Therapy Notes Journal

PRIVACY POLICY

Last updated: October 3, 2026

This Privacy Policy explains how Rhythmic, Inc. ("Company," "we," "us," or "our") collects, uses, and discloses your information when you use our products, tools, and services, and outlines your rights and choices. It applies to Therapy Notes Journal and to the other applications, websites, and tools we operate, generally hosted at rhythmicapps.com and its subfolders (for example, https://rhythmicapps.com/therapy-journal), and any other standalone tools or sites we operate (each a "Product" and collectively, the "Products").

Please read this Privacy Policy carefully.

1. INTERPRETATION AND DEFINITIONS

Words with initial capitalization have the meanings defined below. These definitions apply equally to the singular and plural forms.

  • Account - A unique account created for you to access a Product or parts of it.
  • Affiliate - An entity that controls, is controlled by, or is under common control with the Company.
  • Application - Therapy Notes Journal, provided by the Company.
  • Company - Rhythmic, Inc., registered in Delaware, United States.
  • Device - Any device that can access a Product (e.g., smartphone, tablet, or computer).
  • Personal Data - Any information that relates to an identified or identifiable individual.
  • Service Provider - A third-party company or individual that processes data on our behalf.
  • Usage Data - Information collected automatically when using a Product (e.g., device type, session duration).
  • You - The individual using a Product, or the legal entity represented by that individual.

2. INFORMATION WE COLLECT

This Product stores the content you create primarily on your own device. We do not receive or store that on-device content on our servers. The information described below is limited to what is necessary to operate, support, and improve the Product.

We collect information you provide voluntarily and data collected automatically when you use a Product.

Information you provide

  • Support & Feedback: any information you provide when contacting us for support, completing surveys, or giving feedback.

Data collected automatically

  • Usage Data: how you interact with the Product, including features accessed, session duration, and frequency.
  • Device & Browser Data: IP address, device type, OS version, time zone, and language settings.
  • Referrer & Campaign Data: information on how you discovered the Product (e.g., ad source, referral link).

Advertising and analytics cookies (websites)

Rhythmic-hosted pages for this Product use the OpenAI Ads pixel to measure whether an advertising visitor clicks an app-download link. The pixel may process browser, device, referral, and interaction data for that purpose. It loads only after you accept optional advertising measurement and does not load when your browser sends a Global Privacy Control signal. You can reject or change this choice through the site's privacy controls.

Tracking and advertising identifiers

With your permission through the App Tracking Transparency prompt, and where otherwise permitted, we collect your Apple Identifier for Advertisers (IDFA) or Google Advertising ID (AAID) and use them, through the attribution partners listed in the Third-Party Services and SDKs section, to measure campaign effectiveness, attribute installs, and understand where users discover the Product. You can reset or disable these identifiers, and change your tracking choice, at any time in your device settings.

Your journal content

Your notes between sessions, pre-session and daily check-ins, session notes and takeaways, reflections, goals, therapist details, and values survey answers are kept in the app's private storage on your device. There is no account and no Rhythmic server copy. The text you write, including any feeling words or goals you add in your own words, is not included in Amplitude analytics events, AppsFlyer attribution events, or Sentry error reports or performance traces. If the app or its data is deleted, we cannot recover your writing. You may be able to restore an iCloud backup you made with an earlier version, as described below.

Analytics, diagnostics and attribution

Amplitude receives product events about onboarding, scheduling a session, saving a note, starting and completing a check-in, saving session notes, completing a reflection or the values survey, the breathing exercise, exports, turning the app lock on, and the in-app rating prompt. These events carry limited counts and settings, such as session format and alert timing, whether an export was a text or PDF file, the number of topics, takeaways or reflection answers, whether a note was filed under a session, and whether a daily check-in included a reflection. They do not carry your writing or your answers to check-ins or the values survey. Sentry receives errors, crash context and performance traces, which may include screen names, timings, app version and device information. AppsFlyer receives install-attribution data and two milestone events, your first completed daily check-in and your first saved note, with no content attached. Your therapist's name, your goals in your own words, and every note, reflection or check-in text are excluded from all of it.

Earlier app versions sent selected mood scores, feelings, energy levels, context and stress tags, contributing factors, reflection mood scores, and values survey results to Amplitude. Historical analytics records may still contain those selections. The current version no longer sends them. You can decline app tracking when iOS asks.

Device permissions

Therapy Notes Journal asks for permissions only when you use the feature that needs them, and works without any of them:

  • Notifications: to deliver the session and check-in reminders you turn on. Reminders are scheduled and delivered on your device; we run no push-notification server and no push token is created.
  • Calendar: to add a session you schedule to your calendar, and to remove the events the app added when you delete all entries. iOS grants this as full calendar access; the app only looks up the events it added and does not read or use your other events. Each event holds the session's date, time and alert and, if you picked a therapist, their name; it lives in your calendar and syncs wherever that calendar syncs. Deleting the app does not remove these events: use "Delete all entries" first, or remove them in your calendar.
  • Microphone and speech recognition: to turn what you say into text when you tap Speak on a note or an answer. Your speech is recognized on your device by Apple's on-device speech recognition: the audio is not recorded, stored or sent anywhere, including to us, and only the text you keep is saved, like typed text.
  • Face ID or Touch ID: to open the app when you turn on the optional app lock. The check happens on your device through the system prompt; the app never receives or stores your biometric data, and your device passcode remains the fallback.

