Privacy Policy

Last updated: October 18, 2026 (applies to iPhone version 1.0.0 and later)
This is a translation of the Traditional Chinese policy. If they differ, the Chinese version prevails.

Who we are

Lanternote (“the App”) is developed and operated by EdgeLingo, a one-person studio in Taiwan (“we” or “us”). If you have any questions about this policy or your data, please email support@edgelingo.com.

What data we handle

Data stored on your iPhone

Your entries, answers, memories, and settings are all saved on your iPhone first. When you’re not signed in, they exist only on this iPhone, and deleting the app deletes them too. However, even if you’re not signed in, as long as you’ve agreed to use AI, the entry is still sent to AI for processing when you tap “Done” (see “How AI handles your journal” below). Simply writing an entry or saving a draft doesn’t send anything to AI. Once you sign in, drafts are encrypted and synced just like finished entries (see “Sign-in and sync” below).

Sign-in and sync

• Sign in with Apple: We don’t ask for your name or email address. Apple gives us an identifier that belongs only to you and this app, and we keep only a hash derived from it, which can’t be reversed.
• Encrypted storage: Once you sign in, your entries, answers, memories, memory settings, and vectors (see “Search and similar entries” below) are synced to our database in Google Cloud’s Taiwan region (asia-east1). Each account has its own encryption key (AES-256-GCM), which is in turn protected by Google Cloud KMS.
• Who can read it: The server software decrypts your content and sends it back to you only when your app syncs. Our system logs never record any journal content. Unless required by law, we don’t read your journal for any other purpose.
• Staying signed in: Once you sign in, your iPhone keeps a sign-in token that’s valid for 180 days; after that, just sign in again.
• To comply with App Store rules, we store, encrypted, a token that Apple issues to us, which we use when you delete your account to tell Apple to revoke this app’s sign-in authorization.

How AI handles your journal

We ask you first

Before any of your journal is sent to AI for the first time (when you tap “Done”, open Weekly recap, or use Ask my journal), the app explains what will be sent and where, and asks you to choose: agree, or “Not now”. Until you agree, the app doesn’t send any text to AI. You can turn this off at any time in “Settings > AI”. Once it’s off, nothing more is sent; memories and recaps that were already created stay on your iPhone, and you can delete them yourself.

When something is sent

• Tapping “Done”: this entry, plus a few related memories, to check whether you’re safe, come up with a question or two, and note what to remember.
• Answering questions from Lantern, or tapping “Talk a bit more”: this entry, the questions, and your answers.
• Weekly recap: that week’s entries.
• Ask my journal: your question, and the few entries most related to it.
• Converting to vectors: every entry you finish or edit, every memory, and what you type in the search box and in Ask my journal are sent to be converted into vectors (see below).

Entries with safety concerns don’t produce memories and aren’t used in Weekly recap or Ask my journal.

Where it goes

Content first passes through our servers in Google Cloud’s Taiwan region and is then forwarded to the AI provider; replies come back to your iPhone the same way. Our servers use the content only while handling that request and don’t keep the content of requests or replies.

• Anthropic (Claude): The main AI we use. Content may be processed outside Taiwan (for example, in the United States). Under Anthropic’s Commercial Terms of Service, it doesn’t use this content to train its models. According to its public documentation, inputs and outputs are deleted from its back end within 30 days; only if its automated safety systems flag them as potentially violating its usage policy may they be kept for up to 2 years.
• Google (Gemini, via Vertex AI): Used when Claude can’t respond, and also to double-check safety and to convert text into vectors. Content may be processed in Google data centers in any region. According to Google’s documentation, it doesn’t use this content to train models without permission. We’ve turned off Google’s caching; only if Google’s automated safety checks find that a request may involve abuse may Google keep that request, for up to 90 days.

Search and similar entries

To list “similar entries” when you search, and to find the most relevant entries and memories when you ask a question or when Lantern asks you one, we have Google’s Gemini Embedding model (via Vertex AI) convert text into a string of numbers called a “vector”. Text with a similar meaning has similar vectors.

• Vectors are stored on your iPhone. Once you sign in, they’re also encrypted with your account’s key and synced just like your entries, so they don’t need to be converted again when you switch phones.
• Matching happens on your iPhone. A search sends only what you type; searching never causes your entries to be sent.
• The original content can be roughly inferred from a vector, so we treat vectors as just as sensitive as your entries. When you delete an entry, a memory, or your account, the matching vectors are deleted too.

Safety check

Before each entry is sent to generate questions, AI first assesses whether the content raises any safety concerns. If it does, Lantern won’t ask you any more questions and will instead show a gentle response or helplines. This is an automated assessment, not a medical or professional evaluation; we won’t notify any person or organization because of it. Lanternote is not a medical or mental health counseling service; if you need help, please contact a professional.

