By downloading, accessing, purchasing, or using the App, you agree to these Terms of Use. If you do not agree, do not use the App.

Apple's Licensed Application End User License Agreement (the “Apple Standard EULA”) also applies. These Terms supplement the Apple Standard EULA. If they conflict, the Apple Standard EULA controls to the extent of the conflict. Apple is not responsible for the App or its support.

You must be at least 13 years old to create an account or use the App on your own. If you are under the age of legal majority where you live, your parent or legal guardian must review and agree to these Terms for you. The App is not directed to children under 13.

An App Store age rating describes the type of content in an app; it does not replace these eligibility rules or applicable privacy law.

Subject to these Terms and the Apple Standard EULA, Wind Down Studio grants you a personal, limited, revocable, non-exclusive, non-transferable license to use the App on Apple-branded devices you own or control as permitted by Apple's usage rules.

You may not copy, sell, rent, sublicense, distribute, reverse engineer, interfere with, or attempt unauthorized access to the App or its services, except where applicable law expressly permits it.

Current versions of One Year use Sign in with Apple for accounts and cross-device sync. You are responsible for maintaining control of your Apple ID and devices and for activity through your account.

Some people using an older version may continue in a legacy iCloud mode without creating a One Year account. Features and storage behavior may differ between legacy and current versions.

Please contact us promptly if you believe your account or journal has been accessed without authorization.

You keep ownership of the journal entries, moods, images, and other content you add to One Year (“Your Content”). You give Wind Down Studio a limited permission to host, process, encrypt, transmit, restore, and otherwise handle Your Content only as needed to operate, secure, support, and improve the App as described in the Privacy Policy.

You are responsible for Your Content and for making sure you have the right to store it. Do not use the App to store or transmit unlawful content, infringe another person's rights, introduce malicious code, attack the service, or attempt to access another user's data.

One Year includes an export tool so you can download your journal, including available text, mood, and image content. You should keep exports of anything you cannot afford to lose.

One Year may offer free features and paid weekly, monthly, or annual subscriptions, as well as a one-time lifetime purchase. Available plans, prices, features, currencies, eligibility, and promotions can vary by location and over time. The terms displayed by Apple when you confirm a purchase control that transaction.

Subscriptions automatically renew unless you cancel through your Apple account before the renewal date. Apple charges your Apple account and manages billing, renewal, cancellation, and refunds. Deleting the App or your One Year account does not automatically cancel an Apple subscription.

If Apple offers you a free or discounted trial, its length and eligibility will be shown before purchase. Unless you cancel before the trial ends, it converts to the paid subscription shown at checkout. Promotional and introductory offers may change or end.

You can manage or cancel Apple subscriptions and request a refund from Apple.

We may add, change, suspend, or discontinue features as One Year evolves. We work to keep the App available and your data safe, but uninterrupted access, error-free syncing, or permanent availability is not guaranteed.

Features may depend on Apple services, iCloud, Supabase, Cloudflare, internet access, device compatibility, or other third-party services outside our control. Apple Intelligence features also depend on an eligible device and Apple's on-device model availability.

You may stop using the App at any time. Signed-in users can delete their account from One Year's settings. Account deletion removes the active One Year backend account and associated synced journal data, but it does not cancel an Apple subscription or necessarily delete records Apple, RevenueCat, Meta, or another provider must retain under its own legal obligations.

We may suspend or terminate access if you materially violate these Terms, threaten the service or other users, or if required by law. Where practical, we will give notice and a chance to export Your Content first.

One Year is a personal journaling tool. It is not medical, mental-health, legal, financial, or other professional advice, and it is not an emergency service.

To the fullest extent permitted by law, the App is provided “as is” and “as available,” without warranties of merchantability, fitness for a particular purpose, non-infringement, availability, or data preservation. Nothing in these Terms excludes warranties or consumer rights that cannot lawfully be excluded.

To the fullest extent permitted by law, Wind Down Studio and its members, employees, and service providers will not be liable for indirect, incidental, special, consequential, exemplary, or punitive damages, or for lost data, revenue, profits, goodwill, or opportunities arising from the App.