Export

You can export your entries as a plain-text or PDF file at any time. The file is created on your device and shared only through the destination you choose in the system share sheet; we do not receive it.

Earlier iCloud backups

The app no longer creates new iCloud backups. If you turned on backup in an earlier version, your journal content and settings may remain in a private app area of your own iCloud account. Rhythmic does not operate that storage, cannot access your backup, and keeps no copy. Restoring an existing backup remains available without a paid plan.

Earlier app backups are separate from your visible files. Neither deleting the app nor using "Delete all entries" removes an existing iCloud copy or older device backups. You can remove an earlier app backup or iCloud device backup from iCloud storage settings (Settings, then your name, then iCloud, then Manage Account Storage). Computer backups are managed separately in Finder or Apple Devices on that computer. Calendar events the app added also remain if you delete the app without first using "Delete all entries."

3. HOW WE USE YOUR PERSONAL DATA

We process your personal data for the following purposes:

  • To provide and improve the Product: operate, maintain, and enhance the experience, enable core functionality, troubleshoot technical issues.

  • To analyze and enhance the Product: we use aggregated and anonymized data to understand how users interact with the Product, run surveys, test features, and identify improvements.

  • To customize your experience: where a Product offers personalization, apply the preferences you choose to display relevant features.

  • To enforce terms and prevent fraud: enforce our Terms, prevent fraud, resolve disputes, and detect malicious activity. Where required by law or in cases involving fraud or legal claims, we may share relevant information with law enforcement authorities.

  • To communicate with you: via email, in-app messages, or push notifications about your account, Product usage, or feature changes, including reminders or security notices.

  • To send marketing communications: we may send messages about features, offers, and events. You can opt out of marketing emails at any time via the "Unsubscribe" link in the email footer.

  • To provide customer support: respond to inquiries, send legal or status notices.

  • To comply with legal obligations: process or share information when required by applicable law, regulation, legal process, or government request.

4. THIRD-PARTY SERVICES AND SDKs

The Product relies on the third-party services and SDKs listed below. Each acts as a service provider/processor on our behalf unless stated otherwise. This section is assembled from the processors this app actually ships.

Amplitude (Amplitude, Inc.)

Product analytics and event tracking, to understand how users navigate and interact with the Product so we can improve functionality and engagement. Amplitude does not sell user data or use it for advertising. Privacy Policy: https://amplitude.com/privacy

Sentry (Functional Software, Inc.)

Error monitoring and performance tracking. Collects crash reports, error logs, and device information to help us identify and fix issues. Sentry does not use advertising identifiers. Privacy Policy: https://sentry.io/privacy/

AppsFlyer (AppsFlyer Inc.)

Our primary mobile attribution and marketing-measurement provider, and the partner that presents the App Tracking Transparency prompt. Where permitted (including after you allow tracking through that prompt), AppsFlyer may collect device identifiers such as the IDFA or AAID, IP address, and engagement and conversion data to attribute installs and measure campaign performance across our marketing channels (including Meta, Google, and TikTok). AppsFlyer processes this data on our behalf as a processor and does not use it for its own advertising purposes. Privacy Policy: https://www.appsflyer.com/legal/services-privacy-policy/

Web advertising and measurement pixels

The OpenAI Ads pixel runs on Rhythmic-hosted pages and landing pages for this Product, not inside the app. It measures advertising performance by recording an app-download-link click after optional consent. OpenAI may process browser, device, referral, and interaction data for this purpose. Privacy Policy: https://openai.com/policies/privacy-policy/

5. APP TRACKING TRANSPARENCY (ATT)

In accordance with Apple's App Tracking Transparency framework, Therapy Notes Journal may request your permission to track activity across apps and websites owned by other companies for advertising and attribution purposes. If you decline, we respect your choice and disable tracking features not essential to operating the Product.

6. SENSITIVE DATA

Therapy Notes Journal supports general wellbeing. We are not a medical provider and do not collect "Protected Health Information" under HIPAA. However, we recognize that the information you choose to record about your wellbeing (for example, how you are feeling, what you are practicing or working on, and any notes or reflections you add) can be sensitive, and we treat it with additional care. We process this data solely to provide the Product to you. The content you record remains private to you and is not shared externally unless you choose to export or disclose it.

This sensitive content is stored on your device and is not transmitted to or stored on our servers.

7. LEGAL BASES FOR PROCESSING (EEA/UK USERS)

If you reside in the European Economic Area or the United Kingdom, our legal bases for processing include:

  • Contract performance - to deliver the Product.
  • Consent: for tracking, cookies, and marketing communications (and, where applicable, for any special category data described in the Sensitive Data section).
  • Legitimate interests - to improve and secure the Product.
  • Legal obligation - to comply with applicable laws.

