Privacy Policy

Last updated: 9 October 2026

Ponder is a private reflection and journaling app. This policy explains what information the app handles, why, and the choices you have. It applies to the Ponder mobile app published by Clearpoint Studios.

Your entries stay on your device

The journal entries, moods, tags, and settings you create are stored locally on your device. The app does not upload them to us, and we run no server that stores your journal. The prompts, summaries, and patterns Ponder shows you are computed on the device from those entries. The one exception is the handwriting import described below, which runs only when you take or choose a photo.

Ponder does not switch off the device backup of Android. If backup to your Google account is turned on in your phone's settings, Android may include Ponder's data in that backup. Android and Google run that backup, and we have no access to it. Without it, uninstalling the app removes your entries, so export anything you want to keep.

No account needed

You do not create an account to use Ponder. We do not ask for your name, email address, or phone number.

App Lock

Ponder offers an optional App Lock that uses the biometrics or the screen lock of your device (PIN, pattern, or password). It is off by default. Android performs the check on your device, and nothing about it is sent to us.

What leaves your device

Purchase identifier. Ponder uses RevenueCat to check whether Ponder Pro is active. RevenueCat issues a random app user ID on first launch and holds the purchase status behind it, together with the purchase receipt from Google Play and basic app and device information such as the app version, the platform, and the language. The app also attaches the result of its own integrity check (for example whether it was installed from Google Play and signed with our key) and, if you installed through a link, the source named in that link. The payment itself runs through Google Play. We never see your card details.

Install identifier and product events. On first launch the app generates a random install ID. It is sent to our analytics service on Cloudflare with events about the app itself: that the app was opened, which onboarding page was shown and for how long, whether the paywall or the Studio Bundle screen was opened, which plan was selected, and how a purchase attempt ended (product, price, error code). Each batch also carries the app version, the interface language, the platform, whether Pro is active, the purchase identifier, and the install source from the Play Store link if there was one. The service records the country the request came from and does not store the IP address. The same service tells the app which variant of a price test to show. None of these events contains anything you write, your moods, or your tags.

Device identifier (hashed). A SHA-256 hash of the Android ID of your phone, sent together with the purchase identifier to our service for the Studio Bundle and invitations, a Cloudflare Worker. It is sent once after installation on first launch, to check whether a Studio Bundle belongs to this device. It is sent again when you redeem a bundle code, when you restore purchases, when you open the invite screen, and when you use an invite link or code. It lets the service give Pro back after a reinstall on the same phone, limits how many devices one bundle code can unlock, and prevents one invitation from being redeemed several times from the same device. The Android ID itself never leaves the device. The hash carries no name and no contact detail. On every launch the app also asks this service, with the purchase identifier alone, whether a Studio Bundle is active.

Support. On first launch the app creates an anonymous support account on our Supabase backend: a random account ID with no name, no email address, and no password. It exists so that a conversation you start, and our reply, belong to your installation. On later launches the app uses it to check for replies. If you write to us through the in-app support, we receive your message, the app version, your Android version, the manufacturer and model of your phone, your language, whether Pro is active, and the country the request came from. A copy of the message with the app version, the Android version, and the Pro status also goes to our feedback service on Cloudflare, which tells us that a message arrived. Messages are machine translated with the Gemini API of Google, so that we can read yours and you can read our reply in your language.

Push token for support replies. Ponder includes Firebase Cloud Messaging, a Google service, to deliver a notification when we answer a support message. Firebase starts when the app launches and registers this installation with Google, which issues an installation ID and a push token. If notifications are allowed for Ponder, the app sends that token, the platform, and your language to our Supabase backend, so that the reply can reach your phone.

Handwriting import. Ponder can read a photo of a handwritten page and turn it into journal entries. The photo you take or choose is sent to our import service on Cloudflare, together with your interface language and your purchase identifier. The service checks the purchase identifier with RevenueCat, passes the photo to the Gemini API of Google to transcribe the handwriting, and returns the text to your phone, where it is saved like any other entry. Our service does not store the photo or the text. It keeps a counter of imports per purchase identifier, so that the allowance can be enforced. Nothing is sent until you take or choose a photo.

Other connections. At most once a day the app asks play.google.com whether other Clearpoint Studios apps are available, so that More Apps shows working links. That request carries no identifier. A Play Store link, the share sheet, and the rating dialog hand over to Google Play or to the app you pick.

All of this travels over HTTPS. None of it is used for advertising, and none of it is sold.

Advertising and tracking

Ponder contains no advertising, no ad network, and no advertising ID, and it does no cross-app tracking. The product events described above go to our own analytics service and to no analytics company. We do not build a profile of you, and we do not sell, rent, or trade your information.

Purchases

Ponder is free to use. Ponder Pro is an optional paid upgrade, and the Studio Bundle is a single purchase that unlocks Pro in several Clearpoint Studios apps. Purchases are processed by Google Play. RevenueCat confirms and restores them with the purchase identifier described above. If you buy or redeem a Studio Bundle, our bundle service stores the bundle code together with the purchase identifiers and hashed device identifiers of the apps it was activated in. Neither service receives your journal entries. We never see or store your payment details.

Notifications

If you allow notifications, Ponder sends you reflection reminders. These are scheduled on your device. The only notification that comes from a server is the one that tells you about a reply to a support message. You can turn notifications off at any time in the app or in your device settings.

Children

Ponder is not directed to children and is intended for adults. We do not knowingly collect information from children.

Data retention

On your device. Your journal entries, moods, tags, and settings are kept for as long as the app is installed. They go when you delete them in the app or uninstall it. We never receive a copy, so there is nothing on our side to keep.

Install ID and product events. Deleted automatically 400 days after they arrive. A scheduled job on the analytics service runs every day and removes everything past that date, including the install record once nothing newer has come from it.

Purchase identifier. Held by RevenueCat until you ask us to delete it, because restoring Ponder Pro is what it is for. A lifetime purchase you delete cannot be restored afterwards.

Device identifier (hashed), bundle codes, and invitations. The check on first launch only compares the hash. The hash is stored when a bundle code is entered on this phone, when you open the invite screen, or when you use an invitation. It is then held together with the code until you ask us to delete it, because recognising the phone after a reinstall is what it is for.

Support. A conversation is kept while it is open. Closed conversations are deleted automatically by a daily job. The anonymous support account and the push token stay until you ask us to delete them. A push token that has stopped working is removed the next time we try to use it.

Handwriting photos. Not kept by us. The photo exists on our service only for the one request that reads it, and the text goes straight back to your phone. The daily import counter behind your purchase identifier deletes itself after two days. The answer from RevenueCat on whether that identifier has Pro is cached for up to six hours. The counter for imports made without Pro stays until you ask us to delete it.

To have any of this deleted, write to [email protected].

Service providers

Google Play handles payments and distribution. RevenueCat holds the purchase status. Cloudflare hosts this website and runs our services for product events, the Studio Bundle and invitations, feedback, and the handwriting import. Supabase stores support conversations. Google delivers support notifications through Firebase Cloud Messaging and processes handwriting photos and support messages through the Gemini API. Apart from a photo or a message you choose to send, none of them receives what you write in your journal.

Changes to this policy

If this policy changes, we will update this page and the date above. Significant changes will be made clear in the app or on this site.

Contact

Questions about privacy? Email [email protected] and we will get back to you.