.
Access, correction, deletion, export, objection, withdrawal of consent. These are real rights and we will honour them.
Subject to applicable law, you have the right to:
To exercise any of these, email privacy@innervisions.app. We aim to respond within 30 days (the maximum response time under most applicable laws).
A note on data export. Once you export your content, it leaves InnerVisions' encrypted environment and becomes your responsibility to store and protect. Export formats may evolve over time; past exports remain valid but we do not guarantee that future versions of InnerVisions will import older export formats. You are responsible for maintaining your own backups after export.
We keep your data while your account is open. When you delete, we delete – and because of how the encryption works, deleted content is unrecoverable.
Active accounts. We retain your data for as long as your account is active.
Account closure. When you close your account or request deletion:
Deletion is permanent. We cannot restore deleted content. Export anything you want to keep before deleting.
Inactive accounts. We may delete or anonymise data from accounts that have been inactive for a long period (currently set at 3 years). We will email you before doing this, where we have a working email address.
If we get a subpoena, court order, or other binding legal demand, we comply with the minimum necessary. We push back on overbroad requests.
If we receive a subpoena, court order, search warrant, or other valid legal process from a competent authority, we will comply as required by law. Our approach:
About encrypted content. Even with a valid legal demand, we can only provide ciphertext together with the decryption key we hold. We do not retain plaintext copies of your encrypted content.
We may publish an aggregated transparency report from time to time describing the number and types of legal requests received.
If something goes wrong, we'll tell you. Fast. Within the timeframes the law requires.
If we become aware of a data breach that is likely to result in serious harm or a risk to your rights:
We send service emails because we have to. We send marketing only if you separately ask us to.
Essential service emails (authentication links, billing notifications, security alerts, material policy changes) are part of the service. You cannot opt out of these without closing your account.
Marketing communications (product updates, feature announcements, content, newsletters) are separate. We send these only if you have separately opted in, and you can unsubscribe at any time from a link in any email or from your account settings.
We do not share your email address with third-party marketers.
We use the minimum cookies needed to make the service work, plus analytics that you can disable.
We use cookies and similar technologies for:
We do not use advertising cookies, third-party tracking pixels, or behavioural retargeting cookies.
If your jurisdiction requires a cookie banner (EU, UK, parts of California), one will be shown on first visit.
InnerVisions is for adults. We do not knowingly accept users under 18.
InnerVisions is not intended for, and is not directed at, anyone under the age of 18. We do not knowingly collect data from minors. If we learn that an account is held by a person under 18, we will close it and delete the associated data.
If you are a parent or guardian and believe your child has provided us with personal information, please contact us at privacy@innervisions.app.
We don't transfer journal access to anyone after death. Journals are private during life and private after.
InnerVisions journals are deeply personal. We do not transfer access to a deceased user's account to family, executors, or any third party – even with a will, power of attorney, or court order requesting access – except where compelled by valid legal process (see Section 11).
On verified notice of an account holder's death (typically via a death certificate or equivalent), we will close the account and delete the associated data within 30 days, unless the legal representative requests otherwise within that window.
We may, in future, offer a legacy contact setting that allows account holders to choose what happens to their account at end of life. Until that feature exists, the default is deletion.
InnerVisions and Stellar are separate. No data flows between them.
Some users may know that the founders of InnerVisions also operate Stellar, a separate wellness ecosystem. The two products are operationally and legally separate. No data flows between InnerVisions and Stellar. Your InnerVisions data is not used to deliver Stellar services, and vice versa. If we ever introduce any integration between the two, it will be opt-in and disclosed at the point of consent.
Where you live affects what rights you have. Here are the specifics for major regions.
Australia. This policy is designed to comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. You can complain to us at privacy@innervisions.app, or, if unresolved, to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.
European Union and United Kingdom. Our processing under the GDPR and UK GDPR is based on the following lawful bases: contract (to provide the service you've signed up for), legitimate interests (security, fraud prevention, product improvement), legal obligation (tax, regulatory), and consent (marketing, where applicable). Because journal content can reveal special category data (health, sexuality, religious or philosophical beliefs), we rely on your explicit consent to process this data. This consent is obtained through a specific, granular acknowledgement during onboarding – separate from your general acceptance of these policies – and is freely withdrawable at any time by closing your account, disabling profile memory, or contacting us. You have the right to object to processing of this data at any time, and to lodge a complaint with your local data protection authority.
California. Under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), you have the right to know, delete, correct, opt out of sale/sharing (we do not sell or share), and limit the use of sensitive personal information. Mental and physical health information falls within "sensitive personal information" – we use this only to provide the service and not for any other purpose. To exercise any right, contact privacy@innervisions.app.
Washington, Connecticut, Nevada. Journal content may constitute consumer health data under the Washington My Health My Data Act, the Connecticut Data Privacy Act, and Nevada SB 370. We collect and process this data only with your consent (given through your use of the service) and only for the purposes described in this policy. You have additional rights to access, delete, and withdraw consent under these laws.
For privacy questions, requests, or complaints:
Privacy email: privacy@innervisions.app
General email: hello@innervisions.app
Postal: 5b Beaconsfield Street, Newport NSW 2106, Australia
Legal entity: Metaxu Pty Ltd (ACN 698 120 400) trading as InnerVisions
We aim to respond to privacy requests within 30 days.
Material changes get 30 days' email notice. Minor edits don't.
We may update this policy from time to time. For material changes (changes to subprocessors, data uses, retention, your rights, or how we handle AI processing), we will notify registered users by email at least 30 days before the change takes effect.
For non-material changes (clarifications, typo fixes, restructuring), we may update the policy without prior notice. The "Last updated" date at the top of this page always reflects the current version.