Security Policy

1. Purpose and scope

This Security Policy describes the measures Remly uses to protect the confidentiality, integrity and availability of information processed through the Remly diary app for Android and this policy website. It applies to Remly's app, the optional backup feature and the related online services that Remly makes available.

This policy does not cover the security practices of third-party services such as Google Drive, Google Sign-In, Google Play or Google AdMob. Those services are governed by their own security and privacy policies. This policy is a general description of our practices; it is not a guarantee that any system is completely secure.

2. Our security principles

• Privacy by design — journal content stays on your device by default. Online features are optional and limited to what you choose to use.
• Least privilege — the app requests device permissions and account access only when needed for a specific feature.
• Defense in depth — we combine device protections, secure connections, account authentication and provider safeguards.
• Data minimization — we avoid collecting information that is not needed to operate and improve the app.
• Accountability — we review our practices as the app, our providers and applicable requirements evolve.

3. How data is protected

Journal content on your device

Entries, media and reminders are stored in the app's private storage area, which is protected by the Android operating system's application sandbox and your device's own security features. Access normally requires unlocking your device. If you enable an app lock or similar device protection, that provides an additional layer of protection.

Backups

If you enable backup, Remly sends an encrypted connection to Google Drive and stores the backup in a private application folder within your own Google account. The backup is associated with the Google account you authenticate with. Remly does not access other files in your Google Drive, and journal content is not stored on a Remly-operated content server.

Data in transit

Online features use encrypted connections. Data sent between the app and service providers is protected against interception in transit, subject to the security of your network and device.

Imports and exports

Journal archives that you export are saved to a location you choose. These files are outside the app's private storage and may be accessible to other apps or people depending on where you save them. Store exported files securely and delete them when they are no longer needed.

4. Authentication and access

Remly does not ask for your Google password. When you use backup or restore, you authenticate directly with Google through the official sign-in flow. Remly receives a limited authorization that allows the app to work with its private application folder in your Google Drive.

Access credentials are handled on your device and are not displayed to you or shared with other users. You can end the connection at any time by signing out in the app and by revoking Remly's access from your Google Account permissions. Revoking access may prevent backup and restore until you sign in again.

Remly personnel do not access your journal content. Support requests should not include the full text of private entries or sensitive media unless it is necessary to resolve your issue.

5. Third-party services

Remly relies on established providers for certain online functions. These currently include Google services for sign-in, backup storage, analytics, crash reporting, advertising and in-app purchases. We select providers that maintain recognized security programs and we configure their services to use the minimum access needed for the feature.

These providers may process technical information in accordance with their own terms, security practices and privacy policies. Their security measures are outside Remly's direct control, but we take their practices into account when choosing and configuring services.

6. Secure development and operations

We work to reduce security risk throughout the app lifecycle by:

• reviewing changes before release and testing new features with privacy and security in mind;
• keeping development tools and third-party libraries reasonably current and applying important updates;
• using official distribution channels and release signing for Android builds;
• limiting the permissions and access that the app requests;
• avoiding logging of private journal content in diagnostic systems; and
• reviewing reported issues and taking proportionate action.

No development process eliminates all risk. We prioritize issues based on their potential impact and work to address them responsibly.

7. Incident response

If we become aware of a security incident that affects personal information, we will take steps to investigate, contain and remediate the issue. Where required by applicable law, we will notify affected users, regulators or other authorities in a timely manner. Notifications will describe the nature of the incident and the steps users can take, to the extent known and appropriate.

To report a suspected incident or vulnerability, contact us using the details in section 10. Please do not publicly disclose a suspected vulnerability before we have had a reasonable opportunity to investigate and respond.

8. Retention and deletion

We keep information only for as long as needed for the purposes described in our Privacy Policy or as required by law. You can delete journal content in the app, delete a backup through your Google Drive settings, sign out of the backup connection, or request deletion by emailing support.remlyapp@gmail.com. Step-by-step options are available on our Data Deletion page.

Deleting the app removes local app data from your device, but it does not automatically delete a backup stored in your Google Drive account. See the Privacy Policy for deletion instructions.

9. Your responsibilities

Security is a shared responsibility. To help protect your journal:

• Use a screen lock and keep your device operating system up to date.
• Protect your Google account with a strong password and, where available, two-step verification.
• Review the apps and devices that have access to your Google account and remove access you no longer use.
• Download Remly only from official app stores and install app updates when available.
• Be careful when exporting journal files and store them in a secure location.
• Avoid sharing your device or account credentials with people you do not trust.
• Contact us promptly if you believe your account or data has been compromised.

10. Reporting a vulnerability

We welcome responsible reports from security researchers and users. If you believe you have found a vulnerability in Remly, please email support.remlyapp@gmail.com with the subject "Security report". Include enough detail for us to understand and reproduce the issue, such as the affected feature, steps to reproduce and any relevant technical details.

Please act in good faith: do not access, modify or disclose other users' data, do not disrupt the service, and give us a reasonable opportunity to investigate and fix the issue before public disclosure. We will review reports and respond as appropriate. We do not offer a bug bounty program at this time.

11. Changes and contact

We may update this Security Policy as our practices, providers or legal requirements change. Material updates will be reflected by a new effective date on this page.

For security questions or reports, contact: