Privacy Policy

Who we are

Solous ("Solous", "we", "us", "our") is a private life-journaling service, operated by its founder, an individual based in the State of Washington, USA. For the purposes of the EU/UK General Data Protection Regulation (GDPR), the operator of Solous is the data controller of the personal data described here.

Data-protection contact: contact@solous.net. We answer privacy requests within 30 days (45 days where Washington law applies; see the Consumer Health Data Policy).

What we collect

• Account data: your email address, your settings (such as time zone, display name and photo size), and authentication credentials (a one-way hash of your password, passkey public keys, and authenticator/2FA setup). If you sign in with Face ID, a fingerprint or another passkey, the biometric check happens entirely on your device: we never receive your face, fingerprint or any biometric data, only a public key. For end-to-end-encrypted accounts we also store wrapped (encrypted) key material that only your passphrase or recovery key can open — we cannot use it.
• Your content: the entries, replies, tags, emotions, locations, edit history, and media (photos, audio, video) you choose to save. This exists solely so the Service can show it back to you. Photos you upload may carry embedded data from your camera (such as the date or place they were taken); large photos are resized on your device before upload, which removes it, but a photo small enough to be uploaded unchanged keeps it.
• Technical logs: web-server access logs (masked IP address, timestamps, requested pages) and application error logs (error traces), kept briefly for security, abuse prevention, and debugging.
• Records of agreement: which version of our terms you accepted and when, and when you gave consent for sensitive information. We keep these to show what you agreed to.
• Essential cookies: a session cookie and a CSRF-protection token, required to keep you logged in securely, and a short-lived cookie that carries one-time notices (such as "Saved") from one page to the next. Nothing else.
• Storage on your own device: while you write, your browser keeps unsent drafts locally (encrypted, if your account uses end-to-end encryption) so they survive a closed tab, and deletes them after 30 days. An end-to-end-encrypted account also keeps its unlocked key in the browser tab until you close it. This stays on your device; we never receive it.
• Abuse counters: to rate-limit sign-ups and emails, we keep short-lived counters keyed by IP address or email address, which expire within about a day.
• Messages you send us: email to contact@solous.net is stored on AWS for 30 days and kept in our mailbox for as long as needed to handle it.

We collect nothing else. No analytics scripts, no advertising pixels, no third-party trackers, no device fingerprinting, no data brokers.

Server logs. Our own web server records each request so we can tell whether the site is working and spot abuse. We deliberately keep the least that is still useful: your IP address is masked before it is written down (the last part is replaced with zeroes, so it identifies a rough network rather than you), anything you typed into a URL is dropped entirely — searching your own journal never reaches a log file — and cookies are never recorded, so a log can't be used to sign in as anyone. These access logs are deleted after 14 days. Application error logs, which record what went wrong when something breaks, are deleted after 30 days. They are never used to build a profile, and they are never shared.

One exception, stated plainly because it is a third party: the sign-up and password-reset pages load a bot check from Cloudflare (Turnstile). It exists to stop automated scripts from creating accounts and making us send email to people who never asked for it. Cloudflare sees your IP address and some browser characteristics in order to decide whether you're a robot. It is not an analytics or advertising product, it sets no tracking cookies, and it appears nowhere inside your journal — only on those two pages, before you have an account.

Why we process it, and our legal bases

We only process your data to run the Service for you. Under the GDPR, our lawful bases are:

• Performance of a contract (GDPR Art. 6(1)(b)) — creating and operating your account and storing/serving your content are what you signed up for.
• Legitimate interests (Art. 6(1)(f)) — keeping the Service secure and reliable (brief logs, abuse prevention, debugging), balanced against your rights.
• Legal obligation (Art. 6(1)(c)) — where we are legally required to retain or disclose specific information.
• Consent (Art. 6(1)(a)) — for anything optional we might add in future; you can withdraw consent at any time.
• Explicit consent for sensitive information (Art. 9(2)(a)) — a journal may contain special categories of data, such as information about your health, religious or philosophical beliefs, or sex life. We store it only because you ask us to, with explicit consent you give separately from our Terms, when you sign up (or, for older accounts, when asked). You can withdraw it at any time by deleting that content or your account.

We do not use your data for advertising, profiling, automated decision-making with legal effect, or AI training.

