Privacy Policy

Last Updated: October 12, 2026

Griffin Labs LLC (operating as Patternwise) is committed to being transparent about how we collect, use, and protect your information. This Privacy Policy explains our data practices for Patternwise, an AI-powered journaling application available at patternwise.app and through mobile apps on iOS and Android.

Please read this policy carefully. By using Patternwise, you agree to the practices described here. If you do not agree, do not use the service.

What Information We Collect
How We Process Your Information
Legal Bases for Processing
Third-Party AI Processing
Voice Transcription
Pinecone Vector Database
Upstash Temporary Cache
When and With Whom We Share Your Information
Biometric Authentication
Cookies and Tracking Technologies
Social Logins
How Long We Keep Your Information
How We Keep Your Information Safe
Information from Minors
Your Privacy Rights
Do-Not-Track Features
United States Residents — Specific Privacy Rights
International Data Transfers
Employee and Contractor Access
Security Incident Notification
Updates to This Policy
Contact Us
Review, Update, or Delete Your Data

What Information We Collect {#what-we-collect}

Information you provide directly

When you create an account and use Patternwise, we collect:

Email address and display name (account creation)
Journal entries, chat messages, AI conversation history, reflections, and related content you create
Voice recordings, when you choose to create entries by speaking — processed into text and not retained by Patternwise (see Voice Transcription)
Information about people, events, patterns, and parts you add within the app
Profile information you voluntarily provide
Payment information (processed by Stripe — we receive billing metadata, not raw card numbers)
Communications you send to our support team

How journal content is stored

Journal entries, chat messages, AI analysis outputs, and related structured content (persons, events, patterns, parts) are stored on Google Cloud and encrypted at rest with AES-256. All network traffic is encrypted in transit with TLS.

Information collected automatically

When you use Patternwise, we automatically collect:

Device identifiers, operating system, and app version
IP address and approximate location (country/region)
Session activity, feature usage, and error logs
Firebase Authentication session tokens

We use Firebase Performance Monitoring and Firebase Analytics (Google services) to collect aggregate performance and product-analytics telemetry on our web application — for example, page-load and network-request timing and feature-usage events. These are first-party services used only to operate and improve Patternwise; they are not linked to a Google Analytics 4 advertising property and are not used for advertising. In the US this telemetry is active by default with a notice and an opt-out; we honor Global Privacy Control. For full details on the technologies we use and how to control them, see our Cookie Policy.

Google API user data

If you sign in with Google, we receive your Google account email address and profile information as authorized by you during the OAuth flow. We use this solely for authentication and account management. We do not access your Google Drive, Gmail, or other Google services.

How We Process Your Information {#how-we-process}

We process your information to:

Create and maintain your account
Deliver the core journaling experience, including storing and displaying your entries
Generate AI-powered insights, reflections, pattern recognition, and analysis by transmitting your entry content to third-party AI providers (see Third-Party AI Processing)
Power search and contextual memory features using a vector database (see Pinecone Vector Database)
Process subscription payments through Stripe
Send transactional emails (account confirmation, receipts, password reset) via Resend
Respond to support requests
Detect and prevent abuse, fraud, and violations of our Terms of Service
Comply with legal obligations
Improve and develop the service

The third-party AI providers do not use your journal content to train their models. We do not sell your personal information. We do not serve targeted advertising. (Separately, you may optionally opt in to let anonymized copies of your entries help improve our own models — see Research participation below; this is off by default.)

Legal Bases for Processing {#legal-bases}

For users in jurisdictions that require a legal basis for data processing (including the European Economic Area, United Kingdom, and Canada), we rely on the following bases:

Contract performance: Processing your account data, journal content, and payment information is necessary to provide the service you have contracted for.
Legitimate interests: Fraud detection, abuse prevention, service security, and aggregate analytics are carried out where our interests do not override your rights.
Legal obligation: Compliance with applicable law, including responding to valid legal process.
Consent: Where required by law, we obtain your explicit consent before processing — for example, for optional research participation or AI feature enablement. You may withdraw consent at any time through app Settings.

We use automated AI tools to analyze your journal entries and generate patterns, insights, and risk classifications. This automated processing is not used to make decisions that produce legal or similarly significant effects concerning you — its purpose is to present reflective content back to you within the app. You may contact us at privacy@patternwise.app to request human review of AI-generated content or to object to automated processing.

