Privacy policy

Version of 30 October 2026.

Who processes your data

The data controller is CBT Diary, Portugal. For questions about your data, use the contact form. The service's servers are in Europe.

What we process

• Google account data: account ID, email, name, picture URL — used to sign you in.
• Diary content: thought records, their versions and comments. This is health data, a special category under Art. 9 GDPR.
• Contact form messages: the text you send together with your account's email and name. They are not encrypted, so that we can read and answer them.
• Service data: when entries were created and changed, which psychologists have access, read markers, and facts about your passkeys (no biometrics — they never leave your device).

Legal basis

Your explicit consent (Art. 6(1)(a) and 9(2)(a) GDPR), given at first sign-in. You can withdraw it at any time by deleting your account in your profile.

How entries are protected

Entries and comments are encrypted with AES-256-GCM. The diary key is stored only in wrapped form: your passkey opens it, and so does the key of each psychologist you granted access. The database and backups hold ciphertext only.

While your diary is unlocked, its key sits in the server's memory for your session and is wiped after 30 minutes without activity, at sign-out or on restart. The service operator cannot read entries without actively altering the service's code. Your name, email and service data are not encrypted.

If you lose every passkey, only a psychologist who has access to your diary can restore it. Without one the data cannot be recovered — nobody, including us, holds the key.

Who can see your data

Only you and psychologists you invited and confirmed. We do not sell or share data with third parties and do not use it for advertising or model training.

Retention

Data is kept while you have an account. Deleting the account immediately removes your entries, versions, comments on your diary, keys and sessions; copies in backups stay unreadable because the keys are destroyed. Comments you left in patients' diaries (as a psychologist) stay with those patients, marked as a deleted account. Contact form messages are deleted with the account, or earlier once the question is settled.

Your rights

You can get a copy of your data (“Download my data” in your profile, JSON), correct it, delete your account and withdraw consent. If you believe we infringe your rights, you can complain to a supervisory authority: in Portugal that is the CNPD (Comissão Nacional de Proteção de Dados, cnpd.pt), or the authority of the country where you live.

Cookies

Only technical cookies are used: session, form protection (CSRF), chosen language and time zone. There are no analytics or advertising cookies.