Privacy Policy
Last updated: July 11, 2026.
This page explains what holystic.ai collects, what we do with it, and the rights you have over your data. Where the language gets legal, we try to also say what it actually means in practice.
What we collect
From you, when you sign up
- Email address. Used to identify your account and verify it's you. Authentication is handled by Clerk; we never see your password because there isn't one — we use email-code sign-in.
From you, when you use the app
- Profile choices: Christian tradition, the values you select, and a free-text description of the digital life you're living toward.
- Goals: short descriptions of behaviors you're trying to practice or limit.
- Reflections: the slider positions and the free-text journal entries you submit each day, along with the AI-generated response.
- Feedback: if you submit feedback on a reflection response, we store what you wrote.
If you turn on activity reminders (optional)
holystic can send you a gentle reminder when you cross a limit you've set for yourself — for example, time spent in a particular app. This is off by default and only runs after you explicitly grant the permission. When it's on:
- Your device observes the usage tied to your goals so it can tell when a limit is reached. On iPhone this is handled by Apple's Screen Time framework, which only ever tells the app that a threshold was crossed — the app itself cannot read your specific app or website usage. On Android the app reads usage locally to compute the same thing, and that raw usage stays on your device.
- What reaches our servers is the event, not your usage: which goal was crossed and when (a goal identifier and a timestamp). We do not receive your screen-time totals, an app-by-app or site-by-site breakdown, or your browsing history.
- The reminders themselves are generated and shown on your device as local notifications.
If you also install our optional browser extension, it reports only coarse, aggregated signals — how many minutes you spent in a category of sites on a given day — to inform the same goal-aligned reminders and reflections. It does not send us individual web addresses or your full browsing history. You can turn this off or remove the extension at any time.
If you sign up for the beta
If you fill out the beta sign-up form, we store your first and last name, email address, and which platform you use (iOS, Android, or both) so we can invite you to test the apps and email you about the beta. This is a simple sign-up list — it does not create an app account (that happens later, only if you install the app). We don't sell or share it, and you can ask us to remove you anytime at support@holystic.ai.
Automatically, while the app is running
- Standard server logs: timestamps, IP address, the HTTP request path, and the response status. These are kept for a short window for operational debugging.
- Crash and error diagnostics (no personal content) — only the type of error and the part of the app that produced it.
We do not collect your location, your contacts, or any biometric data. We don't build an advertising profile of you or track you across unrelated apps and websites, and there are no advertising SDKs in the app. The only activity information we ever receive is the goal-threshold events described above — and only if you choose to turn activity reminders on.
How we use it
The data above is used to provide the service: to identify you when you sign in, generate reflections tailored to your tradition and goals, and let you see your history. We don't sell it, share it with advertisers, or use it to target you outside the app.
AI processing of your reflection text
When you submit a reflection, the text you wrote and the sliders you set are sent to OpenAI's API to generate the response. OpenAI processes this content under their business terms, which (as of this writing) commit them to not train their public models on data sent through the API and to delete it after processing. Alongside the reflection itself we include the context the engine uses to make the response relevant: your tradition and goals, the corpus items it retrieved, and — if you've turned on monitoring — a light summary of recent activity signals (such as "social media, 40m" or a goal threshold you crossed). We never send your name, email, or account identifier. If you intentionally submit the reflection form with no current-day answers, we may instead send a bounded selection of your recent reflection entries, related response feedback, and consented goal-linked activity signals so the service can produce a cumulative reflection. If there is not enough history, it does not infer a pattern.
Where it's stored
Your data is stored in a managed Postgres database hosted by Fly.io in the United States.
Free-text fields you provide — journal entries, goal descriptions, and the "what you're living toward" statement — are encrypted at rest using envelope encryption: each user has a personal 256-bit data encryption key (DEK), and that DEK is itself wrapped by a global key (KEK) that lives only in our server's runtime environment, never in the database. The cipher is AES-256-GCM with a fresh random IV per stored value. A copy of the database alone is not enough to recover plaintext — an attacker would also need the KEK from our server's environment. Identifiers and timestamps are stored unencrypted so the application can function.
Rows that were written before envelope encryption was deployed (2026-05-25) remain in unencrypted form for now; new writes use the scheme above.
How long we keep it
As long as your account is active, your data is retained. When you delete your account from the Settings screen, your profile, goals, reflections, and responses are marked deleted immediately and permanently removed after a 30-day grace period during which deletion can be reversed by contacting support. Feedback rows you submitted may be retained anonymized (with all links to your account severed) for service-quality purposes.
Server logs are kept for 14 days, then deleted automatically.
Your rights
- Export. Settings → Data → Export your data produces a JSON file containing your profile, goals, reflections, responses, and feedback. You can save this to your Files app, email it to yourself, or move it to another service.
- Edit. Profile, goals, and tradition can be edited at any time from Settings. Past reflections can be deleted individually.
- Delete your account. Settings → Data → Delete account. This starts the 30-day deletion window described above.
- Ask us a question. support@holystic.ai — we read these.
Children
holystic is intended for adults. We do not knowingly collect data from children under 13. If you believe a child under 13 has created an account, please contact support and we will remove the account.
Changes to this policy
We'll update the "Last updated" date at the top of this page when anything changes. Material changes — like a new category of data we collect, or a new service we send data to — will be flagged in the app before they take effect.
Contact
Holystic.ai LLC
support@holystic.ai