As part of this analysis, an automated safety classifier reviews your entries and chats for signs of distress or self-harm and assigns internal risk indicators. Where such signs are detected, Patternwise responds supportively — for example, gently checking in and surfacing crisis resources such as the 988 Suicide & Crisis Lifeline and the Crisis Text Line (text HOME to 741741). Patternwise is not a crisis, medical, or emergency service, and does not provide emergency intervention or contact emergency services on your behalf (see our Safety page). These internal risk indicators power and improve the safety response; they are not included in your self-service data export by default, but you may request them through an appropriate channel, and they are deleted when you delete your account.

Third-Party AI Processing {#ai-processing}

Patternwise transmits portions of your journal content to third-party AI services in two distinct ways, each with different scope and retention characteristics.

For insights, chat, and analysis (LLM processing): When you write or chat about an entry, your entry text and relevant context from your own history — including names of people you have mentioned — are transmitted to Anthropic (Claude) and Google (Gemini). Providers receive your content without your name, email address, or billing identifiers. Patternwise has executed Data Processing Agreements with both providers, under which your content is not used to train provider models. Providers may retain your content for a limited period — generally up to thirty (30) days — for trust-and-safety and abuse-monitoring purposes, after which it is deleted, unless retention is otherwise required by law.

For search and pattern recognition (embeddings): Patternwise transmits portions of your content to OpenAI to generate vector embeddings — numerical representations of meaning used to power search and similarity features. OpenAI does not use this content to train its models and does not retain it for long-term storage. OpenAI may retain submitted content for up to thirty (30) days for abuse-monitoring purposes, after which it is deleted, unless retention is otherwise required by law. The vectors generated from your content are stored in our Pinecone vector database (see the Pinecone Vector Database section below).

Patternwise does not control the retention or use of data once transmitted to AI providers beyond what our Data Processing Agreements and applicable terms require. The current, authoritative list of our sub-processors — including each provider's purpose, data categories, processing location, and transfer mechanism — is maintained on our Subprocessors page. For an overview of our security architecture, see our Trust Center. The table below mirrors that list for convenience.

Provider	Function	Privacy/DPA
Anthropic	AI Processing	https://www.anthropic.com/legal/privacy
Google (Vertex AI / Gemini)	AI Processing	https://cloud.google.com/terms/data-processing-addendum
OpenAI	AI Processing	https://openai.com/enterprise-privacy/
Deepgram	AI Processing	https://deepgram.com/privacy
Pinecone	Cloud Infrastructure	https://www.pinecone.io/privacy/
Upstash	Cloud Infrastructure	https://upstash.com/trust/privacy.pdf
Google (Firebase + Cloud)	Cloud Infrastructure	https://firebase.google.com/support/privacy
Cloudflare	Security & Network	https://www.cloudflare.com/privacypolicy/
Stripe	Billing & Payments	https://stripe.com/privacy
Resend	Communications	https://resend.com/legal/dpa
Apple App Store	Billing & Payments	https://www.apple.com/legal/privacy/
Google Play	Billing & Payments	https://policies.google.com/privacy

Sub-processor changes and your right to object

We maintain the current list of sub-processors on our Subprocessors page, with a dated change log. When we add or replace a sub-processor that processes your personal information, we will update that page and its change log. If you object to a new sub-processor on reasonable data-protection grounds, email privacy@patternwise.app within 30 days of the change-log date. We will work with you in good faith to address the concern; if we cannot, you may discontinue use of the affected features.

Research participation (optional)

Research participation is optional and off by default. If you opt in, Patternwise uses copies of your entries that are automatically anonymized before storage — by removing your account identifier and stripping personal identifiers (names, places, dates, organizations) — together with message-effectiveness and wellbeing signals, to study how supportive conversations work (which messages help, how conversations flow) and to improve our own models. The focus is the structure and effectiveness of messages, not profiles of individual users. Contributions are stored as a flat, account-less dataset with no mapping back to you, kept separate from your account with no path back to your identity. We do not share this dataset with third parties, and it is not included in submissions to the AI providers listed above (Anthropic, Google, OpenAI).

Because the dataset carries no identifier and no mapping to you, once a contribution is added we cannot locate, retrieve, or remove it individually, and we do not attempt to re-identify it. You can turn the option off at any time in Settings, which stops any future contributions. Research participation does not change how your entries are processed during normal AI interactions.

Voice Transcription {#voice-transcription}

Patternwise lets you create journal entries by speaking instead of typing. Audio you record is processed by speech-to-text providers solely to convert it into text. Patternwise does not store your raw audio, and your voice is processed for transcription only — never to identify you by your voice. We do not perform voiceprinting, voice recognition, or speaker identification.

