Vad händer med dina uppgifter?

1. Scope and controller

This Privacy Policy explains how the adult operator of the SelfSight service in Sweden ("SelfSight," "we," "us") processes personal data through the SelfSight iOS app, selfsight.org, the waitlist, accounts, subscriptions, support, and related services. The controller's required legal identity and contact details appear once in section 10.

SelfSight is a service name, not a separately registered legal person. Apple and some other providers may process information for their own purposes under their own privacy notices and legal responsibilities.

2. Information processed on your device

Core records are stored in Apple's protected app storage. A protected, backup-excluded onboarding profile stores setup answers and permission choices. Depending on the features you choose, local records may include:

• intentions, schedules, priorities, completion status, notes, journal text, and numeric reflection ratings;
• daily and weekly summaries, pattern chains, confidence information, recommendations, and experiments;
• aggregate Screen Time totals, broad categories, and pickup counts, but not message, photo, webpage, or app content;
• HealthKit-derived sleep duration and quality, steps, active energy, and workout duration; SelfSight requests read access only and does not write HealthKit data;
• calendar start and end times, duration, counts, free blocks, and internal identifiers used for suggestions, but not event titles, notes, locations, attendees, or attendee contact details;
• Focus, battery, weather, and daylight information; and
• onboarding answers, preferences, consent state, and feature settings.

Optional system permissions are requested separately. An Apple permission does not by itself enable cloud sync or external AI. Where SelfSight relies on consent, you may withdraw it without affecting processing already carried out lawfully.

For weather, the app requests a one-time location and sends the coordinate supplied by iOS to Apple WeatherKit. SelfSight does not write the coordinate to its persistent data store, although it is held temporarily in memory to complete the request.

Voice journaling uses the microphone and Apple's Speech framework. On-device recognition is preferred where supported; otherwise Apple may process the audio through its network speech-recognition service. SelfSight stores the resulting journal text, not an audio recording.

3. Account, support, purchase, and technical information

• Account and authentication: Sign in with Apple may provide an Apple subject identifier, name, email address, or private-relay address. Supabase processes the identity token, internal user identifier, session, and authentication metadata. A device-local account binding protects signed-out records from a different account.
• Support: signed-in users may send ticket text, a priority level, timestamps, and one optional image per message. Supabase stores the conversation and private attachment path. Authorized support personnel can view the submitted content and limited account/subscription context needed to respond.
• Notifications: if you permit notifications, Apple Push Notification service processes delivery data. After sign-in, SelfSight may associate an APNs device token with your Supabase account to send a generic support-reply notification.
• Purchases: Apple processes payment details. RevenueCat receives an app-user identifier, product, offering attribution, purchase and entitlement status, renewal or expiry information, and related transaction metadata. RevenueCat may first create an anonymous identifier and later associate it with the stable Supabase user identifier after sign-in. SelfSight does not receive full payment-card details.
• Integrity and age evidence: for features that require age or jurisdiction eligibility, Apple's Declared Age Range and App Attest systems may produce age bounds, availability state, app-attestation keys, challenges, assertions, counters, and verification metadata. SelfSight does not request or store a full date of birth.
• Operational information: service providers may receive IP address, device, browser, request, security, and diagnostic metadata needed to deliver and protect their services.

4. Optional cloud sync and external AI

Encrypted cloud sync

Cloud sync is a separate, optional SelfSight+ feature. When a signed-in eligible user enables it, selected daily summaries, pattern chains, journal entries, and profile settings are encrypted on the device with AES-256-GCM before upload to Supabase. Encrypted payloads may include journal text, intention names, derived Screen Time and HealthKit information, calendar load, Focus, battery, weather, mood, and an app-name token map.

The 256-bit key is generated on the device. The local copy is protected in Keychain with device-only protection. When you enable cloud sync, a separate account-specific recovery key copy is synchronised through your iCloud Keychain so that your other Apple devices can decrypt your encrypted records. The key is never sent to Supabase. You need iCloud Keychain on your Apple devices to recover synced records; Apple processes that iCloud Keychain service under its own terms. Supabase stores the eligible content as ciphertext, but authentication, consent, support, entitlement, quota, cost, and other operational records are not part of that encrypted payload.

Turning sync off stops future syncing; it does not by itself delete ciphertext already uploaded. You may delete the account in the app or contact privacy@selfsight.org about deletion.

External AI and public research

External AI is optional, off by default, and separate from Health access, sign-in, purchase, and cloud sync. It requires a current, explicit opt-in plus applicable authentication, subscription, age, jurisdiction, quota, and provider-approval checks. For the initial sensitive-context rollout, users must be verified as at least 18. Withdrawing consent blocks new external requests immediately; local features continue.