Reporting AI content

If a question, answer, or recap written by the AI seems inappropriate or incorrect to you, you can tap “Report this AI content” next to it. We receive only that piece of AI text, the reason you chose, and any note you write yourself, without your journal entries or your account or device identifiers. These reports are used to review and improve how the AI performs, and are deleted automatically after 180 days.

Purchases and usage

• Confirming you got the App from the App Store: Each time you use an AI feature, the app includes a receipt signed by Apple. It contains an identifier that belongs only to your Apple Account and this app, with no name or email address. After we confirm that Apple signed it, we keep only a hash derived from that identifier, which can’t be reversed, together with that day’s usage, to apply the daily fair-use limit. This record is deleted automatically, usually within 3 days.
• Free first week: Without a subscription, all AI features are free for 7 days from your first use. To work out when those 7 days started, we keep the same hash and the time of your first use (no content of any kind). This record isn’t linked to your sign-in account, so it isn’t deleted when you delete your account; if you’d like it deleted, please email us.
• Subscriptions: Payment is handled entirely by Apple, and we can’t see your payment information. When you use an AI feature, the app includes an Apple-signed subscription receipt, which we use only to check whether your subscription is active. The result is held in server memory for at most 10 minutes and is never written to a database.
• Separately, we keep daily aggregate statistics (such as total requests, total cost, and the number of people who used the app that day). These contain no data that can identify individuals and are deleted automatically after 400 days.

Voice

When you dictate an entry, the app uses the microphone and Apple’s speech recognition, built into your iPhone, to turn your voice into text. Your voice is processed only on this iPhone; recordings are never uploaded or saved. The resulting text is saved as a draft just like typed text, and from then on it’s handled the same way as a typed entry.

Reminders

Reminders are local notifications scheduled on your iPhone. Their settings are stored only on your iPhone and never pass through our servers. Notifications never show any journal content.

What we don’t do

• We don’t show ads, we don’t use any third-party analytics, advertising, or tracking tools, and we don’t build a marketing profile of you.
• We don’t sell your data, and we don’t give it to anyone other than the service providers listed in this policy.
• If you choose in your iPhone settings to share analytics with app developers, Apple provides us with crash reports. This is an Apple feature, and you can turn it off in “Settings > Privacy & Security > Analytics & Improvements”.

Who helps us provide the service

• Google Cloud: servers, database, encryption key management, and the Gemini models.
• Anthropic: the Claude models.
• Apple: Sign in with Apple, and App Store purchases and subscriptions.

They process data only on our instructions and are bound by their own data protection terms.

Deleting your data

• Deleting an entry or a memory: It’s deleted from your iPhone immediately. If you’re signed in, the content on our servers is deleted too, leaving only a “deleted” marker with no content for up to 1 year, so your other devices know it was deleted.
• Deleting your account and all data: Do this in the app’s “Settings”, then confirm once more with Apple. All entries, answers, memories, settings, and the encryption key for this account on our servers are deleted immediately, the Sign in with Apple authorization is revoked as well, and the data on this iPhone is deleted too. This can’t be undone. Subscriptions must be canceled separately in the App Store.
• If you’re not signed in: Your data is only on your iPhone, and deleting the app deletes all of it.
• Content already sent to AI providers is deleted according to the terms described in “Where it goes” above.

Your rights

Under Taiwan’s Personal Data Protection Act and other applicable laws, you may make inquiries about or review your personal data or request a copy of it, and you may ask us to supplement or correct it, to stop collecting, processing, or using it, or to delete it. Most of this can be done directly in the app: viewing and editing your entries and memories, turning off Memory or a category of memories, and deleting your account and all data. For other requests, please email support@edgelingo.com, and we’ll reply within the period required by law.

You can choose not to sign in, not to use voice, and to turn off Memory; none of these affect writing your journal. Questions from Lantern after you write, Weekly recap, and Ask my journal can be used only by sending content to AI.

Data security

Connections between your iPhone and our servers are encrypted the whole way (HTTPS), content stored on our servers is also encrypted, and access to the service is granted only to the systems that need it. However, no system can be guaranteed to be 100% secure; if an incident affects your personal data, we’ll notify you as required by law.

Children

Lanternote isn’t designed for children, and we don’t knowingly collect children’s personal data. If you’re under 18, please read this policy together with a parent or guardian.

Changes to this policy

When the app’s features or the way it handles data change, we’ll update this policy and the date at the top. For significant changes, we’ll also let you know in the app.