Web and mobile streaming (Deepgram). When you use voice input, your audio is streamed over an encrypted (TLS) connection to Deepgram, our speech-to-text provider, which returns the transcribed text in real time. Patternwise does not retain the audio. The transcribed text is stored with the same protection applied to text you type. Patternwise has executed a Data Processing Agreement with Deepgram; under that agreement and our configuration, Deepgram does not retain your audio after transcription and does not use it to train its models.

Mobile batch transcription (Google Cloud Speech-to-Text). Where mobile voice entries are processed in batches, your audio is transmitted securely to Google Cloud Speech-to-Text for transcription under our existing Google Cloud Data Processing Agreement. The audio is used only to generate your transcript, is not retained for other purposes, and is not used to train models. The resulting text is stored with the same protection described above.

Voice input is optional. If you do not use voice features, no audio is collected.

Pinecone Vector Database {#pinecone}

To power search and contextual memory features, Patternwise stores vector embeddings of your journal content in a database operated by Pinecone. An embedding is a numerical representation of meaning (generated by OpenAI, as described above) — not the readable text of your entries. Alongside each vector we store a small set of non-identifying metadata used only for filtering — such as entry type, timestamps, category and risk-level labels, and internal record identifiers. We do not store the text of your journal entries in Pinecone. Vectors and their metadata are isolated to your account by a namespace tied to your user identifier, are not shared with other users, and are not used to train AI models.

Pinecone records are deleted when you delete the corresponding journal entry or when you delete your account. Pinecone operates as a data processor under our agreement with them and does not use your data for its own purposes.

Upstash Temporary Cache {#upstash}

To reduce latency in AI processing, Patternwise uses a temporary in-memory cache operated by Upstash. When you use AI features, relevant journal entry context may be temporarily held in this cache to serve your active request. Cached content is scoped to your account and is not accessible to other users. Content is retained only for the duration necessary to serve the request and is not persisted for long-term storage or used for any purpose other than delivering your session.

Upstash operates as a data processor under our Data Processing Agreement with them and does not use your data for its own purposes.

When and With Whom We Share Your Information {#sharing}

We share your information only in these circumstances:

With the AI and infrastructure sub-processors listed in the processor table above, to the extent necessary to provide the service
With Stripe, to process subscription payments
With Resend, to send transactional emails
With law enforcement, courts, or regulators when required by valid legal process, court order, or applicable law — we will notify you of such requests where legally permitted
With successors in the event of a merger, acquisition, or sale of assets, in which case the acquiring party will be bound by this policy or you will be notified of any material change
With your explicit consent for any other purpose

We do not sell your personal information. We do not share your journal content with advertisers or data brokers.

Biometric Authentication {#biometrics}

Patternwise supports biometric authentication (Face ID and Touch ID on iOS, BiometricPrompt on Android) to protect access to your account. Biometric processing is performed entirely on your device by Apple's LocalAuthentication framework or Android's BiometricPrompt API. Patternwise does not receive, store, or transmit your biometric data — we receive only a pass or fail result indicating whether authentication succeeded. You can disable biometric authentication at any time in the app settings or in your device's system settings.

Texas residents — Biometric Identifier Act

For Texas residents: Patternwise does not capture, store, or disclose biometric identifiers as defined under the Texas Capture or Use of Biometric Identifier Act (Tex. Bus. & Com. Code § 503.001). Biometric authentication is performed on-device by your operating system's secure enclave; Patternwise receives only an authentication result and never has access to underlying biometric data.

Cookies and Tracking Technologies {#cookies}

Patternwise uses strictly necessary cookies and browser storage to maintain your authenticated session and remember your preferences. We do not use cookies to serve advertising or track you across third-party websites.

For full details on the cookies we use, their purposes, and how to control them, see our Cookie Policy.

Social Logins {#social-logins}

Patternwise supports sign-in with Google and Apple. When you use a social login, the respective provider shares your account email and profile name with us, subject to the permissions you grant. We do not receive your social provider password. We do not access your social media posts, contacts, or other data beyond authentication credentials. If you disconnect your social login, you can set a password through account settings to retain access.

How Long We Keep Your Information {#retention}

Data category	Retention period
Account and profile data	Duration of active account
Journal entries, AI analysis, chat history	Duration of active account; deleted within 30 days of account deletion request
Pinecone vector embeddings + non-identifying metadata	Deleted when source entry or account is deleted
Upstash cache	Deleted at end of active AI processing session
Voice audio (Deepgram / Google Cloud Speech-to-Text)	Not retained by Patternwise; transcription providers process audio to text and do not store it afterward
Backups	Daily backups retained 7 days; weekly backups retained 30 days; point-in-time recovery 7 days. Deleted data is removed from backups within 30 days
Stripe billing records	7 years from transaction date (tax and legal compliance)
Support communications	3 years from last contact
Server and access logs	30 days rolling. Operational logs contain request metadata (not the contents of your journal entries or messages)
De-identified research data (opt-in only)	Indefinite — no longer linked to your account after de-identification; cannot be individually retrieved or removed

AI provider retention: per applicable DPAs, providers do not retain your content beyond the processing window except as required by their own compliance obligations or applicable law. Refer to each provider's privacy policy for specifics.