How your content is protected

• Encrypted in transit (HTTPS/TLS with HSTS) and encrypted at rest (AES-256).
• Two-factor authentication (passkeys or an authenticator app) is available on every account and recommended. It is not mandatory: an account without it is protected by its password alone.
• Media is kept in a private store and served only through short-lived signed links.
• End-to-end encryption (optional, per account): when you turn it on, your entries, replies, locations, edit history, and media are encrypted on your device with a key derived from your passphrase. We store only ciphertext and key material we cannot open. In that mode we cannot read your content — and we cannot recover it if you lose your passphrase and recovery key. This is the point. What end-to-end encryption does not hide: that an entry exists and its dates, how many entries you have, tag and emotion names, file sizes, and your account data.
• Honesty note: for accounts without end-to-end encryption, "encrypted at rest" does not stop our systems from technically accessing stored content. We do not access it except where strictly required to operate the Service, to carry out your own request (such as erasing content), to prevent imminent harm, or where legally compelled.

How long we keep it

• Your content and account data: for as long as your account exists.
• Deleting a single entry or reply hides it everywhere in the Service, but keeps it in your account, together with earlier versions of anything you edited and photos or audio you removed from an entry, so that a journal never silently loses its past. (Videos you remove are erased, to free space.) To permanently erase specific content without closing your account, email contact@solous.net and we will do it within 30 days. Deleting your account (Settings) erases everything, as described next.
• Deleting your account: we ask for your password (or passkey) again, then switch the account off at once, so nobody can sign in to it or see it, and email you a link to cancel. It is permanently erased 30 days later. The wait protects you if someone else got into your account, or if you change your mind. If you want it erased sooner, email us and we will do it right away.
• After erasure: copies expire from encrypted database backups within 7 days, and deleted photos, audio and video remain in encrypted storage version history for up to 30 days (so an accidental deletion can be recovered) before being permanently erased.
• Technical logs: access logs 14 days; application error logs 30 days.
• Records of account actions: if we warn, limit or suspend an account for misuse (Terms, section 5), we keep a record of what we did, why, and the activity records it was based on (such as upload and request counts and times, never journal content), for as long as the account exists and afterwards only as long as needed to resolve a dispute.
• Records of agreement: for as long as your account exists, and afterwards only as long as needed to resolve a dispute.

Who processes your data on our behalf

We keep our vendors to a minimum. Your data is hosted on Amazon Web Services (AWS) in the United States, which stores and processes it strictly on our instructions as a data processor (compute, database, media storage, and transactional email delivery). If you email contact@solous.net, your message is delivered to our mailbox hosted by Google (Gmail), so Google also handles it, under its own privacy terms. Please don't email us anything you wouldn't want to leave the Service. Cloudflare's bot check is described above. We have no advertising or data-sharing partnerships of any kind, and we do not sell or rent your data.

We disclose data to authorities only when compelled by valid legal process, and only the minimum required. For end-to-end-encrypted content, what we can produce is ciphertext we cannot decrypt.

International data transfers

If you use Solous from outside the United States (including the EU/UK), your data is transferred to and processed in the US. Where required, such transfers rely on appropriate safeguards such as the Standard Contractual Clauses offered by our service providers.

Your rights

Depending on where you live (including under the GDPR and the California CCPA/CPRA), you have some or all of these rights:

• Access / know — get a copy of the personal data we hold. You can also export your complete journal at any time from the Export page.
• Rectification / correction — fix inaccurate data (you can edit your content directly).
• Erasure / deletion — delete your whole account at any time from Settings (erased after a 30-day grace period, or at once if you ask), or ask us to permanently erase specific content (see "How long we keep it").
• Restriction and objection — ask us to limit or stop certain processing.
• Portability — receive your data in a portable, machine-readable format (that's exactly what the export is).
• Withdraw consent — where processing relies on consent.
• Non-discrimination — we will never penalize you for exercising these rights.

Washington residents and health data: see our Consumer Health Data Policy for your rights under the My Health My Data Act, including how to appeal a decision.

California residents: we do not sell or share your personal information (as those terms are defined by the CCPA/CPRA), and we do not use it for cross-context behavioral advertising.

To exercise any right, email contact@solous.net. If you are in the EU/UK and believe we have mishandled your data, you also have the right to lodge a complaint with your local data-protection supervisory authority.

Children

Solous is not directed to children. You must be at least 16 years old (or the minimum age of digital consent in your country, if higher) to create an account. We do not knowingly collect data from children under that age; if you believe a child has signed up, contact us and we will delete the account.

Data breaches

If a personal-data breach occurs that is likely to put your rights at risk, we will notify affected users and, where legally required, the relevant supervisory authority without undue delay. Content in end-to-end-encrypted accounts is stored only as ciphertext whose keys we do not hold.

Changes to this policy

We may update this policy; the "Last updated" date above always reflects the current version. For material changes we will ask you to agree again in the Service before you continue; until you do, you can still read, export, and delete your journal.

Contact

Privacy questions or requests: contact@solous.net. See also our Terms of Service.