Last updated: September 7, 2026
Effective August 26, 2026
Your Bright Spot is operated by Nicky’s Coaching Corner LLC (“we,” “our,” or “us”) and is a quiet, safe place to reflect. This policy explains, in plain language, what information we collect, how it is used, and the control you have over it.
What data we collect
We collect the information you provide when creating an account (your email address), your daily check-in entries (mood rating, mood tags, reflection answers, your identified bright spot, gratitude, and intention), your support-style and spiritual-language preferences, and your companion customization choices. We do not import your phone address book. If you choose to enter trusted contacts, their names and phone numbers are stored on this device for your account (up to three contacts). Tapping a contact opens your phone app to place a call. We do not collect your location or camera roll.
How your journal entries are stored
Journal entries and profile information are stored in our Supabase database. Some settings and cached information are also stored on your device; trusted contacts are stored locally for your account. Row-level security is used to restrict ordinary app users to their own account data. Authorized server functions use privileged access to operate the service, and authorized team access may be needed for support. These controls do not mean that only you, and no service provider or authorized operator, can access the data.
Your AI companion (Nova)
Nova is an AI companion, not a human, therapist, medical provider, or crisis counselor. To generate replies, your messages and companion preferences are sent through our API server to OpenAI. Available context can include excerpts from up to five recent journal entries and up to ten manifestations. These are separate from long-term memory and may be used even when Nova Memory is off.
When conversation-history saving is enabled, saved chat context may also be used; conversations are stored in your private account database with a local device cache. Existing accounts without a history preference retain the previous enabled behavior. In Settings, turning off conversation-history saving deletes saved conversations when the operation succeeds; Nova can still process messages to reply without retaining ordinary chat history.
Long-term Nova Memory requires separate opt-in. Turning it off stops new memory creation and retrieval but does not delete existing memories. Use Manage Nova memories to review, forget individual memories, or delete them all. Clearing conversation history does not clear long-term memory, journals, or voice notes. Check that each deletion succeeds; a failed request does not confirm removal.
Voice features — three separate paths
Your Bright Spot offers three distinct ways to use your voice, and each is handled differently:
- On-device speech recognition: The microphone button next to a text field uses Apple’s built-in speech-recognition system. Apple—not Your Bright Spot—controls whether a request is processed on the device or sent to Apple’s servers; this can depend on your device, iOS version, and language. Only the recognized text, never the raw audio, is sent to Your Bright Spot.
- Server transcription (Voice Journaling): Your recording is uploaded over an encrypted connection to our API server, processed in memory, and sent to OpenAI’s transcription API to convert it to text. Our transcription handler does not intentionally save uploaded audio to a database or disk. This does not guarantee immediate erasure from memory or provider systems. The resulting transcript is returned to the app and can be saved to your private journal entry.
- Uploaded voice notes (optional): If you choose to keep audio from a Voice Journaling session, the recording is uploaded to a private Supabase storage bucket in a folder scoped to your account, with a matching database record. Playback uses short-lived signed links that expire after one hour. There is no permanent public link to your audio. Deleting a voice note removes both the audio file and its database record.
Technical diagnostics
Your Bright Spot keeps a small, bounded technical diagnostic log on your device to help us fix bugs a tester reports—for example, “the Settings screen failed to open” or “a save request failed.” This log records only lifecycle events (what screen, what action, and what outcome) and never your journal entries, voice transcripts, companion conversations, credentials, receipts, or other private content.
Any identifier needed to correlate related events is replaced with a random token that exists only for your current app session. It is not a persistent device or user identifier and is never the same across two different app launches. The log never leaves your device automatically; it can only be copied or shared if you choose to do so from Settings, More, or the app’s error-recovery screen.
Who we share data with
Your Bright Spot uses a small number of service providers to operate. We do not sell or share your personal information with advertisers or data brokers:
- Supabase: Our database, authentication, and file-storage provider. Your account data, journal entries, companion conversations, and voice notes you choose to keep are stored here.
- OpenAI: Powers Nova’s replies and voice transcription. Your message and the context described above are sent to OpenAI’s API to generate a reply or transcript. OpenAI does not use API data submitted this way to train its models.
- RevenueCat: Manages premium subscription status. See “Subscriptions and payments” below for what it can and cannot see.
- Apple and Google: Process app distribution and in-app purchases. For on-device speech recognition, Apple controls whether a request is processed on the device or through Apple’s servers.
- Expo: Provides the app’s build and update infrastructure. Your Bright Spot does not use Expo’s push-notification service; reminders are scheduled locally on your device.
We do not use advertising trackers or track you across other apps or websites. RevenueCat processes purchase history and your app account identifier for subscription functionality and subscription analytics. Provider retention is separate from deleting data in Your Bright Spot. OpenAI API content is not used for training by default; provider safety logs may retain content under applicable retention rules. We do not promise zero provider retention.
Authentication
Sign-in is handled by Supabase Auth using your email and password. Passwords are never stored in plain text—they are hashed using industry-standard algorithms. Your session is managed with a short-lived access token that is automatically refreshed while you use the app.
Subscriptions and payments
Premium subscriptions are billed through Apple In-App Purchase on iOS or Google Play Billing on Android. Your Bright Spot never sees, stores, or has access to your payment-card information. RevenueCat manages your subscription status on our behalf, tied to your platform account. You may manage or cancel a subscription through your App Store or Google Play account settings.
Data storage and security
All data is transmitted between your device and our servers over encrypted connections (TLS). Supabase, our database and storage provider, encrypts stored data at rest as part of its standard infrastructure. We are not certified under ISO 27001, SOC 2, or HIPAA, and Your Bright Spot is not a covered healthcare entity. No method of transmission or storage is 100% secure. Although we take reasonable precautions, we cannot guarantee absolute security.
Data retention and deletion
You can export your journal and request deletion of entries, saved companion history, or Nova memories through the privacy controls. Conversation history and Nova Memory have separate controls. Check the result of each action; a failed request does not confirm deletion.
Submitting the account-deletion form records a pending account-deletion request. Your account and data remain stored until the deletion process completes. Processing may require retries or help from our team. You may sign out after submitting and contact support to check progress. We target completing verified requests within 30 days.
A limited deletion-audit record is retained separately from the deleted account. This audit record can include account and request identifiers, timestamps, processing status, retry counts, and sanitized error information. It is not anonymous.
After deletion completes, we retain this audit record and its matching deletion-recovery marker for 30 days, then automatically delete both. Failed, processing, or interrupted deletion records remain until the deletion is safely resolved.
Your rights and choices
You have the right to access the personal data we hold about you, correct inaccurate data, export your journal entries as text or JSON, request deletion of your account and associated data subject to the retention limits described above, and opt out of optional notifications through your device settings.
To exercise these rights or ask a question about your data, contact us using the email address below. We aim to respond within a few business days.
Age requirement
Your Bright Spot is intended for people who are 18 or older, and creating an account requires confirming this. We do not knowingly allow accounts for anyone under 18. If you believe someone under 18 has created an account, please contact us, and we will remove the account and its data promptly.
Changes to this policy
We may update this Privacy Policy from time to time and will update the date at the top of this page. For material changes, we will provide notice. Where separate consent is required, we will request it before applying those changes. Posting an updated policy does not by itself change your optional Nova Memory consent.
Contact us
For privacy questions, data requests, or to report a concern, email us at support@yourbrightspot.org.
If you’re in crisis
Your Bright Spot is not a replacement for professional mental-health care. If you are in crisis, in the United States you can call or text 988, text HOME to 741741, or call 911. Outside the United States, please contact your local emergency number or a local crisis service.