When you request account deletion, we initiate deletion of your encrypted journal content, Pinecone vectors, and account data within 30 days. Stripe billing records and legally mandated records are retained for the periods noted above. If you opted into research participation, any de-identified contributions already added to the research dataset are not included in this deletion — they are no longer linked to you and cannot be associated with your account, so they cannot be individually retrieved or removed.

How We Keep Your Information Safe {#security}

All data is encrypted in transit with TLS and at rest with AES-256 on Google Cloud. Production access is limited to the people and systems that run the service.

The vector embeddings and non-identifying metadata we store in our Pinecone vector database are namespace-isolated by user account. These vectors are numerical representations, not the readable text of your entries, and Pinecone does not hold your journal text. The Third-Party AI Processing and Pinecone Vector Database sections of this policy describe this in detail.

No security system is impenetrable. We implement technical and organizational measures appropriate to the risk — including access controls, audit logging, and key isolation — but we cannot guarantee that unauthorized access, disclosure, alteration, or destruction of your data will never occur.

For questions about our security practices or to report a vulnerability, contact security@patternwise.app.

Information from Minors {#minors}

Patternwise is intended solely for users who are 18 years of age or older. We do not knowingly collect personal information from anyone under 18. Age is verified at the point of purchase during checkout. If you believe we have inadvertently collected information from a minor, please contact privacy@patternwise.app and we will delete it promptly.

Your Privacy Rights {#privacy-rights}

Depending on your location, you may have the right to:

Access the personal information we hold about you
Correct inaccurate information
Request deletion of your personal information
Restrict or object to certain processing
Receive your data in a portable format
Withdraw consent where processing is based on consent
Lodge a complaint with your applicable data protection authority

To exercise any of these rights, contact us at privacy@patternwise.app. We will acknowledge receipt of your request within 10 business days and provide a substantive response within the timeframe required by applicable law (generally 30–45 days for the full response, with possible extensions of up to an additional 45 days for complex requests).

Account information

You can review and update your profile information within the app. You can delete your account and all associated data through Settings > Account > Delete Account, or by emailing privacy@patternwise.app.

Do-Not-Track Features {#dnt}

Most web browsers and some mobile operating systems include a Do-Not-Track ("DNT") feature you can activate to signal your preference against online behavioral tracking. Patternwise does not currently respond to DNT browser signals because no uniform industry standard for DNT recognition has been established. We will revisit this position if a standard is adopted.

United States Residents — Specific Privacy Rights {#us-rights}

Various US state privacy laws grant residents additional rights. This section applies to residents of California, Texas, Colorado, Connecticut, Virginia, and other states with enacted comprehensive privacy laws.

Categories of personal information we collect

Category	Examples	Collected
Identifiers	Email, display name, device ID, IP address	Yes
Personal information (Cal. Civ. Code § 1798.80)	Name, account credentials	Yes
Protected classifications	None actively collected	No
Commercial information	Subscription tier, billing history	Yes
Biometric information	Authentication result (pass/fail only — no biometric template stored)	Yes (result only)
Internet/electronic activity	Session data, feature usage, logs	Yes
Geolocation data	Country/region inferred from IP	Yes (approximate only)
Inferences	AI-generated patterns, reflections, and insights derived from journal content	Yes
Identifiable user-generated content	Encrypted journal entries, chats, AI analysis	Yes

Sources of personal information

We collect personal information directly from you (account creation, journal entries, payment), automatically from your device (session and usage data), and from authentication providers (Google, Apple) when you use social login.

How we use and share personal information

We use personal information to provide and improve the service, process payments, send transactional communications, and comply with legal obligations. We share it with the sub-processors listed in the Third-Party AI Processing section above. We do not sell personal information or share it for cross-context behavioral advertising.

Your rights under state law

Depending on your state of residence, you may have the right to know, access, correct, delete, and port your personal information, and to opt out of sale or sharing (we do not sell or share for advertising). To exercise rights, contact privacy@patternwise.app.

We will not discriminate against you for exercising your privacy rights.

