cloudbunBack home
Privacy policy
The short version
- Your journal is private to you. Your chats, notes, habits, moods, worry jar and gratitude well live on your phone. While you're signed in, we also keep an encrypted-at-rest backup of your Cloudbun, journal included, that only your account can read, so it comes back on a new phone. It's deleted with your account.
- Your words leave your phone only when your cloudbun reads your day. When you wrap up or tap Read my day, the day's messages go together through our server to our AI service provider for that one read. With Plus, each message also goes there for a quick reply, and a short summary of your week or month for your stories. We don't store them there and we never log them. (If you talk out loud, your phone's speech service may hear you first; see Voice.)
- No ads, no selling. We don't show ads, we don't sell your data and we don't share it for advertising.
- Analytics are anonymous, can be turned off any time (in the EU, EEA, UK and Switzerland, usage analytics stay off until you say yes), and never contain what you write or say.
- You can delete everything from Settings at any time. See Delete your account.
Who we are
Cloudbun is made by the Cloudbun team ("we", "us"). The data controller is the developer named as the seller on Cloudbun's App Store and Google Play pages. We are the controller of the personal data described here. Questions or requests: [email protected].
What stays on your phone
Cloudbun keeps your most personal things on your device, in the app's private storage on your phone. If you sign in, they're also backed up to your account (see "Your backup" below); signed out, they're not sent to our servers:
- your chats with your cloudbun, your journal days and day summaries, moods and mood calendar
- your notes and to-dos, habits and habit garden
- worry jar and gratitude well entries, care activity history
- focus timer sessions, and on Android, the apps you choose to pause and any daily app limits
- your wallet, quests, collections and most game progress
Like other app data, this can be included in your phone's own backups (iCloud or Google), which are handled by Apple or Google under their terms. You can choose how long journal days are kept in Settings › Privacy and your data › Keep my journal (forever, 1 year or 90 days), and you can export it in Settings › Privacy and your data › Export my data.
Your backup
While you're signed in, the app keeps a backup of your Cloudbun on our server, so signing in on a new phone brings everything back: your island, wallet and progress, your journal days and summaries, chats, notes, habits, moods, worry jar, gratitude well and your settings. It's updated a little while after things change on your phone.
- Only your account can read it: not friends, not other players. It's stored encrypted at rest (we hold the key on our server, so this isn't end-to-end encryption) and sent over an encrypted connection. It's never used to train AI, never read by the AI and never used for ads.
- If the backup grows past about 3 MB, the oldest chats stay only on your phone and the app tells you so in Settings; everything else is always included.
- If your phone and your account both have an island, the app asks which one to keep. It never mixes them or replaces one without asking.
- Signing out stops backups (your data stays on your phone). Deleting your account deletes the backup with it. The timer label you type in Focus and the apps you pause are not included.
What we store on our servers
Our backend runs on Supabase (database, sign-in and server functions) in the United States (US East, Virginia). It holds what's needed for your account, your backup, your island and friends:
| What | Details | Why |
|---|---|---|
| Your account | An account id and the email address from Sign in with Apple or Google. Google may also share your name and profile picture; the app can show the picture on your profile. | To sign you in and keep your account yours. |
| Your backup (while signed in) | Your whole Cloudbun as saved on your phone: island, wallet and progress, journal, chats, notes, habits, moods, worry jar, gratitude well and settings. Readable only by your account. | So it comes back on a new phone. See "Your backup". |
| Your island and cloudbun's look | Island name, your cloudbun's name, flavour, hat and resident critters, island layout, level and islets. | To back up your island and show it to friends you add. |
| Friends | Your friend code, friendships and friendship hearts, warm squishes, gifts (the material and amount), guestbook stickers, visits, and anyone you block. | So friends can visit, squish and send gifts, and blocked players can't. |
| AI usage counters | How many smart check-ins and stories you used each day, token counts and estimated cost. Never any text. | To apply fair-use limits and keep the service affordable. |
| Purchases | Which product you bought, the Stars granted, whether Plus is active, and the store's event id. | To deliver what you bought. |
Talking with your cloudbun (AI)
Your cloudbun answers every message right away. On the free plan that reply is made on your phone (by your phone's own built-in AI where it has one, or picked from ready-made lines), and nothing is sent.
