Secure Authentication
Sign in with email and password, a passwordless magic link, or Google OAuth. Your account is protected by industry-standard authentication through Supabase Auth with bcrypt password hashing and secure session tokens.
Privacy First
Your journal.
Your business.
Dandelion Reflect is built on a simple belief: a journal should be the most private space in your digital life. Here's how we make that real.
Last updated 29 October 2026
No Content Analytics
We don't analyze or mine what you write: no keyword tracking, no sentiment analysis, no behavioral profiling. Entries are stored and searched only so you can read and find them.
No AI Training
Your journal entries are never used to train AI models — ours or anyone else's. Your entries, moods and breathing sessions are stored in your account so you can look back on them, and for nothing else.
Row-Level Security
Every database query is enforced with Supabase Row-Level Security (RLS) policies: no other user can read your entries, and a buggy or misconfigured API path can't return them. Entries are also encrypted at rest at the infrastructure level. Like almost every cloud service, our operators could technically access the database — we commit to never reading entry content except where the law requires it.
What we deliberately don't do
- ✕No ads — ever
- ✕No data selling or sharing
- ✕No AI training on your entries
- ✕No advertising or cross-site trackers
- ✕No social features or public profiles
- ✕No streak counters or guilt mechanics
- ✕No content analysis or sentiment mining
- ✕No email marketing about your journal habits
Frequently Asked Questions
Can anyone else see my journal entries?+
No. There are no social features, no sharing buttons, no public profiles. Dandelion Reflect is a purely personal journal, and entries are shown only to you when you're signed in. Photos, drawings and voice notes are stored privately and shown through signed links that expire; anyone you share such a link with (for example inside an exported file) could open it until it expires.
Can I lock Reflect on my phone?+
Yes. Open Me, then Privacy, and turn on App lock. You choose a 4 to 6 digit PIN, and where your device supports it you can also unlock with your fingerprint or face. Reflect locks when you leave it or stop using it for the time you pick. The lock is a screen lock for that one device. It stops a quick look by someone who picks up your phone. It doesn't encrypt your entries, and anyone who can open your email on that phone can get past it. Your PIN never leaves the device, and Reflect stores only a salted hash of it there. If you forget it, tap "Forgot your PIN?" on the lock screen, sign out, then sign back in with your email link or Google; pages that haven't synced yet stay on the device.
Do you sell my data?+
No. We don't sell your data or share it with advertisers or data brokers, and we don't run ads. A few service providers process data on our behalf to run Reflect: Supabase (database and storage), Vercel (hosting and analytics), PostHog (product analytics, US), Resend (sends the one welcome email when you sign up; it receives only your email address), Dodo Payments (web payments) and Google Play (payments in the Android app).
How do I delete my account or export my data?+
You can do both yourself, any time, on the web or in the Android app. Open Me, then Privacy, then "Delete account and data", type DELETE and confirm. That permanently deletes your account and everything in it: entries, photos, voice notes, moods, tags and pack progress. Product analytics in PostHog carry only a random account ID and aren't removed automatically yet. Email us and we'll delete them. A paid plan is cancelled so it doesn't renew. To keep a copy first, use Me, then Your journal, then Export. Can't sign in? Email yoshita@dandelion-psychotherapy.com from your account email and we'll delete your account, or send you an export, within 7 days. Deleted data leaves our live database straight away; it can remain in our database host's (Supabase) encrypted backups until those are overwritten in their normal cycle. Step-by-step instructions are on reflect.dandelion-psychotherapy.com/delete-account.
How are payments handled?+
On the website, payments are handled by our payment provider, Dodo Payments, and we never see your card details. In Reflect's Android app, purchases are processed by Google Play under your Google account: Google handles your payment details, and we receive only the purchase token, which plan you bought and its subscription status (for example active, cancelled or its renewal date). To cancel or change a plan bought there, use Google Play's subscriptions page.
Is my data encrypted?+
Data is encrypted in transit (TLS/HTTPS) and at rest on Supabase's infrastructure. Your connection to Dandelion Reflect is always secured.
Do you use cookies or trackers?+
We use essential cookies for authentication (keeping you logged in) and cookieless, aggregate Vercel page-view analytics. We also use PostHog product analytics to see which screens people use and where they get stuck: it records page views and actions like "created an entry" or "opened the upgrade page", linked to a random account ID — never your email, and never what you write, your moods, tags or prompts. Session recording is off, and we honour your browser's Do Not Track setting. Like any web service, PostHog sees your device's IP address when events are sent; we've switched off its IP-based location lookup, so no country or city is attached to your analytics. No advertising cookies and no cross-site trackers.
How do writing reminders work?+
Reminders stay off until you turn one on in Me. When you do, your browser gives us a push address for that device, and we store it with the time, days and time zone you picked. At that time we send an empty message through your browser's push service (run by Google, Mozilla, Apple or Microsoft, depending on the browser), and your device shows one fixed line: "Your page is here when you want it." Nothing you write is ever sent. Turning the reminder off, signing out or deleting your account removes the push address from our records.
Ready for a journal that respects you?
Start writing in a space where your privacy isn't a feature — it's the foundation.
Start Your Private Journal