If every gate is approved and the feature is enabled, SelfSight may send an authenticated request containing a bounded 14–90 day relative chronology to its gateway and contracted Scaleway Generative APIs infrastructure in Paris. The chronology may contain daily aggregates for sleep and activity, broad Screen Time categories, intention category, timing and status, Focus, calendar load, and a numeric reflection rating. It excludes names, email, account and device identifiers from the model prompt, absolute dates, precise location, app names, journal text, intention titles or notes, calendar titles or attendees, arbitrary free text, and raw HealthKit samples.

Scaleway states that normal synchronous inference has zero prompt/output retention and is not used to train its underlying models. Its published policy permits limited retention and human access for harmful, malicious, or abnormal-error requests for up to two weeks, and retention of aggregated or anonymized API metadata for up to six months. SelfSight will not enable private external processing until the applicable provider terms, data-processing role, special-category scope, subprocessors, transfer position, review period, and controller approval have been recorded.

Public research is technically separate. If enabled, Tavily receives only a generic query assembled from a fixed vocabulary and never receives the private chronology, identity, account session, HealthKit data, journal content, or model prompt. Tavily's US processing, role, terms, retention, and transfer position must be approved before use.

The gateway associates operational metadata with the authenticated account to enforce consent, entitlement, age and jurisdiction eligibility, rate limits, weekly quotas, abuse controls, and cost controls. This can include consent and disclosure versions, grant or withdrawal times, provider and model, capability, token counts, estimated cost, entitlement class, timestamp, outcome, and a request identifier. Prompt content is not stored in the AI usage record, and the account identifier is not included in the external model prompt.

5. Website and waitlist

If you join the waitlist, we collect only the email address you enter. Before sending the form, you must separately confirm that you want early-access news and occasional product updates and that you are at least 13. The form creates a pending EmailOctopus contact tagged waitlist-consent-2026-09-27. We do not send waitlist marketing until the EmailOctopus double opt-in confirmation is complete. The provider’s contact creation time and versioned tag form the consent receipt. You may unsubscribe at any time.

Cloudflare Turnstile receives a security token and limited device, browser, network, and interaction information to distinguish people from automated abuse. The website automatically follows your device’s light or dark appearance preference and does not store a separate theme preference. Cloudflare hosts and delivers selfsight.org and provides Cloudflare Pages Analytics. SelfSight does not use advertising trackers and does not sell personal data or share it for cross-context behavioural advertising. If a website technology requires consent under applicable local e-privacy rules, we will obtain it before enabling that non-essential storage or processing.

6. Purposes and legal bases

Under the GDPR, SelfSight relies on the following legal bases where applicable:

• Contract necessity (Article 6(1)(b)): providing requested local features, accounts, support, subscriptions, encrypted sync, exports, and service administration.
• Consent (Article 6(1)(a)): confirmed waitlist or product email, optional permissions where consent is the appropriate basis, and optional external AI. Consent is not inferred from accepting the Terms or from granting an unrelated Apple permission.
• Legitimate interests (Article 6(1)(f)): securing the service, preventing fraud and abuse, enforcing limits, diagnosing failures, and protecting users and systems. SelfSight considers the necessity and impact of this processing and provides a right to object.
• Legal obligation (Article 6(1)(c)): records and disclosures required by tax, accounting, consumer, data-protection, or other applicable law.

HealthKit-derived information and other information used to infer physical or mental health may be special-category health data. Where Article 9 applies, SelfSight relies on your explicit consent under Article 9(2)(a), expressed through the relevant separate Health, sync, or external-AI choice after receiving information about the processing. Aggregation reduces detail but does not necessarily remove special-category status.

SelfSight does not use solely automated decision-making that produces legal effects or similarly significant effects about you. Pattern chains and AI outputs are optional reflective information, not decisions about eligibility, employment, credit, insurance, healthcare, or legal rights.

7. Recipients and international transfers

Depending on the features used, recipients may include Apple (platform services, Sign in with Apple, App Store, HealthKit, Screen Time, WeatherKit, Speech, App Attest, push notifications, and purchases), Supabase (authentication, database, encrypted sync, support, consent, quota, usage records, and server functions), RevenueCat (offerings, purchases, entitlements, and subscription lifecycle), Cloudflare (website delivery, Turnstile, optional cookie-less analytics, and App Attest verification infrastructure), EmailOctopus (waitlist and email delivery), Scaleway (conditional AI inference), and Tavily (conditional generic public research).

Suppliers may act as processors, subprocessors, or independent controllers depending on the activity. Apple and other independent services process information under their own terms. Before an optional feature is enabled, SelfSight records the supplier role, processing location, current subprocessor list, retention position, data-processing agreement and, where needed, the GDPR Chapter V transfer safeguard. You may request the current record for a recipient at privacy@selfsight.org.

