Privacy Policy

Last updated October 21, 2026

Back & Forth is a private journal for families. What you write is meant for the people in your journal and no one else, and we built the service around that. This policy explains what we collect, why, and the choices you have. If anything is unclear, write to us at [email protected].

The short version

• We collect only what the service needs to work.
• We never sell your data, show ads, or use trackers, and we don’t use what you write to train AI models.
• Only the members of a journal can see what’s in it. We don’t read your journals.
• Kids’ accounts are made and managed by a parent or guardian, who can delete them and everything in them at any time.

What we collect

From grown-ups

• Account details: your name, email address, and password (stored only as a secure hash), and a profile photo if you add one.
• What you write and share: entries, replies, photos, drawings, voice notes, reactions, moods, questions, letters, and drafts.
• Settings: your time zone, notification and reminder preferences, and visit dates you add.
• Help requests: what you send us through Help & feedback, with the app version, device type, and page you sent it from.

From kids

• Account details entered by their parent or guardian: a display name, a username, and a PIN (stored only as a secure hash). Kid accounts don’t need an email address.
• What they write and share in their journals, the same kinds of content as above.

Automatically

• Sign-in and security data, such as session tokens and your IP address, used to keep you signed in and to stop abuse (for example, limiting repeated PIN attempts).
• Push notification addresses, if you turn on notifications on a device.

Photos are resized and re-encoded on your device before upload, which removes location and camera data. We don’t use advertising or analytics cookies; the app stores only what it needs to keep you signed in and remember your settings.

How we use it

• To run the service: show your journals to their members, deliver notifications and reminders, and keep track of streaks and badges.
• To keep accounts secure and the service working properly.
• To answer your help requests and improve the app.
• To send emails you need, like password resets and the notifications you choose. We don’t send marketing emails without asking first.

Children’s privacy

Back & Forth is for families, including children under 13. A child’s account can only be created by a parent or legal guardian, who gives consent when creating it, and who manages it from their own Settings. We collect only what a child shares in their journals and what’s needed for their account, and we never use it for advertising.

A parent or guardian can review what their child has shared (it’s in the journal they share), reset their PIN, and delete the account and all of its data at any time in Settings → Kid accounts, or by writing to us. We don’t knowingly let a child under 13 create their own account; if you believe one has, contact us and we’ll delete it.

Who can see your information

• Members of your journals see what’s shared in those journals, and your name and profile photo.
• Our service providers, who store and process data only on our behalf and under contracts that protect it:
  • Supabase: database, sign-in, and file storage (United States)
  • DigitalOcean: hosting for the app and this site (United States)
  • Resend: sending email
  • Your browser or phone maker’s push service (Apple, Google, or Mozilla), if you turn on push notifications. Notifications contain only a short message.
• When the law requires it, or to protect someone’s safety, we may disclose information in response to a valid legal request.

We don’t sell or rent personal information to anyone.

How long we keep it

We keep your information while your account is open. Deleting an entry, photo, or voice note removes it from the service. When an account is deleted, we delete its information, including what it wrote, within 30 days, except where we must keep something by law. Backups are overwritten on a rolling basis.

Your choices and rights

• Edit or delete your entries and replies at any time.
• Change your notifications and reminders in Settings.
• Ask us for a copy of your data, to correct it, or to delete your account, by writing to [email protected].

Depending on where you live (for example, California or the European Union), you may have additional rights over your data. We honor these requests for everyone, wherever you live.

Security

Data is encrypted in transit and at rest, access to it is restricted, and passwords and PINs are stored only as secure hashes. No service can promise perfect security, but we work hard to protect your family’s words, and we’ll tell you promptly if a breach affects you.

Changes

If we make a meaningful change to this policy, we’ll tell you in the app or by email before it takes effect. The date at the top shows when it was last updated.

Contact

Questions or requests: [email protected].