Candela

Privacy Policy

A diary holds the things you would not say out loud. This page says exactly what happens to them — in plain words, not in legal fog.

Last updated 9 September 2026 · applies to Candela up to version 1.2 on Android and version 1.1 on iOS

Who is responsible

MOBILUCK publishes Candela. Because the app sends us nothing, there is in practice no personal data of yours for us to hold, use or lose. Where this page uses the language of the GDPR, it does so about the app's behaviour — not to claim we are processing something behind your back.

Privacy and data-rights requests	congvt@mobiluck.vn
General support	mobiluckvn@gmail.com

The short version

• There is no account. No sign-up, no name, no email, no password, and no identifier we generate for you. You open the app and write.
• We operate no server that touches your journal. There is no database of ours holding entries, photos or recordings.
• Nothing you write is reported to anyone. No entry text, no titles, no photos, no recordings, no transcripts, no mood — none of it is sent to us or to anyone else. That has not changed and will not.
• Advertising, from version 1.2 on Android, in one place only. A short rewarded advert you choose to watch, offered only on the page where writing stops after the trial — never while you write or read, never for anyone who has bought the app, and never during the first 14 days. Every request is non-personalised, in every country. Details under Advertising.
• The app counts a few things about itself, and they stay on your phone. Version 1.1 keeps a small local tally — how many pages you have written, how long a session lasted, whether you reached the purchase screen. It never contains a word you wrote, it never leaves the device, and erasing your data erases it too. See What the app counts.
• No AI. Nothing you write is sent anywhere to be analysed, summarised or replied to. There is no chatbot and no companion feature.
• iCloud is optional and off by default — and it is iOS only. Turn it on and a copy goes into your own iCloud storage, under your Apple Account. Apple keeps it; we cannot read it. On Android there is no cloud storage of any kind.
• You can export everything, or erase everything, from inside the app — without asking us, because there is nobody to ask.

What the app stores, and where

This table describes the iOS app. The Android app stores the same things, in the same shape, but on the phone only — see On Android.

What	Where it lives
What you write — entry text, page titles, photos, handwriting, attached files, voice recordings and their transcripts, an optional mood for the day, and the plans you put on the calendar	On your iPhone, inside the app's own storage, which iOS protects with the device passcode. Plus your own iCloud, if you switch that on.
Your PIN, if you set one	Only a salted hash of it, in the iPhone's Keychain, marked so that it never syncs to iCloud and never leaves the device. The PIN itself is not stored anywhere, by anyone. That is why nobody — including us — can unlock a journal for you.
The key to an encrypted backup, if you made one without a PIN	32 random bytes in the iPhone's Keychain. Unlike the PIN hash, this one is marked to travel through your iCloud Keychain, so the backup still opens on your next phone. Apple carries it; we never see it. See Encrypted backup below.
Your settings — language, reminder time, calendar system, which lock you chose, whether iCloud is on	On your iPhone.

Because none of this reaches us, the lawful basis that matters is the one for the app doing what you asked it to do — Art. 6(1)(b) GDPR, performing the contract you entered into by using it. A diary can reveal things about your health, so the app treats it as special category data under Art. 9 throughout: hence the PIN, the device-level file protection, and the encryption on backups.

iCloud — iOS only

In Settings → iCloud you can turn on Keep a copy in my iCloud. It is off until you do.

With it on, your journal is written to the private database of your own iCloud account — the same storage your photos and device backups use. Apple is the provider. Data in a private database is available to your Apple Account and not to the app's developer: we have no dashboard, no key and no route to it. It counts against your iCloud storage, not ours.

Everything goes up, including voice recordings. Pages, plans, photos, handwriting, files and audio. We say this plainly because an earlier version of the app promised the opposite, and because it is the honest trade: without it, your recordings exist on exactly one phone and are gone with it.

Where Apple physically stores iCloud data, and for how long after you remove it, is Apple's to describe — see Apple's Privacy Policy. We deliberately do not claim a region here; the previous version of this page named one, and we will not repeat a promise we are not the ones keeping.

Turning the switch off stops any further syncing. It does not delete what is already there — there is a separate Remove the copy from iCloud action for that, and it leaves the journal on your phone untouched.

