Privacy Policy — Sanctuary

Effective date: 20 August 2026 · Last updated: 20 August 2026

Sanctuary is a private, on-device journaling app for Android. This policy explains what Sanctuary does and does not do with your information.

The short version: your journal stays on your phone. Sanctuary has no servers, no account, and no ability to send your entries anywhere.

1. Who we are

Sanctuary (“the app”, “we”) is published by the Sanctuary developer. If you have any question about this policy or your privacy, contact us at legacybusiness25@gmail.com.

2. The core promise: no data collection, no transmission

Sanctuary does not collect, transmit, sell, or share any personal information. Specifically:

No account and no sign-in. You do not create an account or give us your name, email, or phone number to use the app.
No analytics, no trackers, no advertising. The app contains no analytics SDK, no advertising SDK, and no third-party tracking of any kind.
No networking capability. The app does not request the Android INTERNET permission. On Android, an app without that permission cannot open a network connection, so your journal content physically cannot leave your device through the app. (The app does read ACCESS_NETWORK_STATE, which can only check whether connectivity exists — it cannot send or receive any data.)

Because there is no collection and no transmission, there is no data for us to access, retain, or disclose.

3. What you create stays on your device

Everything you put into Sanctuary is stored locally in the app’s private storage on your device:

Journal entries (text, moods, tags, dates) are stored in a local database that is encrypted at rest using SQLCipher. The database key is held in Android’s hardware-backed Keystore via encrypted preferences.
Photos you attach to an entry are copied into the app’s private storage and are not shared with other apps.
Settings (theme, font, app-lock configuration, and similar preferences) are stored locally.

This data is removed when you delete the relevant entries or when you uninstall the app. Sanctuary sets allowBackup="false", so your encrypted journal is not included in Android’s automatic cloud backup.

4. Device permissions and why they are used

Permission	Why it is used
Microphone (`RECORD_AUDIO`)	Optional voice-to-text dictation. Speech is transcribed on your device using Android’s on-device speech recognizer. Audio is not recorded, not stored, and not sent anywhere. The microphone is used only while you are actively dictating, and only if you grant the permission.
Biometric (`USE_BIOMETRIC`)	Optional app lock. If you enable it, your device’s biometric/screen-lock is used to unlock the app. Sanctuary never sees or stores your fingerprint, face, or PIN — that is handled entirely by Android.
Billing (`com.android.vending.BILLING`)	Lets you make the optional one-time “Lifetime Pro” purchase through Google Play (see §6).

You can use the core journaling experience without granting the microphone or biometric permissions.

5. On-device AI features

Some optional features (for example cleaning up text, summaries, and reflection prompts) use on-device artificial-intelligence models, such as Google’s Gemini Nano via Android’s ML Kit GenAI, running locally on supported devices. When you use these features, your text is processed on your device and is not sent to us or to any server by the app.

An honest note about the AI model itself: the on-device model is part of the Android system and is provisioned and updated by your device’s operating system (Google Play services / AICore), not by Sanctuary. That system-level provisioning is outside the app’s control and is governed by Google’s own terms and privacy policy. Sanctuary itself never transmits your journal content — the “stays on your phone” promise above applies to everything you write and store in the app.

On devices that do not support on-device AI, these features either fall back to a simple local alternative or are unavailable, with a clear message. No feature sends your content off-device.

6. Purchases

Sanctuary offers a single optional one-time “Lifetime Pro” in-app purchase. Payments are processed entirely by Google Play Billing — Sanctuary never sees or handles your payment details. Your purchase (an entitlement attached to your Google account) is what lets Sanctuary restore Pro across your devices and reinstalls. Google’s handling of the transaction is governed by Google’s Privacy Policy. Sanctuary stores only a local flag recording that Pro is unlocked.

7. Children’s privacy

Sanctuary does not collect personal information from anyone, including children. The app is a personal journal and is not directed at children under 13.

8. Your control over your data

Because your data never leaves your device, you remain in full control:

Delete individual entries at any time within the app.
Export or back up your journal yourself using the app’s backup/export features (these produce a file you choose where to save; the app does not upload it anywhere).
Uninstalling the app removes its local data from your device.

9. Changes to this policy

If this policy changes, we will update the “Last updated” date above and post the revised policy at the same public URL. Material changes will be reflected in the app listing.

10. Contact

Questions about privacy in Sanctuary: legacybusiness25@gmail.com.