Privacy Policy
Effective date: October 13, 2026
This Privacy Policy explains how MyReflect ("we", "our") collects, uses, stores and protects information when you use our mobile app and this website. It is for general information and is not legal advice.
1. Who is responsible
The data controller is:
MyReflect
Julia Rosenögger
c/o Online-Impressum #9824
Europaring 90
53757 St Augustin
Germany
Email: info@myreflectapp.com
2. The app
2.1 Using the app without an account
You can use MyReflect without an account. In that case your entries stay on your phone, protected by a password you set. We do not receive them.
2.2 Information you provide when you create an account
When you create an account, we collect:
- your name
- your email address
2.3 Entries stored with your account
If you create an account, your entries are stored with your account so that they move with you and are available offline and across sessions. Depending on the modules you use, these entries can include your day ratings and feelings, journal and gratitude entries, sleep times, habits, water intake, period tracking (flow, symptoms and how you feel), your weekly mantra and your goals. Some of this information can be health-related.
We process this data only to provide the app's functions to you. Where it is health-related, we process it on the basis of your explicit consent, which you give when you create your account and which you can withdraw at any time by deleting your account.
2.4 Information collected automatically
MyReflect is distributed through the Google Play Store. Google may automatically collect certain data as part of app distribution, security and billing (for example device information, crash and diagnostic reports, and app performance data). This is governed by Google's own privacy practices, in addition to this policy. We do not add our own advertising, analytics or tracking SDKs to the app. We do not collect location data.
2.5 How we use your information
We use the information to:
- create and maintain your account
- authenticate you when you log in
- provide the core functions of the app
- respond to messages you send us
We do not sell your personal information, and we do not use it for advertising or third-party marketing.
3. This website
3.1 Server log files
When you visit this website, our web server automatically processes technical data that your browser transmits, such as your IP address, the date and time of the request, the page requested and the browser type. We process this data to deliver the website, keep it secure and find errors. Our legal basis is our legitimate interest in running a secure website (Art. 6(1)(f) GDPR). Log files are deleted after [TODO: retention period, e.g. 7 days].
3.2 Contact form and email
If you send us a message through the contact form, we process your name, email address, the topic you selected and your message to answer your request. Our legal basis is your consent (Art. 6(1)(a) GDPR) and, where your request relates to a contract or your rights, Art. 6(1)(b) and (c) GDPR. The form sends your message by email to our mailbox, which is hosted by STRATO AG. We keep your message as long as needed to handle your request and delete it afterwards, unless we are required to keep it by law.
3.3 Cookies and tracking
This website does not use cookies, analytics or tracking tools, and it does not load fonts or other content from third-party servers.
3.4 Hosting
This website is hosted on a server operated by [TODO: hosting provider and location]. The provider processes the log data described above on our behalf.
4. Third-party service providers
- Appwrite Cloud stores and manages account data and the entries you sync (name, email and associated app data). Appwrite processes this data on our behalf under its own security and privacy practices. See Appwrite's privacy policy for details.
- Google Play services collects certain data automatically as part of app distribution and billing, as described above.
- STRATO AG hosts our mailbox and processes the messages you send through the contact form or by email.
We do not share your personal information with any other third parties, and we do not permit these providers to use your data for their own purposes beyond providing services to us.
5. Data storage and security
Your account data is stored on Appwrite Cloud's infrastructure. We take reasonable measures to protect your information, but no method of electronic storage or transmission is completely secure, and we cannot guarantee absolute security.
6. Data retention and deletion
You can delete your account and associated data at any time directly in the app. When you do, your data is removed from our active systems. Residual copies may remain temporarily in routine backups kept by our infrastructure provider (Appwrite Cloud) before they are fully deleted.
If you can't delete your data in the app for any reason, you can ask us to do it using the contact form on this website (topic "Delete my data") or by email. To protect your account, we may ask you to confirm the request from the email address registered with your account.
7. Children
MyReflect is not directed at children under 13 (or the relevant minimum age in your country), and we do not knowingly collect personal information from children. If you believe a child has given us personal information, please contact us so we can delete it.
8. Your rights
8.1 GDPR
The controller is based in Germany, so the GDPR applies to our processing of your personal data wherever you are. You have the right to access, correct, delete, restrict and port your personal data, to withdraw consent at any time, and to object to certain processing. You can also lodge a complaint with your local data protection authority or with the data protection authority responsible for us.
8.2 California residents (CCPA/CPRA)
If you are a California resident, you have the right to know what personal information we collect, to request its deletion and to opt out of its sale. We do not sell personal information.
8.3 All users
Wherever you live, you can contact us at any time to ask for access to, correction of or deletion of your personal data.
9. International data transfers
We are based in Germany. Our infrastructure provider (Appwrite Cloud) may process data in locations outside Germany or the European Economic Area. Where this happens, we rely on appropriate safeguards, such as Standard Contractual Clauses, as required by the GDPR.
10. Changes to this policy
We may update this policy from time to time. Changes are posted here with an updated effective date. If a change affects how we process data you gave us earlier, we will ask for your consent again where the law requires it.
11. Contact
Questions about this policy or about your data rights, including deletion requests: info@myreflectapp.com, or use the contact form.