Who is responsible for your data
Data controller: Michal Jurena
Address: Mrsklesy 125, 783 65 Mrsklesy, Česko
Privacy contact:
support.oblak@gmail.comPhone: +420 773 878 879
Account and journal
Sign in with Apple uses Apple's system sign-in sheet in the app. Apple provides an account identifier and, when available, your name and email, which may be a private relay address. Oblak sends Apple's identity token to Supabase to authenticate your account; your Apple password is not shared with Oblak. Oblak stores your profile, photos, memory titles, notes, dates, places, coordinates, people tags and their images, and the changes needed to sync your journal. You choose which content to add. Photos and notes can contain information about other people; only add or share content you are entitled to use.
Oblak downloads journal data and photos from the cloud to keep a local copy on this device for viewing. During photo restoration, iOS may continue scheduled downloads after you leave the app or while the app is no longer running. Force-quitting the app can interrupt downloads; reopening it may be needed to resume. Background location tracking remains off.
Legal bases and purposes
Accounts, cloud synchronization, journal retrieval, subscription access and sharing you request are processed to perform our service contract (GDPR Article 6(1)(b)). Optional AI uses your separate consent (Article 6(1)(a)). Security, handling abuse reports and protecting users rely on our legitimate interests (Article 6(1)(f)); responding to legal duties relies on Article 6(1)(c). We do not sell your data or use your journal for advertising. Device permission alone is not consent to unrelated processing.
Providers and recipients
Supabase hosts authentication, the journal database, stored media and server functions. Apple handles sign-in, App Store purchases and subscription payments, and provides map, place-search and location services. If you enable the AI assistant, OpenAI processes the text described in AI & your data. Infrastructure providers may process network addresses, request metadata and security logs. Shared-album participants can access content made available to them. There is no advertising or cross-app tracking integration in this build.
We use Gmail (Google) for support email. OpenAI Sites hosts this website. Providers may process IP addresses and browser, request and error information to deliver and protect the service.
Payments and subscriptions
Apple processes subscriptions and payments through the App Store. On your device, Oblak checks verified StoreKit transaction information and subscription status to enable access. The current app does not send transaction receipts or purchase history to its Supabase backend and does not receive or store your payment card or bank account details.
Support and content safety
If you contact support, we process your contact details and message using Gmail (Google). Send only information needed to resolve the issue. Sharing safety uses reports containing your account ID, the reported account or content ID, a reason and optional description, plus processing status and times. Reports do not create another copy of the photo or journal. The operator reviews shared photos, album titles and names or avatars made visible to other users before they are shown to those users. Blocking records the two accounts and restricts their interactions. Private journal entries are not submitted to this sharing review.
Optional artificial intelligence
AI processing is off until you choose Allow in AI & your data. Once enabled, existing and future memory titles and notes are sent for meaning-based indexing, including during background sync activity while the app runs. Chat also sends recent messages, relevant memory text and metadata, names and identifiers of people tags, selected mentions and time zone. Pending local text edits may be included before cloud backup finishes. Photo files are not sent to the AI provider by the current integration.
Processing locations and transfers
The journal database is hosted in Ireland (EU) by Supabase. Authentication, storage, server functions, support and security operations may involve Supabase and its subprocessors in other countries. OpenAI processes optional AI requests, including in the United States; no EU-only AI processing or zero-retention configuration is claimed. Apple processes its sign-in, map and App Store services under its own privacy terms. Support email uses Google Gmail, and this website uses OpenAI Sites hosting; their service infrastructure may operate outside the EEA.
For transfers requiring protection outside the EEA, the providers' applicable data-processing terms include EU Standard Contractual Clauses or other lawful transfer mechanisms. Supabase's and OpenAI's published data-processing terms explain the relevant safeguards and subprocessors. You may ask the privacy contact for information or a copy of the safeguards relevant to your data. A database in Ireland does not mean all processing occurs in the EU.
Provider documents include further safeguards and lists of subprocessors:
Supabase DPA · Supabase subprocessors · OpenAI DPA · OpenAI subprocessors · Apple Privacy · Google Privacy
Retention and deletion
Your profile, journal, photos, people tags and AI search indexes are kept while your account exists, including after subscription expiry, until you delete the content or account. Accepted account deletion blocks access and aims to remove service-controlled live data within 30 days. Minimal deletion records (request ID, account ID, status and times) are retained for 90 days after completion; they do not retain your journal or media. Abuse reports are retained for 90 days from submission; blocks until you unblock or delete the account. Support correspondence is kept for 12 months after the request closes, unless a specific legal obligation or dispute requires longer retention. AI chat history is not stored as a journal record. OpenAI may retain API abuse-monitoring logs for up to 30 days by default, or longer where required by law or reasonably necessary to protect safety. Provider security logs and recovery copies follow the provider's applicable retention and deletion rules, not an instant-erasure promise. We do not offer a recoverable history of deleted entries. Contact us for details about a specific deletion or legally required retention.
Deleted memories are hidden locally while deletion is pending. Successful synchronization removes the cloud entry, its AI search index and associated media. The app keeps failed deletion work for retry; a connection is needed to finish cloud deletion. Check synchronization status in settings. Account deletion also removes remaining media belonging to your account, including incomplete uploads. Copies kept independently by other people are outside Oblak's control.
Your rights and choices
Where applicable, you can request access, correction, erasure, restriction and portability, and object to processing based on legitimate interests. Withdraw AI permission in AI & your data, also available from Account & help without a subscription. Withdrawal does not undo prior lawful processing. Requests are normally answered within one month, subject to lawful extensions explained to you. You can complain to your local data-protection authority; in Czechia this is ÚOOÚ (uoou.gov.cz).
An account and an active Oblak Plus subscription are needed to access the journal in the App Store version. You can decline optional AI and continue using the journal with your subscription. Privacy information and contact options remain available without an active subscription. Camera and location permission are optional; you can import a chosen photo or select a place manually. Oblak does not use AI to make decisions with legal or similarly significant effects about you.
Age, other people and policy changes
Oblak is intended for people aged 16 and over. It is a general personal journal, not a service for children or a medical record. If local law requires a guardian to authorize your subscription purchase, obtain that authorization. We do not request health records or other special-category personal data: do not upload sensitive information about yourself or others without an appropriate legal basis and any required explicit consent. People tags come from users, not an imported address book or facial recognition. If someone has added your information, contact us to exercise your rights. Material changes to processing are explained in an updated policy and require a new choice when consent is needed.
This website
This website does not add its own analytics, advertising tools, forms or localStorage. An email link opens a draft in your mail app and does not send a message by itself. Hosting may process technical logs for operation and security; this is not cross-app advertising tracking.