How to exercise your rights

Submit a request to privacy@patternwise.app or through the in-app deletion flow. We will verify your identity before processing the request. We may ask for information sufficient to confirm you are the account holder.

Appeals

If we decline your request, you may appeal by emailing privacy@patternwise.app with "Privacy Rights Appeal" in the subject line. We will provide a written response. If your appeal is denied, you may contact your state attorney general.

California residents — Sensitive Personal Information {#sensitive-personal-information}

Journal content you create in Patternwise may constitute sensitive personal information under California law, including content reflecting your health, mental or physical condition, personal relationships, and the contents of your communications. Patternwise does not use sensitive personal information for purposes beyond providing the journaling service to you. We do not use sensitive personal information to infer characteristics about you for advertising, profiling, or sale. You have the right under Cal. Civ. Code § 1798.121 to direct us to limit our use and disclosure of sensitive personal information to service provision purposes; because we do not use it beyond those purposes, no additional action is required on your part, but you may contact us at privacy@patternwise.app to exercise this right in writing. Audio you submit for voice transcription is processed only to convert your speech to text; Patternwise does not extract voiceprints or use your voice to identify you, so this audio is not processed as a biometric identifier.

California "Shine the Light" law

California Civil Code § 1798.83 permits California residents to request a list of all third parties to whom we have disclosed personal information for direct marketing purposes during the preceding calendar year. Patternwise does not disclose personal information to third parties for direct marketing purposes.

Texas Data Privacy and Security Act (TDPSA)

Texas residents have the rights enumerated above under the Texas Data Privacy and Security Act. To exercise your rights or submit an appeal, use the contact information in the Contact Us section.

International Data Transfers {#international-transfers}

Patternwise is based in the United States. If you access our services from the European Economic Area, United Kingdom, Switzerland, or other jurisdictions with data transfer restrictions, your personal information may be transferred to and processed in the United States and other countries where our sub-processors operate.

Where such transfers occur, we rely on one or more of the following safeguards:

The EU-US Data Privacy Framework (and the UK Extension and Swiss-US framework) for sub-processors that are self-certified under it
Standard Contractual Clauses (SCCs) approved by the European Commission or applicable UK authority, incorporated into our agreements with sub-processors that are not DPF-certified
Your explicit consent where required

The transfer mechanism applicable to each sub-processor is noted on our Subprocessors page. As a summary: Google (all services), Stripe, Cloudflare, Resend, and Upstash self-certify under the EU-US Data Privacy Framework and also incorporate Standard Contractual Clauses. Anthropic, OpenAI, Pinecone, and Deepgram are not DPF-certified and rely on Standard Contractual Clauses (with the UK and Swiss addenda) incorporated into their data processing terms. If you are located in the European Economic Area or United Kingdom, your entry content may be transferred to and processed in the United States by the providers listed above.

If you have questions about the transfer safeguards applicable to your data, contact privacy@patternwise.app.

Employee and Contractor Access {#employee-access}

Patternwise employees and authorized contractors do not read your journal entries as part of normal operations. In limited cases — such as responding to a support request you initiate, investigating abuse, or complying with legal process — authorized staff may access content. Such access is logged and subject to internal access controls.

Security Incident Notification {#breach-notification}

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify affected users and applicable regulatory authorities within the timeframes required by law — including, where applicable, the 72-hour window under GDPR. Notification will be sent to the email address associated with your account.

Updates to This Policy {#updates}

We may update this Privacy Policy from time to time. For material changes — those that meaningfully affect your rights or our data practices — we will provide at least 30 days' advance notice by email to the address on file and by in-app notice. The updated "Last Updated" date at the top of this policy will reflect the effective date of any change. For non-material changes (corrections, clarifications, adding new sub-processors with equivalent safeguards), we will update the date without advance notice.

Continued use of Patternwise after the effective date of a material change constitutes your acceptance of the updated policy.

Contact Us {#contact}

Griffin Labs LLC (operating as Patternwise) 8080 Westpark Drive STE 78255, Houston, TX 77063 United States

Privacy inquiries: privacy@patternwise.app Legal notices: legal@patternwise.app General support: support@patternwise.app Website: https://www.patternwise.io

For GDPR or UK GDPR inquiries, or to identify our data protection contact, email privacy@patternwise.app with "GDPR" in the subject line.

Review, Update, or Delete Your Data {#dsar}

To review, update, export, or delete the personal information we hold about you, you may:

Use the in-app controls in Settings > Account
Email a data subject access request to privacy@patternwise.app

We will respond to verified requests within 30 days. Complex requests may require up to 45 days; we will notify you if an extension is needed. Identity verification is required before we process deletion or portability requests.