Plimm Get Plimm

Privacy Policy

Effective October 14, 2026

Plimm is operated by Dias Jakupov ("we", "us"). This policy explains what Plimm stores, what Plimm sends from your device, and what we never collect.

The short version

Your entries are never sent to Plimm or any AI service. Plimm has no accounts and no server that stores your writing. We cannot read your entries.

What Plimm stores on your device

Everything here except your voice recordings is kept in a database that Plimm encrypts itself, with SQLCipher, under a key made on your device the first time Plimm opens. On Android the key is sealed by the Android Keystore and never leaves the phone. On iPhone it is kept in the Keychain and moves with your own iCloud or encrypted computer backup, so a restored iPhone can still open your journal. The operating system encrypts this data as well: Android's file-based encryption, or iOS Data Protection. A journal from an earlier version is encrypted on the first launch after the update; if that cannot finish, Plimm opens it as before and tries again on a later launch. On iPhone, when iCloud Backup is on, iOS includes this data, but not your voice recordings, in your own iCloud backup, which Plimm never receives; that backup keeps its copy until a later backup replaces it, even after you delete data in the app. The AI models run entirely on your device. Your writing is never sent anywhere to be processed.

Voice journaling

When you record a voice entry, Plimm asks for microphone access and captures audio only while you are recording. The recording is transcribed on your device by a speech model that Plimm downloads during setup. Neither the audio nor the transcript is sent to Plimm or any AI service — there is no server involved in turning your voice into text.

Recordings are kept by default so you can play back what you said, and you can turn that off or delete every recording in Settings → Recordings. Deleting an entry deletes its recordings with it, and Delete All Data removes all of them.

One honest point is worth making: your transcripts are in Plimm's encrypted database, but your recordings, which are audio files in Plimm's private storage, are protected by your device rather than by the app. On Android that is file-based encryption, on iOS it is Data Protection. Both keep the files unreadable to other apps and to anyone without your device passcode — but the protection comes from the operating system, not from Plimm's own encryption. If you would rather no audio existed at all, turn recordings off and only the transcript is kept.

What Plimm sends from your device

Six things, and only these:

  1. Usage events. We use PostHog to learn which features are used — for example, that an entry was saved, that the settings screen was opened, or that crisis support resources were shown (see Crisis detection below). Each event carries the event name, coarse details such as the Plimm Pro package or a message count, your device model, operating system version, app version, and a random identifier — never your writing, your name, or your email. We do not collect your name or email at all. PostHog's servers, like any web service, receive your IP address when events are delivered. You can turn usage analytics off at any time in Settings. See the PostHog Privacy Policy.
  2. Basic app-lifecycle events. The Google Firebase SDK automatically reports coarse app-lifecycle events such as first open and session starts, along with device model and operating system version. See the Google Privacy Policy.
  3. Crash reports. If the app crashes, Google Firebase Crashlytics sends a technical report: device model, operating system version, and what the code was doing when it failed. Crash reports never include journal content.
  4. A settings check. When the app starts, at most once an hour, it asks Google Firebase Remote Config whether settings such as the free-tier limits have changed. The request carries a random app-installation identifier, the app's name and version, the operating system version, your device's language, region and time-zone settings, and when the app was first opened. It never includes anything you wrote. See the Google Privacy Policy.
  5. Purchase information. Purchases are processed by Apple or Google and verified by RevenueCat. RevenueCat receives your purchase receipt and a random identifier — not your name, and nothing from your journal. See the RevenueCat Privacy Policy.
  6. The AI model download. During setup, and again only if you choose to install an update, Plimm downloads its AI models (about 437 MB in total at the moment — one for reflection, one for turning speech into text) from Hugging Face's servers or from Google Cloud Storage. As with any download, those servers see your device's IP address. Nothing about you or your journal is sent with the request. See the Hugging Face Privacy Policy and the Google Privacy Policy.

What we never collect

Crisis detection

Plimm looks for signs of crisis in what you write so it can show support resources. The detection itself happens entirely on your device, and what you write is never sent to Plimm or any AI service. If support resources are shown, Plimm sends a usage event to PostHog recording that they appeared and the severity level that triggered them — never your words, and never why. This event carries the same random identifier as other usage events and is not sent if you turn usage analytics off in Settings.

Plimm picks which crisis lines to show from your phone's settings, on the device: on Android, the country of the mobile network, then of the SIM card, then the phone's region setting; on iPhone, the Region setting. Plimm does not send that country anywhere or add it to any usage event, including the one recorded when resources are shown (analytics services may still infer an approximate region from your IP address, as described above). If you are in a country Plimm does not list, it shows how to reach your local emergency number and links to findahelpline.com.

Deleting your data

In the app, Settings → Delete All Data erases everything Plimm has stored. This is immediate and permanent. Uninstalling the app also removes all of its data. Plimm has no server copy of your journal to delete, because your journal is never sent to us. Usage events already sent to PostHog are tied only to a random identifier, not to your name or email. For questions about those events, or about purchase records held by Apple, Google, or RevenueCat, contact us at diasjakupov04@gmail.com.

Children

Plimm is intended for adults. You must be 18 or older to use it, and we do not knowingly collect any information from children.

Where Plimm is offered

Plimm is offered worldwide on the App Store and Google Play, in English. The practices in this policy apply wherever you use the app.

If you are in the UK, the EEA or Switzerland

Data protection law there asks us to spell out a few more things.

Who is responsible. The controller of the personal data described in this policy is Dias Jakupov, who operates Plimm. You can reach him at diasjakupov04@gmail.com. Your journal is not part of this: it is never sent to us.

Why Plimm sends each thing from your device.

Your right to object. Where we rely on legitimate interests, you can object at any time. The quickest way is in the app: Settings → Privacy → Share anonymous usage data. Turning it off stops usage events to PostHog, including the one sent when crisis resources are shown. It does not stop the Firebase app-lifecycle events, crash reports or the settings check, which the app has no switch for. To object to those, write to us.

Your other rights. You have the right to access, correct, erase and restrict the processing of your personal data, to object to it, and to take it with you. Most of what Plimm holds is already in your hands: you can edit or delete any entry, Settings → Export entries gives you a copy of your journal, and Settings → Delete All Data erases it. For anything held by the services listed above, write to us. Usage events are tied only to a random identifier, so we may not be able to find the ones that came from your phone.

Complaints. You can complain to a data protection authority: in the UK, the Information Commissioner's Office; in Ireland, the Data Protection Commission; or the authority where you live. We would like the chance to put things right first, but you do not have to ask us before you complain.

Transfers outside your country. PostHog (we use its US Cloud), Google Firebase and RevenueCat process this data in the United States. They rely on safeguards such as the EU–US Data Privacy Framework (and its UK extension) or Standard Contractual Clauses, which they offer to the apps that use them.

Your privacy rights elsewhere

Wherever you live, including under India's Digital Personal Data Protection Act, Canada's PIPEDA, the Australian and New Zealand Privacy Acts, Singapore's PDPA and South Africa's POPIA, you can ask what we hold about you and ask us to correct or delete it. Write to diasjakupov04@gmail.com. One honest limit: usage events are tied only to a random identifier, not to your name or email, so we may not be able to find yours. Turning off Settings → Privacy → Share anonymous usage data stops new ones from being sent.

Changes to this policy

If this policy changes, we will post the new version here and update the effective date. For material changes, we will also say so in the app.

Contact

diasjakupov04@gmail.com