You have the right to withdraw consent at any time.

8. YOUR RIGHTS AND CHOICES

Depending on your jurisdiction, you may have the right to access or request a copy of your data, request correction or deletion, withdraw consent for marketing or tracking, request data portability, and object to certain processing. To exercise these rights, email us at support@rhythmicapps.com.

California residents (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect, use, and disclose; to delete it (subject to exceptions); to correct inaccurate information; to opt out of the "sharing" of personal information for cross-context behavioral advertising; and to non-discrimination for exercising these rights.

We do not "sell" personal information for monetary consideration. However, our use of analytics and advertising identifiers with the attribution partners listed in the Third-Party Services and SDKs section may constitute "sharing" under California law.

To exercise these rights, email support@rhythmicapps.com. We will respond to verified requests within 45 days.

Our use of the OpenAI Ads pixel to measure download-link clicks may involve disclosing certain identifiers and activity for cross-context behavioral advertising, which may constitute "sharing" or a "sale" under some state laws. You can opt out through the site's privacy controls or by emailing support@rhythmicapps.com. We honor Global Privacy Control (GPC) signals where required.

Other U.S. state privacy rights

If you reside in a U.S. state with a comprehensive consumer privacy law (such as Virginia, Colorado, Connecticut, Texas, Oregon, and others), you may have rights similar to those above, including to access, correct, delete, and obtain a copy of your personal data, and to opt out of targeted advertising, the sale of personal data, and certain profiling. To exercise these rights, contact us at support@rhythmicapps.com. You may also have the right to appeal a decision on your request.

9. DATA RETENTION

We retain your personal data only as long as necessary for the purposes stated in this Policy.

  • Attribution/analytics data: up to 24 months (aggregated data may persist longer in anonymized form).

  • Analytics and diagnostics: retained only while needed for product analytics, reliability, fraud prevention, applicable legal obligations, and dispute resolution. The applicable purpose, provider configuration, and legal obligation determine the period.

10. INTERNATIONAL DATA TRANSFERS

Your information may be transferred to and processed in the United States, the European Union, and/or other countries where we or our service providers operate. The primary processing location for Therapy Notes Journal is the United States. These countries may have data-protection laws that differ from those in your jurisdiction.

When we transfer personal data from the European Economic Area, United Kingdom, or Switzerland to a country without an adequacy decision, we rely on appropriate safeguards, including Standard Contractual Clauses approved by the European Commission (and the UK Addendum where applicable), and we maintain data-processing agreements with our service providers requiring them to protect your data consistent with this Privacy Policy.

If you have questions about international transfers, contact us at support@rhythmicapps.com.

11. DATA SECURITY

We use encryption, access controls, and secure servers to protect your data. However, no internet transmission or electronic storage is completely secure, and we cannot guarantee absolute security.

12. DATA BREACH NOTIFICATION

If a security breach results in unauthorized access to your personal data, we will notify the relevant supervisory authorities as required by applicable law (where required, within 72 hours of becoming aware), and we will notify affected users without undue delay where the breach is likely to result in a high risk to your rights and freedoms. We maintain incident-response procedures to detect, investigate, and respond to potential security incidents.

13. CHILDREN'S PRIVACY

Therapy Notes Journal is not directed to, and is not intended for use by, anyone under the age of 18. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us personal data, please contact us at support@rhythmicapps.com and we will delete it.

14. LINKS TO OTHER WEBSITES

Our Products may contain links to third-party websites not operated by us. We are not responsible for the content or privacy practices of those sites. Please review their privacy policies before providing any personal data.

15. CHANGES TO THIS POLICY

We may update this Privacy Policy periodically. The updated version will always be available at https://rhythmicapps.com/therapy-journal/privacy. We will let you know via email and/or a prominent notice in the Settings or Profile screen in the Product, and by updating the "Last updated" date above. Changes are effective when posted.

16. DELETE YOUR PERSONAL DATA

You have the right to delete, or request that we help delete, the personal data we have collected about you. Because this Product stores your content on your device, you can delete it directly within the Product or by deleting the app; we do not hold a separate copy on our servers. Please note we may need to retain certain information where we have a legal obligation or lawful basis to do so. To make a request, contact support@rhythmicapps.com.

17. EU / UK CONTACT AND REPRESENTATIVE

For questions about how we process the personal data of individuals in the EEA and the UK, you can contact our EU-based point of contact:

Gabriel Kwakyi Schumanngasse 67 1/7 1170 Vienna, Austria support@rhythmicapps.com +43 699 8189 6557

EEA and UK data subjects may contact us at this address regarding the processing of their personal data.

CONTACT US

If you have any questions or requests regarding this Privacy Policy, please contact us:

Rhythmic, Inc. Attention: Privacy Officer Email: support@rhythmicapps.com Address: 251 Little Falls Drive, Wilmington, DE 19808, United States