Skip to main content
Onwards Upwards

Your Privacy Choices

This page summarises the privacy rights available to you and how to exercise them. It applies to all users, with specific California (CCPA/CPRA) callouts noted below. For the full legal basis, see our Privacy Policy.

Do Not Sell or Share My Personal Information

We do not sell your personal information for money, and we do not share it for cross-context behavioural advertising. There is nothing to opt out of because the practice does not exist at Onwards Upwards. If this ever changes, we will update this page and provide a working opt-out before any such processing begins.

Limit the Use of My Sensitive Personal Information

Mental-health information is "sensitive personal information" under CPRA. We only use sensitive PI for the limited purposes of providing, securing, and improving the core journaling service — we do not use it to infer characteristics about you for any other purpose, and we never disclose it to third parties for their own use.

You can additionally turn off automated Insights aggregation at any time: Settings → Insights. With Insights off, your entries are never read for pattern detection.

Access, correct, port, and delete

  • Access & portability: Settings → Export downloads a JSON copy of your profile, entries, and consent records.
  • Correction: edit your profile and any entry directly in the app.
  • Deletion: Settings → Delete account permanently removes your profile and all entries.

Cookies & tracking

Non-essential cookies are off until you accept them. You can change your choice at any time:

Authorised agents & verification

California residents may use an authorised agent to submit requests. We will verify the agent's written permission and your identity (typically via the email associated with your account) before acting. We will not discriminate against you for exercising any privacy right.

Contact

Submit a privacy request or appeal a decision: privacy@onwardsupwards.app. We respond within 45 days (CCPA) or 1 month (GDPR), with one allowed extension where the request is complex.