Privacy policy
Your diary, your choices.
How Niji Diary handles local records, optional online assistance, purchases and support.
Who provides Niji Diary
Niji Diary is provided by Jignesh Patel, an independent developer. This policy covers the Niji Diary app, nijidiary.com and our online services. Contact support@nijidiary.com for support, privacy requests or questions about this policy.
The account holder is responsible for records they add and for permission to include other people’s information. The service is intended for adults; children’s activities and care records are managed by the responsible adult, not through independent child accounts.
Your encrypted local diary
Saved records and supported files are encrypted in a vault on your device. The local diary does not require an online account. Niji does not receive your vault’s decryption key. Device and browser storage, your chosen unlock method, and recovery material determine access.
Encrypted exports go where you choose. Keep the export and recovery code separately. A readable export is no longer encrypted. Uninstalling the app or clearing browser storage can remove the local copy. Niji cannot remotely recover or erase a vault that exists only on your device.
When you ask Diary for online help
Starting voice, image, or text assistance sends the content needed for that request through Niji’s Cloudflare service to Google Gemini. This can include live audio, your selected photo or file, your question, and relevant records or screen-control descriptions. The app does not send the entire vault simply because you open it. Online AI processing is separate from local encryption.
With AI Off, the app makes no AI requests. You can still use manual entry, local search and encrypted export. The microphone or camera is used only for the feature you start and the permission you grant. You can stop the session or revoke permission in your device settings.
Google applies its own processing and abuse-monitoring rules. Its published Gemini API policy describes retention of prompts, context and output for up to 55 days for abuse monitoring. Niji does not promise zero retention by Google. See Google’s abuse-monitoring policy and Gemini API terms.
Niji keeps service authorization, usage quantities, time allowance, coarse status and error records needed to operate online assistance and prevent abuse. These service records are separate from your local diary. AI can be wrong; review important details before saving or acting on them.
Accounts and purchases
An online account connects purchases and hosted service access across supported devices. We process the email address you verify, passkey public credentials, opaque account and device identifiers, sessions, membership permissions, and purchase entitlements. Your passkey’s private key remains with your passkey provider. Creating this account does not upload or unlock the local vault.
Apple or Google handles payment details. RevenueCat processes store transaction identifiers, product and subscription status, purchase history and an opaque billing identifier so Niji can confirm purchases, restore access and calculate allowance. Niji does not receive your payment-card number from an app-store purchase. Your vault key and diary contents are not supplied to RevenueCat for billing.
Verification and recovery email is delivered through Cloudflare Email Sending. Incoming support email uses Cloudflare forwarding to the support mailbox. Email providers process messages and delivery metadata under their own policies.
Usage sharing, reports and support
Optional usage sharing records counts and performance measurements with a configurable installation identifier. It excludes diary entries, photos and conversation content. You can turn sharing off in Settings and manage the identifier there. Cloudflare processes network details such as IP addresses to deliver and protect requests, even when they are not included in our analytics events.
A private support receipt contains app version, platform, coarse service state and fixed error codes. It does not include your diary, conversations, file names, account identity or keys. If you email us, we receive the email address and the information you include; send only what is needed to explain the problem.
Reporting an AI response is a separate, explicit action. The report preview lets you choose the response, context and any attachments to send. Submitted report content and media expire after 7 days; content-free report status expires after 30 days. Unfinished uploads expire after 1 hour. The report access receipt lasts 24 hours. Private storage and scheduled cleanup enforce these limits; removal can complete on the next cleanup run.
Launch notifications
If you ask to hear when Niji Diary launches, we collect your email address and record your consent. We send a confirmation link before adding you to the launch list. This does not create an app account, start a subscription or enroll you in a newsletter. Launch contacts are stored separately from app accounts and analytics, with the address encrypted in our Cloudflare database.
Use the unsubscribe link in your confirmation email to remove your contact, or email support@nijidiary.com. Unconfirmed requests expire after 48 hours. Confirmed contacts are removed when you unsubscribe, within 90 days after the launch notice, or after one year, whichever comes first. Scheduled cleanup runs hourly. Cloudflare processes confirmation email and delivery metadata; its provider retention may differ from our contact retention.
Website page views
We use Cloudflare Web Analytics to understand visits and page performance on this public website. It does not use cookies or local storage, collect form values or email addresses, or connect visits to your app account, diary or launch signup. It does not run on notification-management pages, URLs containing query details, or when Do Not Track or Global Privacy Control is enabled. Cloudflare still processes network information needed to deliver requests. We do not use advertising pixels, session replay or cross-site advertising profiles.
Retention and service providers
Local records remain until you delete them. Account, membership and allowance records remain for the service they support; account deletion removes or de-identifies service-held records through the deletion workflow. Limited purchase, unused-credit, fraud-prevention and legally required records can remain where necessary to honor obligations. The deletion receipt explains the status and any retained categories.
Support correspondence is kept as needed to resolve requests and meet applicable obligations. Store, email, infrastructure and AI providers may retain their own records under their policies. We use Cloudflare for hosting, security, databases, private report storage, email and usage analytics; Google for Gemini; RevenueCat for purchase management; and the store you use for purchases. Processing may occur outside your country.
We do not sell personal information or use diary content for advertising. Website measurement is limited to the Cloudflare Web Analytics described above.
Your controls and privacy requests
You can turn AI and usage sharing off, revoke microphone and camera permissions, export or erase the local vault, manage store subscriptions, and request deletion of the online account. See the deletion guide. Deleting an account does not cancel a store subscription or erase copies you exported.
Depending on where you live, you may have rights to access, correct, delete or receive a copy of service-held personal information, restrict or object to processing, or withdraw consent. Email support@nijidiary.com. We may need to verify control of the account without requesting your vault key, recovery code or passkey. You can also contact your local privacy regulator. Exercising privacy rights does not affect your right to use the free local diary.
We update this policy when our practices change. The effective date and version identify the current policy; significant changes affecting existing users will be communicated through the app or an appropriate account channel.