How the journal is locked — iOS

You choose, and you can change your mind later in Settings → PIN & lock:

• A six-digit PIN. Face ID can open it for you, with the PIN as the fallback.
• Face ID or your iPhone's passcode, with no PIN at all — nothing extra to remember. The lock is the one your phone already has.
• No lock. Then anyone holding your unlocked phone can read the journal, and the app says so where you make that choice.

With no lock in place, deleting a page or erasing everything asks for Face ID or your phone's passcode first. That is a last fence, not a lock, and the app describes it that way. There is no way for an app to make you sign in to iCloud again, so this — the lock your phone already trusts — is the strongest proof of "same owner" that iOS offers.

Encrypted backup — iOS

Settings → Privacy & data → Encrypted backup writes one file containing your whole journal, encrypted with AES-256-GCM. You choose where the file goes; the app does not send it anywhere. What unlocks the file depends on how your journal is locked, and the file records which of the two it was:

If you have	The file is locked with
A PIN	A key derived from that PIN (600,000 PBKDF2-SHA256 rounds). The file opens anywhere, on any phone, with something you remember.
No PIN	32 random bytes kept in your Keychain and unlocked with Face ID. Because that key travels through your iCloud Keychain, the file opens on this phone and on any phone signed in to the same iCloud Keychain — and nowhere else. There is nothing to type if you lose both.

What leaves your phone, ever — iOS

• To your iCloud — only if you switched it on. Described above.
• To Apple, when you buy — the purchase is handled entirely by the App Store. We receive no card details, no name and no address; we see only anonymous sales reports from Apple. Whether you have paid is checked on your device against your Apple Account.
• To your iCloud Keychain — the 32-byte key for an encrypted backup, and only if you made one without having a PIN. Never the journal itself, and never anything readable. Apple carries it between your own devices; we have no access to it.
• Anonymous usage counts — only if you switch them on. From version 1.2 on Android, Candela can send counts of what happened: a screen was opened, a page was saved, a purchase succeeded. Never a word you write, never a title, a file name, a transcript or a mood. It is off unless you turn it on, it is asked for separately from everything else, and you can turn it off again at any time in Settings. See Measurement.
• Nothing else. No error logs beyond the above, no fonts or scripts fetched at runtime.

iOS may ask you separately whether to share crash and usage data with Apple. That is a setting of the operating system, in Settings → Privacy & Security → Analytics & Improvements. It is Apple's, not ours, and we receive nothing from it that identifies you.

Permissions the app asks for — iOS

iOS asks you before granting any of these, and Candela works without every one of them — it just loses that one way of putting something on a page. You can change your mind at any time in iOS Settings → Candela.

Permission	Asked when	What it is for
Camera	The first time you tap Camera in the writing bar	Taking a photo straight into a page. The photo is shrunk and stored with the page, exactly like one picked from your library. Nothing is uploaded to us, and the camera is never opened by itself.
Photos	Never, in practice	Photos are chosen through the system picker, which runs outside the app — so Candela receives only the pictures you pick and cannot see the rest of your library.
Microphone	The first time you record a voice note or dictate	Recording voice notes, and speaking instead of typing.
Speech Recognition	The first time you dictate or record	Turning speech into text on the device — see below.
Face ID	The first time you unlock with it, or confirm a deletion	Opening your journal, resetting a forgotten PIN, opening a backup locked without a PIN, and confirming it is you before anything is erased. iOS answers yes or no; the app never receives your face or fingerprint data.

Speech and dictation — iOS

When you dictate, iOS turns speech into text on the device. The app requires the on-device recogniser and does not fall back to a network one, which is why it asks you to download the offline language model if it is missing. Your voice is not sent to a server for transcription, ours or anyone's.

On Android

The Android app is the same journal, and the promise at the top holds there too. Four things work differently, and one of them is a real trade-off rather than a detail.

There is no cloud copy, at all

Android has no equivalent of the iCloud switch, and we did not build one. iCloud works on iPhone because it is storage you already have, under an account you already signed in to. The nearest thing on Android would mean asking you to sign in to something and hand an app permission to your Drive — a new account, a new place your journal lives, and a new thing that can go wrong.

So on Android your journal exists on that one phone. Nothing syncs anywhere. The only way a copy leaves the device is the encrypted .candela file you create yourself, in Settings → Privacy & data, and you choose where it goes. It is the same file format as on iOS, so a journal moves between an iPhone and an Android phone in either direction.