SelfSight aims to process private app content in the EEA where practical. Some providers, subprocessors, support operations, or independent services may process information outside the EEA. The applicable safeguard depends on the recipient and may include an adequacy decision, Standard Contractual Clauses, or another lawful GDPR Chapter V mechanism. Optional AI or research processing remains disabled where the required role, contract, transfer, retention, subprocessor review, and data-protection impact assessment approval are incomplete.

SelfSight may also disclose information to professional advisers, competent authorities, or transaction counterparties where necessary and permitted by law. SelfSight does not sell personal data or use HealthKit, Screen Time, journal, or location information for advertising or data brokerage.

8. Retention, security, and deletion

Retention

• Local records: remain until you delete them in the app, complete account deletion, remove the app, or erase the device, subject to Apple backup behaviour you control.
• Onboarding profile: remains in protected, backup-excluded Application Support until the related app or account data is erased.
• Encrypted sync and account records: remain while needed to provide the account or until deletion. Turning sync off stops new sync but does not itself erase existing ciphertext.
• Support: remains while the conversation is open. Closing the ticket invokes a deletion flow for its private attachments and database conversation.
• AI consent, usage, quota, and integrity records: remain while needed to operate and secure the feature and are included in account deletion, subject to limited provider, security, legal, and backup exceptions.
• Waitlist: pending contacts are used only to complete the confirmation process; confirmed contacts remain until you unsubscribe, request deletion, or the signup purpose ends. The consent timestamp and version tag are retained only for as long as needed to demonstrate consent and honour an unsubscribe.
• Temporary exports: remain in the app's temporary directory until removed by the app, account deletion, or iOS. A copy you share is controlled by the destination you choose.
• Provider and legal records: transaction, fraud-prevention, security, incident, accounting, and backup records may remain for the period required by the provider's documented policy or applicable law.

SelfSight applies storage-limitation criteria rather than promising an automatic deletion period that is not technically enforced. We review retention settings and outstanding accounts at least annually. You may ask for the current period applicable to a category by contacting privacy@selfsight.org.

Account deletion

The in-app Delete Account flow authenticates the session, removes user-owned Supabase Storage objects and verifies that cleanup, deletes active database records and sessions, and deletes the Supabase Auth user last. After server success, the app attempts to erase local SwiftData, onboarding and quarantine files, privacy preferences, widget snapshots, notifications, temporary exports, the device encryption key, and the account binding. Export anything you need first.

Deleting the account or app does not cancel an App Store subscription; cancel it separately in Apple subscription settings. Account deletion removes the active SelfSight records held in Supabase, not independent Apple App Store transaction records or RevenueCat records retained under their own documented retention, tax, fraud-prevention, or legal obligations. You may contact privacy@selfsight.org to request assistance with a RevenueCat-related privacy request. Limited transaction, security, fraud-prevention, incident, legal, or time-limited backup records may remain where permitted or required.

Security

Measures include Apple platform data protection, Keychain, TLS in transit, AES-256-GCM for eligible sync payloads, authenticated sessions, access controls, database row-level security, server-side consent and entitlement gates, minimized AI schemas, and provider credentials kept out of the app. No system is completely secure. Protect your device, Apple account, and passcode, and keep copies of exports you need.

9. Your choices and privacy rights

You can decline or revoke optional system permissions in iOS Settings; use local features without signing in where available; independently disable sync or external AI; export app records; unsubscribe from email; delete local data; close a support ticket; or delete a signed-in account. Turning external AI off stops new external requests immediately without disabling local analysis.

Subject to applicable conditions and exceptions, EEA users may request access, correction, erasure, restriction, portability, or information about recipients; object to processing based on legitimate interests; and withdraw consent. SelfSight may need to verify your identity. Withdrawal does not affect earlier lawful processing.

Send a request to privacy@selfsight.org. We normally respond within one month, subject to the GDPR’s permitted extensions and exceptions. You may complain to the Swedish Authority for Privacy Protection, Integritetsskyddsmyndigheten (IMY), at imy.se, or to another competent supervisory authority.

10. Age, changes, and contact

SelfSight is intended for people aged 13 or older and is not directed to children under 13. The waitlist requires an age confirmation and does not knowingly accept an under-13 signup. A parent or legal guardian must provide permission or involvement for a user under the age of legal majority where required by applicable law. External AI involving HealthKit or other sensitive context is initially restricted to eligible users verified as at least 18. SelfSight stores only limited age-range bounds and verification metadata, not a full date of birth. If you believe a child has provided personal data contrary to these requirements, contact us.

We may update this policy when the Service, suppliers, or law changes. The effective date and version will be updated, and additional notice or renewed consent will be provided where required. A change does not retroactively expand an earlier consent.

Controller: Anna Welin, operating SelfSight personally in Sweden
Postal address: Vasagatan 16, 602 41 Norrköping, Sweden
Privacy: privacy@selfsight.org
Legal: legal@selfsight.org