Last updated: 2026-07-14
Vincendio is a personal journal. You write private things here — reflections, moods, progress. We take that seriously, so below is exactly what we store, why, and who we trust it to. Plain language wherever plain language will do.
The short version: only you can see your journal. We do not sell your data, we show no ads, and we run no advertising or tracking analytics.
The controller of your personal data is the operator of Vincendio. For anything concerning your data, write to contact@vincendio.com. We answer every request.
Only what the app needs to work:
We do not sell your data and we do not share it with advertisers. We do rely on technical providers, without which the app could not run:
When you sign in, sign up, or reset a password, we store your IP address as part of an attempt counter (in Upstash). This is what stops someone guessing passwords after a handful of tries. The counter expires by itself — after 15 minutes for sign-in, after an hour for sign-up and password reset — and the address goes with it. We do not build a profile from it and we never join it to your journal content.
Separately, our hosting provider (Vercel) keeps its own server logs, which also contain IP addresses, under its own policy.
Your journal does not leave the European Union. The database is in Frankfurt (eu-central-1), the servers handling application requests are in Frankfurt (fra1), and so are your proof photos (Vercel Blob) and the sign-in attempt counters (Upstash). Everything you write and upload — entries, reflections, habits, progress, photos — is stored and processed inside the EU.
Only two things go outside the EEA, and we name them plainly:
These providers base such transfers on Standard Contractual Clauses (SCCs) or on the Data Privacy Framework.
Vercel and Neon are US companies, even though the processing regions we have chosen are in the EU — any theoretical parent-company access rests on those same legal bases.
We keep your data for as long as your account exists. Nothing is deleted automatically — last year's journal is meant to remain last year's journal. The exceptions are email-verification and password-reset tokens, which expire on their own.
You can delete your account yourself, in Settings. Deletion is immediate and permanent: all of your data goes — journal, habits, workouts, progress, photos, and your forum posts and replies. We also hand back the access you granted us in Google. There is no grace period, and we keep no copy to give back to you.
Replies other people wrote under your forum posts stay. They are their words, not yours, and we have no right to delete them.
You can download your data yourself, in Settings — "Download my data" hands you everything we hold about you as a single JSON file. Photos are linked from it rather than embedded: you fetch them while signed in. It contains no passwords and no Google or Notion tokens — those are of no use to you, and a file holding them would be dangerous to keep.
If you would rather not, or something is broken, write to contact@vincendio.com and we will send a copy by hand. You can also write to that address about deleting your account, if for some reason you cannot do it yourself.
After deletion from the database, data may persist for a while in our providers' backups, which rotate on their own schedules.
Under the GDPR you have the right to access your data, to have it corrected or erased, to restrict processing, to data portability, and to object to processing based on legitimate interest.
To exercise any of these, write to contact@vincendio.com. You also have the right to lodge a complaint with the Polish supervisory authority (Prezes Urzędu Ochrony Danych Osobowych, PUODO) if you believe we are handling your data unlawfully.
We use only the cookies the site needs to function:
We use no analytics or marketing cookies. There is no Google Analytics, no advertising pixel, and no tracking tool of any kind in the application's code. That is why you will not see a cookie-consent banner here — there is nothing to consent to.
Your colour theme is stored in your browser's local storage. That never leaves your device.
The forum is the only part of Vincendio that others can see. The posts, photos and links you publish there are visible to other signed-in users, along with the name on your account. Everything outside the forum — journal, habits, workouts, progress — is visible only to you.
You can delete your own posts at any time.
If we change how we handle data, we will update this document and change the date at the top of the page. For significant changes, we will tell you by email.