What we collect, why, where it goes, and how to take it back.

1. The short version

• You need only an email address to use Elja. We never ask for a card to start.
• Your reflections, promises, recordings and Mirrors are yours. We do not sell them, show you ads, or use them to train AI models.
• AI features (the read-back after an entry, the Weekly Mirror, Proof of Becoming, the Sunday Letter, Mentor, transcription) send your words to a processor to do that one job and nothing else. You can turn AI processing off in Settings.
• Rooms, on Elja Studio, is the one place other people see anything you wrote. Every post and reply is read before it appears, and all anyone ever sees is a username.
• You can export everything or delete your account instantly, from inside the app, at any time. A Room post is the one thing that does not vanish outright — your words are replaced and your name is removed, so that other people's replies still make sense. Section 5 says exactly what happens.
• Elja is for adults 18 and over.

2. What we collect

Account. Your email address, a sign-in token, the language you chose, your time zone and reminder hour, your plan, and a record that you accepted these terms and confirmed you are 18 or older.

Your practice. The text of each reflection; a voice recording when you choose to speak instead of type; the transcript of that recording; each promise and whether you marked it kept, revised or released; the mission you are on and the day you are on; anything you import from another journal.

What Elja writes back. The short summary and themes after an entry, the Weekly Mirror, Proof of Becoming, the Sunday Letter, reminders and check-ins. These are generated from your entries and stored separately from them.

Elja Mentor (Elja Studio). What you type to Mentor and what Elja writes back, kept as a conversation so you can reopen it. A reading of each message you send — none, watch, or crisis — is stored alongside it, and is what decides whether Elja answers with resources instead of a reply. When Mentor suggests something you can put on your Mission, we store the suggestion and whether you took it.

Time Capsule (Elja Studio). A short video or audio message to yourself, sealed until Day 30. It is stored in a private bucket, is never transcribed, summarized or read by any AI, and is included in export and delete.

Rooms (Elja Studio). Rooms are small boards by topic where people answer one question a week. If you use them we store: the username you chose and the date you last changed it; each post and reply, with the username you wrote it under copied onto it; the optional promise on a post; whether each one is waiting to be read, published, refused or hidden; which posts you tapped “I’m with you” on; and any report you file, with the reason. We also keep the moderation record for each post and reply — which check ran, what it decided, and which model — but never a copy of what the post said.

Nothing in a Room is ever read back into your own practice. Your posts do not appear in your History, in a Mirror, in Proof, or in anything Mentor says, and nothing you wrote privately is ever pre-filled into a post.

Your username is the only thing other people in a Room see. Your display name, email, photo, location, plan and account id are never shown, and usernames cannot be searched.

Sharing you choose. If you invite a Witness, we store their name and email and a record of each time they viewed your dots. A Witness sees only kept / revised / released by date — never a word you wrote. If you join an organization on Elja for Teams, your organization sees participation for groups of ten or more people only, never an individual and never an entry; this is enforced in our database, not just in policy.

Email course. If you sign up for Keep One Promise by email on our website, we store your email address, which day you are on, and an unsubscribe token. We never store your replies.

Device and usage. App version, device type and operating system, crash reports, and product events such as “reflection saved” or “mirror viewed.” Events never contain the content of an entry. Reminders are scheduled on your phone by the app itself; we hold no push notification token and cannot send you a notification from our servers.

Payments. Subscriptions are bought through Apple or Google in the app, or through Stripe on the web. We receive a confirmation of what you bought and when it renews or ends, and for a web purchase the email address you gave the checkout. We never see your card number.

3. Why we use it (and our legal basis)

We use your information to run Elja and keep your practice in one place (performance of our contract with you); to generate the read-back, Mirrors and Proof when AI processing is on (your consent, which you can withdraw in Settings); to send the reminders and emails you asked for (consent); to keep the service secure, fix crashes and understand which features are used (our legitimate interests, balanced against yours); and to comply with the law.

If you use Rooms, we read every post and reply before it appears. We do that to run a shared space that is safe to be in, which is part of our contract with you and is also our legitimate interest and everyone else’s in the room; where a post reads as somebody being in danger we act on that in the interests of their vital protection. You can leave Rooms alone entirely and everything else in Elja works exactly the same.

We do not use your reflections, recordings, promises, Mirrors or Time Capsules for advertising, for profiling, or to train or improve any machine-learning model, ours or anyone else’s.

4. Who processes it for us

We use a small number of service providers, each under a contract that limits them to doing the job described. None of them may use your content for their own purposes.

We may also disclose information if the law requires it, to protect someone’s safety, or in a merger or acquisition (in which case this policy continues to apply to your data, and we will tell you).

5. Where it lives and how long

Our servers are in the United States. If you use Elja from elsewhere, your information is transferred to and processed in the United States under standard contractual safeguards.