Two consequences worth saying out loud, because you cannot undo either of them:

• Losing the phone loses the journal unless you have exported a file.
• Uninstalling the app deletes it. Candela switches off Android's automatic backup (allowBackup="false"), so the journal is deliberately kept out of Google's cloud backup and out of the phone-to-phone transfer that runs when you set up a new device. That is the price of the paragraph above: we would rather your diary not be copied into a Google backup you forgot was on.

The app can reach the network, and does so for one thing

The Android app holds the INTERNET permission. It is there because Google Play Billing declares it: the moment an app can be bought, that permission comes with the purchase library, whether or not the app itself ever opens a connection. Candela's own code opens none — there is no HTTP client in it of any kind.

So the permission list is not evidence that your writing travels. What travels is what Google Play needs to sell you the app and to answer, on the next launch, "has this account already paid?" Google handles that; the transaction never passes through us and it never contains a word of your journal. We see only anonymous sales reports, the same as on the App Store. Google's own handling of it is described in the Google Privacy Policy.

Two other things use the network in version 1.2, and nothing else does. A rewarded advert, if you choose to watch one — see Advertising. And anonymous usage counts, only if you switched them on — see Measurement. There is still no remote config, no fonts or images fetched at runtime, and the app deliberately blocks plain HTTP for anything it might ever do.

Permissions

Android asks you before granting any of these, at the moment the feature needs it — not at install, and not during onboarding. The app works without every one of them; it just loses that way of putting something on a page.

Permission	Asked when	What it is for
Microphone (RECORD_AUDIO)	The first time you record a voice note or dictate	Recording voice notes, and speaking instead of typing. The recording is written straight into the app's own storage.
Notifications (POST_NOTIFICATIONS)	The moment you switch the writing reminder on	The one reminder you set. The text is fixed and generic — it never contains a word you wrote, or anything about how you have been feeling, because it may appear on a lock screen in a room full of people.
Fingerprint / face unlock (USE_BIOMETRIC)	The first time you unlock with it, or confirm a deletion	Opening your journal and confirming it is you before anything is erased. Android answers yes or no; the app never receives your fingerprint or face data.
Start at boot (RECEIVE_BOOT_COMPLETED)	Not asked — granted at install, if you set a reminder	Android clears every scheduled alarm when the phone restarts. Without this the reminder would quietly stop and you would think the feature was broken.
Network (INTERNET, ACCESS_NETWORK_STATE, BILLING)	Not asked — declared by Google Play Billing	Buying the app, and checking on launch whether this account has paid. See above.

There is no camera permission and no storage permission, and both features still work. Taking a photo hands the job to your camera app; picking a photo or a file goes through the system picker, which runs outside Candela — so the app receives only the one item you chose and can never see the rest of your gallery or your files.

Lock, backup and speech

• The lock is a six-digit PIN, which fingerprint or face unlock can open for you. Only a salted hash of the PIN is stored, wrapped again with a key held in the Android Keystore. The count of failed attempts is kept on disk on purpose: swiping the app away must not clear the waiting period.
• An encrypted backup always needs a PIN you type (AES-256-GCM, key derived with 600,000 rounds of PBKDF2-SHA256). Unlike iOS there is no device-key variant, so an Android backup opens anywhere with something you remember — and a backup an iPhone locked with Face ID and no PIN cannot be opened here at all. The app says so, in those words, instead of reporting a wrong PIN.
• Dictation runs on the device only. Candela uses Android's on-device recogniser and has no fallback to a network one — if the phone cannot do it offline in your language, the app tells you that rather than sending your voice somewhere. Your recordings and their transcripts stay on the phone; on Android there is no cloud for them to go to.

Your rights, on Android

Everything in Your rights below applies unchanged. Export and delete both live in Settings → Privacy & data, both are free, and neither involves us. Deleting everything clears the journal, the attachments, the recordings and the PIN from the phone — and because there is no copy anywhere else, that is the end of it.

How long it is kept

• Your journal: until you delete it. Nothing expires, nothing is archived.
• A deleted page: removed immediately from the phone — text and every attachment — and, if iCloud is on, removed from there too.
• Delete everything: clears the journal, the attachments, the recordings and the PIN from the phone, and the copy in your iCloud if you have one. There is no recovery period, because there is no copy of ours to recover from.
• Deleting the app removes the journal on that phone. On iOS a copy in your iCloud stays until you remove it; on Android there is no copy anywhere, so uninstalling is the end of it.