To the fullest extent permitted by law, Wind Down Studio's total liability arising from the App or these Terms will not exceed the greater of the amount you paid for One Year during the 12 months before the event giving rise to the claim or US $100. These limitations do not apply where prohibited by law.

These Terms are governed by the laws of the State of Delaware, without regard to conflict-of-law rules. Any dispute that cannot be resolved informally may be brought in the state or federal courts located in Delaware County, Delaware.

If the law where you live gives you mandatory consumer protections or the right to bring a claim elsewhere, this section does not take those rights away. These Terms do not require arbitration or waive participation in a class action.

If a provision of these Terms is unenforceable, it will be limited to the minimum extent necessary and the remaining provisions will remain in effect. Our failure to enforce a provision is not a waiver. You may not transfer these Terms without our consent; we may transfer them as part of a merger, financing, reorganization, or sale of the App or our business.

We may update these Terms as the App, law, or our practices change. We will post the updated date here and provide additional notice in the App when a change is material. Continued use after the effective date means you accept the updated Terms to the extent permitted by law.

Wind Down Studio, LLC is the controller of personal information covered by this Policy.

Account and authentication data

When you create an account with Sign in with Apple, we receive an Apple-provided account identifier and authentication credentials. Depending on the information Apple includes and your Apple privacy choices, Supabase may also receive your email address or Apple private relay email address. We also process account creation and last sign-in timestamps.

Your journal data

We process the text, images, moods, entry dates, plant layouts, timestamps, deletion status, and related sync metadata you choose to save. Journal text and image files are encrypted before they are stored on our current backend. Entry dates, mood values, file paths, plant layouts, and operational timestamps are currently stored as unencrypted metadata so syncing and garden features can work.

For legacy users who have not migrated, journal data may remain on the device and in the user's private Apple iCloud/CloudKit container rather than our current backend.

Purchases and entitlement data

Apple and RevenueCat provide transaction, product, subscription, trial, renewal, cancellation, receipt, entitlement, anonymous purchaser identifier, device, and attribution information needed to offer paid features, validate purchases, restore access, prevent fraud, and measure subscription performance. We do not receive your full payment card number.

Usage, analytics, and diagnostics

We use PostHog to process a pseudonymous account or device identifier, app and device information, feature interactions, paywall and purchase activity, settings choices, and diagnostic errors. Some events can include the date of a journal entry, a selected mood value, character count, whether an entry contains a photo or mood, and subscription-access status. We do not intentionally send journal text or journal images to PostHog.

The App also sends an aggregate numerical change when a memory is planted or removed so we can show a total community memory count. That request does not include the journal entry, account ID, mood, or image, although the network provider may process standard request information such as an IP address.

Advertising conversion data

We use Meta tools only to measure whether advertising led to app activity or purchases, not to read or target ads based on journal content. The Meta SDK and RevenueCat attribution integration may process device identifiers, a Meta anonymous identifier, app activation, campaign attribution, purchase, subscription, and conversion events.

Device permissions and local data

If you choose, the App accesses selected photos, the camera, notifications, and Face ID or other device authentication. Photos and camera images you attach become part of Your Content. Apple performs biometric authentication; we receive only the success or failure result, not your biometric data. Reminder preferences and journal-lock settings are stored on your device.

On-device Apple Intelligence

On supported devices, an optional writing-prompt feature can use recent journal entries with Apple's on-device Foundation Models. The App does not send those entries to Wind Down Studio, PostHog, or an external AI model for that feature.

Support communications

If you contact us, we process your email address, the content of your message, and any account identifier or diagnostic information you choose to include so we can respond.

• Provide accounts, syncing, restore, export, and widgets.
• Encrypt, secure, maintain, and troubleshoot the App.
• Process purchases and provide paid features.
• Understand feature use and improve performance and design.
• Measure advertising conversions and campaign effectiveness.
• Respond to support and privacy requests.
• Prevent fraud, abuse, security incidents, and violations of these Terms.
• Comply with law and enforce our legal rights.

Where the EEA, United Kingdom, or similar law applies, our legal bases are: performing our contract with you to provide One Year; our legitimate interests in securing, supporting, improving, and measuring the App; consent where required for device permissions or advertising measurement; and compliance with legal obligations. You may withdraw consent at any time, without affecting processing that occurred before withdrawal.