We keep your data for as long as your account exists. When you delete your account, your account row, entries, recordings, Mirrors, Proofs, promises, Witness grants, Time Capsules and consent records are deleted immediately from our live database and purged from backups within 30 days. Subscription records are kept by Apple, Google, RevenueCat and Stripe as long as they require for tax and fraud purposes. Unsubscribing from the email course stops the emails; we keep your address and the record that you unsubscribed, so that nothing is sent to you again by mistake. Deleting your account deletes that record too, along with the address. You can also ask us to delete it at any time by writing to contact@eljaapp.com.

What happens to a Room post when you delete your account, and why it is not simply deleted. A post in a Room usually has other people’s replies underneath it, written by people who did not agree to lose what they wrote because somebody else left. So the post itself stays and everything of yours comes out of it: the link to your account is removed, the username on it is replaced with “someone who left”, the words are replaced with “This person has left Elja.”, and the promise attached to it is deleted. The same happens to every reply you wrote. Your “I’m with you” taps and any reports you filed are deleted outright. The moderation record stays attached to the emptied post — it says which check ran and what it decided, and it never held a copy of what you wrote. Nothing of yours is left in a Room, and the conversation other people had still reads as a conversation. If you would rather a post were gone before you delete your account, email contact@eljaapp.com and we will remove it.

6. Your controls

All of these are inside the app, under Settings, and work instantly without emailing anyone:

• AI processing off. Elja stops sending your entries anywhere for summaries, Mirrors, the Sunday Letter or Mentor. Voice transcription also stops. Everything else keeps working. The one thing this switch does not cover is posting to a Room, because a post cannot appear in front of other people without being read first — so with the switch off you can still read Rooms, and posting still sends that post to be checked. Nothing else about your practice is sent.
• Export. One tap produces a file with everything we hold about you, including your Room posts and replies.
• Delete account. One tap, one confirmation, gone. You can also delete a single entry, recording, Time Capsule or Witness at any time. A Room post is the exception — see section 5 — and we will remove one on request.
• Reminders. Change the hour or turn them off. Reminders are notifications on a phone, so this control lives in the iPhone and Android apps; the web app does not send them and does not show the setting.
• Witness. Revoke access at any time; the link stops working immediately.
• Vault lock. Require a PIN or biometrics to open Elja on your device. This one is also iPhone and Android only: it locks the app on a phone you carry, and a browser tab is not that.

Depending on where you live, the law may also give you the rights to access, correct, restrict, port or object to how we use your information, and to complain to a data protection authority. You can exercise any of these by using the controls above or by emailing contact@eljaapp.com. We will answer within 30 days and we do not discriminate against you for using your rights.

California residents. We do not sell or share personal information as those terms are defined by the CCPA, and we have not done so in the past twelve months. The categories we collect are listed in section 2.

European Economic Area and United Kingdom residents. Elja App LLC is the controller. Our legal bases are in section 3. Transfers to the United States rely on the Standard Contractual Clauses and the UK Addendum.

7. Security

Everything is encrypted in transit (TLS) and at rest. Your recordings and Time Capsules live in private storage that only your account can open. Access to production systems is limited to the people who run Elja and is logged. Elja is not end-to-end encrypted: our server has to read an entry to generate a Mirror from it, and we say so plainly rather than promise something we can’t keep. If we ever have a breach that affects you, we will tell you and the relevant authorities as the law requires.

8. Elja is not a medical service

Elja is a reflection practice. It is not therapy, medical care, or crisis support, and nothing it writes to you is a diagnosis or treatment. If you write about wanting to hurt yourself, Elja will show you resources and a way to reach a person instead of a generated reply. In a Room, that post is not published and is not kept: you see the resources, nobody else sees anything, and you are never told you broke a rule. If you are in danger, contact local emergency services.

9. Children

Elja is for adults. You must be 18 or older to create an account. We do not knowingly collect information from anyone under 18; if we learn we have, we delete it. If you believe a minor has an account, email contact@eljaapp.com.

10. Changes

What changed on September 17, 2026. Section 2 no longer lists a push notification token, because we never stored one: reminders are scheduled on the phone by the app. Nothing else changed.

What changed on September 13, 2026. Rooms and Elja Mentor are described for the first time, in sections 2, 3, 4, 5, 6 and 8 — including the one place the AI processing switch does not reach, and exactly what happens to a Room post when an account is deleted. Stripe was added to the processor table in section 4, because a subscription can be bought on the web as well as through the app stores. The OpenAI and ElevenLabs rows now name everything they are actually sent. Nothing about reflections, recordings, Mirrors, Proof or Time Capsules changed.

When we change this policy in a way that matters, we will tell you in the app or by email before it takes effect, and we will keep the previous version available on request. The effective date at the top always tells you which version you are reading.

11. Contact

Elja App LLC · contact@eljaapp.com