Your messages leave your phone when your cloudbun reads your day: when you tap Wrap up today or Read my day and a smart check-in is available. Then the app sends the day's messages to our server, which asks our AI service provider to pick out what you did and what you plan to do, and to write one reply about your day. That request contains:
- the day's messages since your cloudbun last read them (at most 20 messages and 3,000 characters; the newest are kept), each up to 1,000 characters
- for context, up to 8 earlier messages from that day that were already read (yours and your cloudbun's replies)
- your open to-dos (up to 15), things already noted today, and your habit names
- your local date and time, and your cloudbun's name
With Cloudbun Plus, each message is also sent to our server for a quick reply, with up to 6 earlier messages from the same day and your cloudbun's name.
You decide: the app asks once before anything is sent, and you can change it any time in Settings. If you say no, nothing is sent; replies are made on your phone and your cloudbun makes rough guesses on your phone when you wrap up.
For your stories (with Plus: the Sunday story and the monthly one), the app sends a short summary of that week or month: moods, counts, short labels of things you did, habit names and streaks. Without Plus, or with AI switched off, nothing is sent for stories.
Our server runs on Google Cloud Run in the United States (us-central1). It does not store your words and does not write them to logs. Its logs contain a one-way hashed account id, the type of request, timings, token counts and cost. Google processes the request to produce the reply; requests may be handled in any region where Google offers these models. Under the paid Google Cloud terms we use, Google does not use these requests to train its models.
Before anything is sent, the app checks the message for signs that you may be in danger. If it finds them, nothing is sent, nothing is rewarded, and your cloudbun shows real helplines for your region. Our server runs the same check again.
When a smart check-in isn't available (offline, out of your allowance, signed out, or AI switched off), your cloudbun makes rough guesses on your phone instead and nothing is sent.
The AI can get things wrong. You can switch off anything it noticed in the recap before you collect.
Voice
If you talk instead of typing, your phone's speech recognition turns your voice into text. Depending on your phone and settings, Apple (on iPhone) or Google (on Android) may process the audio on the device or on their servers, under their own privacy terms. Cloudbun keeps only the words. It never records or stores audio. When your phone can recognise speech on the device, Cloudbun asks it to, and passes your cloudbun's name, island name, habit names and open to-dos to it as hints; those hints never go to a speech service that may work online.
Anonymous usage and crash reports
To find bugs and see which parts of the app get used, the app sends these anonymous reports. Crash reports are on unless you turn them off. Usage events are on unless you turn them off, except in the EU, EEA, UK and Switzerland, where the app asks first and sends nothing until you say yes. Both switches are in Settings › Privacy and your data.
- usage events to PostHog (US servers): app opens, which screens you open (the screen's name only), onboarding steps, counts of things collected, items placed or bought, level-ups and similar events, plus whether a screen reader, larger text, bold text, reduced motion (the phone's or the app's own Less motion) or dark mode is on, so we know what to make more accessible. Only numbers, yes/no values and item ids are allowed. There's no session recording, no location lookup and never any text you wrote or said.
- crash reports to Sentry: the type of error, where it happened in the code and basic device details, with user details, on-screen text and error messages removed.
Turn either off at any time and nothing more of it is sent.
Purchases
Cloudbun Plus and Stars are sold through the App Store and Google Play, which handle payment. We never see your card details. We use RevenueCat to check purchases; it receives your Cloudbun account id and your purchase and subscription details from the store. When you delete your account, we ask RevenueCat to delete its record of you too.
Notifications, widgets and app pausing
- Reminders are scheduled on your phone. We don't currently collect push notification tokens.
- Widgets read a small snapshot from the app on your phone (island name, a picture of your island or room, plant names, and on iPhone up to 3 open to-dos; on Android only how many to-dos there are, never their words). On Android, other apps on the device may be able to read the widget's pictures.
- App updates: the app checks Expo's update service (EAS Update) for small updates. That check carries the app's version, your phone's platform and a random install id, never your account or anything you wrote.
- Focus and app pausing on Android: with your permission, Cloudbun reads which app is in the foreground and app usage time (Usage access) and lists your installed apps, and can show a pause screen over apps you chose. This happens only on your phone and is never sent anywhere.
- Screen Time on iPhone (when available): the apps you pick stay in Apple's Screen Time system on your device; Cloudbun can't see which apps you picked.
What friends can see
Friends you add with your friend code can see your island, your cloudbun's name and look, your level, critters living on your island, guestbook stickers and friendship hearts. They can never see your journal, chats, notes, habits or moods.
Why we use your data (legal bases)
- To provide the app you asked for (performance of a contract): your account, your backup, friends and purchases.
- Legitimate interests: keeping the service secure, preventing abuse (for example rate limits and fair-use caps), fixing problems (crash reports) and, outside the EU, EEA, UK and Switzerland, anonymous usage events. You can object by turning either off in Settings.
- Consent: in the EU, EEA, UK and Switzerland, anonymous usage events; everywhere, sending your talks to the AI, microphone and speech recognition, notifications and Android usage access. You can withdraw consent at any time in Settings or your phone's settings.
- Legal obligations: for example, keeping purchase records where the law requires.
Who we share data with
We share data only with service providers who process it for us under contract, and only as described above:
| Provider | What for |
|---|---|
| Supabase | Database, sign-in and server functions |
| Google Cloud (hosting, AI processing and logs) | Our AI server and the AI model |
| Apple, Google | Sign-in, app stores and payments, speech recognition |
| RevenueCat | Checking purchases and subscriptions |
| PostHog, Sentry | Anonymous usage and crash reports (either can be turned off in Settings) |
| Expo (EAS Update) | Delivering app updates |
| Cloudflare | Hosting this website |
We may also disclose information if the law requires it, to protect someone's safety, or as part of a sale or reorganisation of our business (in which case this policy keeps applying to your data). We don't sell personal data and we don't share it for cross-context behavioural advertising.
International transfers
Our servers and several providers are in the United States. Where data moves from the UK, EEA or Switzerland to other countries, we rely on the safeguards our providers offer, such as the EU Standard Contractual Clauses and the EU-US Data Privacy Framework where applicable.
How long we keep it
- Server data (account, backup, island, friends, usage counters, purchase records) is kept while your account exists and deleted when you delete your account.
- Server logs with hashed ids are kept for 30 days.
- Anonymous usage and crash reports are kept for up to 90 days.
- Data on your phone stays until you delete it, delete the app, or it passes your journal retention setting.
Your rights and choices
Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict some uses, and to withdraw consent. In the app:
- Export: Settings › Privacy and your data › Export my data saves a file with everything Cloudbun keeps on your phone.
- Delete: Settings › Privacy and your data › Delete my data deletes your account and its server data, and clears the app on that phone.
- Analytics: Settings › Privacy and your data › Share anonymous usage, and Send crash reports.
- AI: Settings › Privacy and your data, the switch for your cloudbun reading your day with AI.
For anything else, including a copy of the data on our servers, email [email protected] from the address you sign in with. We'll answer within 30 days. You can also complain to your local data protection authority.
California residents: we collect the categories described above (identifiers, your backup, the content you choose to send to the AI, and app activity) for the purposes described above. We don't sell or share personal information, and we don't use sensitive personal information to infer characteristics about you. You won't be treated differently for exercising your rights.
Children
Cloudbun is for people aged 13 and over. In some countries you need to be older (for example 16) to use it without a parent's permission. We don't knowingly collect data from children under 13. If you believe a child under 13 has an account, email us and we'll delete it.
Security
Data travels over encrypted connections (HTTPS). Server data is protected by access rules so each account can only reach its own data, and server keys never ship in the app. No system is perfect, so please keep your phone locked and your sign-in account secure.
Changes
If we change this policy, we'll update the date at the top and, for meaningful changes, tell you in the app before they take effect.
Contact
Cloudbun · [email protected]