We do not sell journal entries or journal images. We disclose information only as described below:

• Apple: authentication, iCloud for legacy users, device permissions, App Store purchases, subscriptions, refunds, and platform services.
• Supabase: account authentication, database, encrypted journal text, unencrypted sync metadata, and server functions.
• Cloudflare: encrypted image-object storage, delivery through signed URLs, and the aggregate planted memory counter.
• PostHog: pseudonymous product analytics, feature flags, and diagnostics.
• RevenueCat: purchase validation, entitlements, subscription analytics, and conversion attribution.
• Meta: app activation and advertising conversion measurement. This disclosure may be considered “sharing,” targeted advertising, or cross-context behavioral advertising under some privacy laws even though we do not sell information for money.
• Legal and safety recipients: if reasonably necessary to comply with law, protect users, investigate abuse or security incidents, or establish and defend legal claims.
• Business transfers: in connection with a merger, financing, reorganization, acquisition, or sale, subject to appropriate confidentiality and notice.

You can review the providers' policies at Apple, Supabase, Cloudflare, PostHog, RevenueCat, and Meta.

Current accounts use a unique data-encryption key to encrypt journal text and images with AES-GCM before backend storage. The account key is encrypted under a service master key and is provided only to an authenticated device. Image objects are kept in private storage and accessed with short-lived signed URLs. We also use transport encryption, account-scoped access controls, and platform security features.

This design is not a zero-knowledge system: because Wind Down Studio operates the service master key, we can technically recover an account's encryption key when necessary to operate, secure, restore, or comply with law. No security method is perfect, and we cannot guarantee that unauthorized access or loss will never occur.

We keep your active account and synced journal data until you delete the account or the information. We do not maintain a separate backup archive of journal content. When in-app account deletion succeeds, active Supabase account and database records are deleted and associated Cloudflare R2 image objects are removed.

Product analytics and diagnostic data are retained for up to 12 months. Support communications are kept only as long as needed to resolve the request and maintain reasonable business records. Purchase, tax, fraud-prevention, security, and legal records may be kept for the period required by law or reasonably necessary to establish or defend legal claims.

Service providers may retain limited records under their own legal obligations or standard deletion cycles. Deleting your One Year account does not delete data controlled independently by Apple or cancel an Apple subscription.

Wind Down Studio is based in the United States, and our providers may process information in the United States and other countries where privacy protections may differ from those where you live. Where required, we rely on recognized safeguards such as adequacy decisions, standard contractual clauses, or provider data-protection terms for international transfers.

You can:

• Edit or delete individual journal entries and images in the App.
• Export available journal content from settings.
• Delete your One Year account and synced content from settings.
• Change camera, photo, notification, and biometric permissions in iOS Settings.
• Manage or cancel subscriptions in your Apple account.
• Contact us to request access, correction, deletion, portability, restriction, or objection where applicable.
• Object to or opt out of Meta advertising conversion measurement by emailing us with the subject “Privacy Opt-Out.”

Depending on where you live, you may have rights to know or access information, correct it, delete it, receive a portable copy, restrict or object to processing, withdraw consent, and appeal a denied request. You may also have the right to opt out of the sale or sharing of personal information, targeted advertising, or certain profiling, and to receive equal service without discrimination for exercising a right.

We do not sell personal information for money. Meta conversion measurement may be treated as “sharing” or targeted advertising in some jurisdictions. To exercise a right, email hi@wndn.studio. We may need to verify your request. You may use an authorized agent where applicable. If you are not satisfied with our response, you may appeal by replying to our decision and may complain to your local privacy or data-protection authority.

One Year is not directed to children under 13, and we do not knowingly collect personal information from a child under 13 without legally valid parental consent. If you believe a child under 13 has provided personal information, contact us so we can investigate and delete it. Users under the age of legal majority must use the App with permission from a parent or legal guardian.

We may update this Policy as One Year, our providers, or applicable law changes. We will update the effective date above and provide additional in-app notice when a change is material. Where required, we will ask for consent before using information for a materially new purpose.

For privacy questions or requests, contact: