Privacy policy
Last updated: October 1, 2026
Reflet is a mood-tracking app. This policy explains what data we collect, why, who it is shared with, and how you can access or delete it.
Data we collect
| Data | Purpose | Legal basis |
|---|---|---|
| Email address, account identifier | Create and secure your account | Performance of the contract |
| Mood entries, emotions, tracked criteria, notes | Running the service (history, correlations, reports, video recaps) | Explicit consent, given when you create your account |
| First name (optional), declared sex (optional) | Greeting you in the app; offering the "Period" criterion to the people it concerns. Both questions can be skipped, and the answers changed or cleared at any time from your profile. | Consent |
| Notification token, reminder preferences | Sending you the reminders and alerts you chose | Consent (notification permission) |
| Purchase / subscription history (via RevenueCat) | Manage your subscription and access to paid features | Performance of the contract |
| Crash and performance data (Sentry) | Diagnose and fix bugs | Legitimate interest |
| Usage data (PostHog), including your answer to "How did you find Reflet?" | Understand feature usage and improve the product | Legitimate interest |
| Completed sign-up, subscription start (Meta, TikTok) | Measure how well our advertising campaigns perform | Legitimate interest |
Health data
Your mood entries, your emotions and, if you turn it on, your cycle tracking are health data. We only process them with your explicit consent, collected when you create your account, and solely to run Reflet. They are never used for advertising, nor shared with Meta or TikTok. You can withdraw this consent at any time by deleting your account.
Analytics and advertising
Usage data sent to PostHog is tied to your account's technical identifier, never to your email address or first name, and is hosted in the European Union. It contains neither your mood entries nor your notes; only a criterion name may appear, when you share a correlation or change the criterion shown in a trend.
To measure how well our ads perform, the app tells Meta (Facebook, Instagram) and TikTok when you complete sign-up and when a subscription starts (amount and currency). Meta's kit also logs app installs and launches. These services receive your device's technical information (model, OS version, IP address), but never your mood entries, criteria, notes, email address or first name. Reflet does not ask for iOS tracking permission, so these services cannot access your iPhone's advertising identifier. You can object to this measurement by writing to us.
Reflet never sells any of your data.
Processors and partners
- Supabase — database and authentication
- RevenueCat — in-app subscription management
- Sentry — application error tracking
- PostHog — product analytics, hosted in the European Union
- Expo — push notification delivery
- Apple — Sign in with Apple, where applicable, and notification delivery on iPhone
- Google (Firebase Cloud Messaging) — notification delivery on Android
- Meta and TikTok — measuring our advertising campaigns
Supabase, RevenueCat, Sentry, PostHog, Expo, Apple and Google process data on our behalf, strictly within the purposes set out above. Meta and TikTok only receive the events described above, which they also process under their own privacy policies.
Retention
Your data is kept for as long as your account is active. When you delete your account, your data is erased from our database immediately, and your profile is deleted at RevenueCat and PostHog. Any backup copies are gone within 30 days at most, unless a longer retention period is legally required.
Your rights
Under the GDPR, you have the right to access, rectify, erase, port and object to the processing of your data. You can exercise these rights directly in the app, under Profile → Data: "Export my data" produces a JSON file with all of your data, and "Delete my account" permanently deletes your account. You can also write to contact@getreflet.app.
You can withdraw your consent at any time: clear your first name or declared sex from your profile, turn off notifications, or delete your account for your mood data. You may also lodge a complaint with your local data protection authority — in France, the CNIL (cnil.fr).
Account deletion
You can delete your account and all your data directly from the app, or via our account deletion page.
Security
Data is encrypted in transit (TLS) and at rest. Access to production data is restricted and logged.
Contact
For any question about this policy: contact@getreflet.app