What the app counts, and where that stays

From version 1.1 Candela keeps a small tally about itself, so we can tell whether the app is any good: how many pages have been written on this phone, roughly how long a session lasted, whether the purchase screen was reached and what led there, whether a backup succeeded. It is counting and labels — never a word you wrote, never a title, never a file name, never which mood you picked on which day.

It stays on the phone. It is written to a small file inside the app's own storage, capped at half a megabyte and overwritten as it fills. There is no server of ours to send it to. It is excluded from iCloud Backup on iOS, and on Android it is covered by the same rule that keeps the journal out of Google's backup. Erasing your data from inside the app erases the tally too, and the random identifier it uses is thrown away and replaced.

Version 1.2 on Android can send some of it — but only if you say yes. That is the promise above being kept, not broken: the app asks in a question of its own, separate from the terms and from everything else, and the answer starts as no. Say yes and Candela sends counts of what happened — a screen was opened, a page was saved, a purchase succeeded — to Google Analytics for Firebase, along with crash reports if the app falls over. Say no, or never answer, and the collection libraries are switched off at the SDK level and send nothing at all.

What it never sends, whatever you answer: a word you wrote, a title, a file name, a mood, a photo, a recording, your email or any identifier that names you. You can change your mind at any time in Settings, and turning it off both stops the sending and clears what was gathered.

Advertising

Android version 1.2 shows one kind of advertisement. The iOS version shows none. Everything we promised before turning it on is what we built, and it is listed below.

The advertisement is a rewarded one: a short video you choose to watch, in exchange for being able to keep writing. Nothing arrives uninvited, nothing covers a page, and there is no banner anywhere in the app.

These are the rules, and they are enforced in the code, not by policy:

• An advertisement appears only after your 14 free days have ended and only if you have not bought the app. Never during the trial. Never for someone who has paid — buying removes advertising entirely, and there is no separate "remove ads" purchase because it is the same thing.
• It appears in one place only — the screen you reach when writing stops — and only as a button you choose to press. Nothing full-screen arrives uninvited, and nothing is ever placed over a page you are reading or writing.
• Advertisements are non-personalised everywhere in the world, not only where the law demands it. No profile of you is built, and the request carries nothing from your journal, no age, no gender and no location.
• In the EEA, the UK and Switzerland you are asked first, through Google's consent form, with "Do not consent" offered as plainly as "Consent". Saying no simply means no advertisement.
• What one view buys you depends on where you are. In most countries a view unlocks the rest of that day, once per day. In lower-income countries, where far fewer people can buy the app at all, there is no wall at all: when you start a new page you are simply offered one short ad in exchange for that page, as often as you like, with no daily limit. The same app, a different way to reach it.

Google's own handling of advertising data is described in the Google Privacy Policy.

Your rights

Under the GDPR you can do all of the following. Most of them do not involve us at all, which is the point.

Right	How
Access and portability (Art. 15, 20)	In the app: Settings → Privacy & data → Export entire journal. A plain, readable file you can keep or move elsewhere. Free, whether or not you have paid.
Erasure (Art. 17)	In the app: Settings → Privacy & data → Delete everything. See the deletion page. Free, and free forever.
Rectification (Art. 16)	Edit any page in the app at any time — including after the trial ends.
Objection (Art. 21) and restriction (Art. 18)	There is no processing by us to object to. If you believe otherwise, write to congvt@mobiluck.vn.
Complaint (Art. 77)	You may complain to the data protection authority in your country. You do not have to contact us first.

Write to congvt@mobiluck.vn for anything the app cannot do for you. We answer within 30 days. Be aware that we cannot retrieve, unlock or restore a journal — not as a policy, but because we never had it.

Age

Candela is for people aged 16 and over. The app asks you to confirm this when you first open it. We hold no data from anyone, of any age.

Automated decisions

None. Candela does not profile you, score you, or make any automated decision about you.

Changes to this policy

If a future version changes what happens to your data, this page will be updated in the same release that changes it, never after. Material changes will also be shown to you inside the app.