Home
Firefly RealmFirefly Realm

Working product draft

Privacy Notice

Effective date: To be confirmed on release · Version: Draft 0.1

This Privacy Notice explains what Firefly Realm collects, why, how it is used and the choices you have. It is written in plain language; precise legal wording will be added after professional review.

This document is a working product draft. It has not yet received professional UK legal or privacy review. Items shown in square brackets, for example [DATA CONTROLLER NAME REQUIRED], are placeholders the operator must complete before commercial release.

1. Who is responsible for your information

The data controller for Firefly Realm is [DATA CONTROLLER NAME REQUIRED], contactable at [CONTROLLER CONTACT EMAIL REQUIRED], registered address [CONTROLLER REGISTERED ADDRESS REQUIRED]. If a Data Protection Officer is appointed, their contact details will appear here: [DPO CONTACT — IF APPLICABLE].

2. What information is collected

  • Account information: your email address and an authentication password (held only as a salted hash by Supabase).
  • Reflections: the words you write into the reflection form, along with optional energy level.
  • Perspectives: AI-generated responses to your reflections.
  • Release entries: entries you write in Quick Journal and The Unsent Page, including any title, the entry text, optional feeling tags, optional intensity value and timestamps. Release entries are private to you and are not sent to any AI provider by default.
  • Achievements, animal companions and XP: small records of progress derived from your reflections and, where you unlock them, from deterministic in-app events. This includes the badge identifier, tier, rarity, whether it was a secret badge, the area it came from and the timestamp.
  • Consent records: that you agreed to the AI-processing disclosure, and the version you saw.
  • Operational logs: timestamps, success/failure status, model identifier and token counts for AI calls. These never contain your reflection or Release text.
  • Feedback: anything you choose to send through the in-app Feedback form, including an optional reply email.
  • Essential session storage: a Supabase authentication token in your browser, small local preferences such as your reduced-motion choice, and a short-lived draft envelope used only when you choose to turn a Release entry into a Reflection. See the Cookie information page.

3. Why your information is processed

  • To provide the reflection, Perspective, achievement and progress features.
  • To keep your account secure and prevent abuse.
  • To maintain quotas that protect against runaway AI costs.
  • To improve the product based on aggregated, non-identifying operational metrics and your voluntary feedback.

4. Lawful bases

[LAWFUL BASES — PROFESSIONAL REVIEW REQUIRED] The intended bases are: performance of a contract (providing the service you asked for), legitimate interests (security, fraud prevention, quota enforcement, service improvement using non-identifying metrics), and your explicit consent for sending filtered reflection content to an external AI provider.

5. Service providers (subprocessors)

  • Supabase — authentication, database and serverless functions hosting.
  • OpenAI — generates Perspectives from filtered reflection content under contractual terms that exclude their use of API content for model training by default.
  • Hosting and CDN — [HOSTING / CDN PROVIDERS REQUIRED].

These providers may store information outside the UK. Where international transfers occur, appropriate safeguards such as Standard Contractual Clauses are intended to be in place; precise transfer mechanisms will be confirmed with each provider before commercial release: [INTERNATIONAL TRANSFER MECHANISMS — REVIEW REQUIRED].

6. AI privacy filtering

Before any reflection is sent to OpenAI, Firefly Realm runs an automated filter that removes or generalises obvious identifiers such as email addresses, phone numbers, postcodes, vehicle plates, long digit sequences, web links and social handles. Filtering is rules-based; it cannot guarantee complete anonymity, and you should avoid entering anything you would not want externally processed. See the AI & Privacy page for details.

7. Retention and deletion

  • Reflections, Perspectives, achievements, animal-companion records and XP: kept until you delete the entry or your account.
  • Release entries (Quick Journal and Unsent Page): kept privately until you choose Let it go, which permanently deletes that page immediately — it cannot be restored from the app.
  • AI usage logs (operational metadata only, no reflection or Release text): kept for up to [RETENTION PERIOD — REVIEW REQUIRED].
  • Consent records: kept as evidence of consent for as long as legally appropriate.
  • Backups: rolling provider backups with limited retention windows configured by Supabase. Content may persist in those backups for a short period after in-app deletion until the backup rotates out.

8. Deleting your account and content

You can delete individual reflections at any time from your account. Release entries can be permanently deleted with the Let it go action on each page. To request full account deletion, use the Profile screen or contact [PRIVACY CONTACT EMAIL REQUIRED]. Deletion removes your account, reflections, Perspectives, Release entries, achievements, animal-companion records and XP records.

9. Your rights

  • Right of access to your personal information.
  • Right to rectification of inaccurate information.
  • Right to erasure.
  • Right to restrict or object to certain processing.
  • Right to data portability where applicable.
  • Right to withdraw consent at any time for AI processing (without affecting prior lawful processing).

You can complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

10. Security

Firefly Realm relies on Supabase Row Level Security so that each user can only read or modify their own reflections, Release entries, achievements and XP records. Secret animal-companion badges are hidden from the catalogue until earned. Service-role and AI provider keys are held only as server-side secrets and never exposed to the browser. Detailed security controls are not published to avoid disclosing security-sensitive information.

10a. Limited automated safety pattern-check

Firefly Realm may run a small local pattern check on some entries in the Release area to decide whether a light-hearted celebration would be inappropriate, and to show a restrained note pointing to human support (for example Samaritans in the UK). This is not a professional safety assessment, is not continuous monitoring, is not reviewed by a person in real time, and may be incomplete. No diagnosis or risk score is stored. Release entries are never shared with any external service as part of this check.

10b. Animal Companions and achievements

Achievements and animal-companion badges are unlocked only from a server-controlled catalogue using deterministic in-app conditions (for example completing a Reflection or keeping a page of a certain length). There is no public leaderboard, no public profile, and no public sharing by default. Achievement and Reflection data is not sold, and is not used for advertising or behavioural profiles.

11. Children

Firefly Realm is intended for adults. The minimum supported age is [MINIMUM AGE — UK DEFAULT 13 OR 16 PENDING REVIEW]. Accounts believed to belong to younger users will be closed.

12. Changes to this notice

Material changes will be announced in-app and at the top of this page, with the new version and effective date. Continuing to use Firefly Realm after a change indicates you have read the updated notice.