Privacy policy

Who looks after your data

The Cabana app belongs to ALC Intermediação e Representação Ltda., registered under Brazilian company number (CNPJ) 66.279.691/0001-12, based in Brasília/DF, Brasil. It is the controller of the personal data handled here, under Brazil's General Data Protection Law (Law 13.709/2018).

This policy covers the app and this website. It is written to be read — if any part is unclear, write to [email protected] and we will rewrite it.

What stays on your device only

Cabana works fully without an account, without signing up and without the internet. Until you create an account, everything you write — the journal, your mood, the names of your goals, the voice notes, your creature — stays on your phone and nowhere else.

In that case there is nothing of ours to access, hand over or delete: we do not have the data. This is not a promise not to look; it is the absence of the data on our side.

The journal text, your mood entry, the goal titles and the voice notes are stored encrypted on the device itself, with a key that is created there and never leaves it. The name you gave your creature and how much it has grown sit readable in the app file — it all goes together when you erase.

What leaves the device, and only if you want it to

If you create an account and turn on syncing — so you do not lose your creature when you change phones — then some things do go up to our server: your creature, your goals, your mood entries, your reflections, the adventures and your inventory. The account is for a new phone, not for two at once: what you delete on one does not disappear from the other.

Your email also goes up, since it identifies the account, along with the timestamp of each change, which is how the phone and the server know which one is newer.

Voice notes never go up. Step counts, when you turn that on for a goal, never go up: they are read, used at that moment and discarded.

What goes up, but we cannot read

The text of your journal, your mood entry and the titles of the goals you wrote go up encrypted. The key that opens that encryption is created on your device, kept there, and never sent to us.

In practice: what sits on our server is a scrambled block that not even we can open. If someone broke into the entire server, they would not read one line of your journal.

This has a consequence you should know: if you ask for a copy of your data, the one that can put it together is your device, not our server. That is why the button to take a copy lives inside the app, under Your data.

When you write someone else’s name

Once a week Cabana asks who was good to you. If you answer with a name, that name belongs to another person — and they did not choose to be here. That is why it gets the most restricted treatment in the app.

The name stays encrypted on your device and never goes to our servers, not even when you create an account. We do not have it, we do not use it for anything, and we do not cross it with anything else. It exists so your creature can offer to write a letter to that person, and for nothing else.

If you write the letter and choose to send it, the app builds a link and opens your phone’s share sheet — you decide whether to send it and through which app. The whole letter travels inside the link itself, in the part browsers never send to the server: we do not receive it, do not store it, and cannot read what you wrote or who it went to. There is no list of letters or recipients on our side.

The consequence is honest and must be said: because the letter is not with us, it cannot be deleted after it is sent — whoever has the link has the letter. This is the same as any message sent through any app.

There is one exception, and it is your choice: if you invite someone to be your madrina, that person’s e-mail goes to our server, because that is how the invitation is sent. They get an e-mail saying who invited them, can accept or decline in one tap, and can leave later — leaving deletes their e-mail from our side, right away. While they have not accepted, the invitation expires on its own and the e-mail goes with it. Nothing else of theirs stays with us: not a name, not what you write, not what your creature does.

If you delete the name in the app, it is gone from the device. Apart from the e-mail of an invited madrina, if the named person wants to know what we hold about them, the answer is: nothing — and [email protected] will say so in writing to anyone who asks.

What we use it for

To make the app work: show your creature, keep your goals, remember what you have written, and give all of it back when you change phones.

Nothing else. We do not use what you write for advertising, we do not build a profile of you, we do not sell and we do not hand anything to anyone for commercial purposes.

The app counts, anonymously, how often certain things happen — how many times it was opened, for instance — so we know what to improve. That count carries no identifier, no time of day and not one letter of what you wrote. Those numbers go to our server, added up by day, with nothing that says who you are — and you can turn the count off whenever you want, under "Your data", inside the app. Turning it off erases what was already counted and stops counting.

Who we share it with

With whoever runs the infrastructure: the service that stores the synced account database, and the service that sends the confirmation email. They handle the data on our behalf and cannot use it for anything else.

With the app stores, when you subscribe: payment is handled by Google Play or Apple, and we neither receive nor store your card number.

With the service that confirms the subscription to the app: RevenueCat. It keeps an identifier of your account and the subscription history — never your email or card number — and when you delete the account, that record is deleted too.

With Hugging Face, only if you turn on search in your memory: the model that runs the search is downloaded from the servers of Hugging Face, a company in the United States. In that download it receives your device's IP address and nothing you wrote, which never leaves the device.

With public authorities, if there is a lawful order. If that happens and the law allows us to tell you, we will.

Data leaves Brazil

The server that stores the synced account is outside Brazil. That is an international data transfer, and it only happens if you create an account and turn on syncing.

When you turn on syncing we ask for your consent specifically for that transfer, separate from your consent to use the app. You can refuse and keep using all of Cabana on your device.

As said above: the content of what you write crosses encrypted, and we do not hold the key.

The same goes for search in your memory: if you turn it on, the model comes from the servers of Hugging Face, a company in the United States, and all that crosses in that download is your device's IP address.

How long we keep it

For as long as your account exists. You can delete it at any time. From the app, deletion is complete: the rows go from the database, the subscription record is deleted, what is on this device is erased and your encryption key is revoked. From this website, the rows go from the database along with the subscription record; whatever is left on the device goes when you delete from the app or uninstall it.

If the account goes two years without a single sign-in, we delete it, and we email you before we do.

Whatever is on your device goes when you uninstall the app, or through Your data inside it.

Your rights

Brazilian law gives you the right to confirm that processing exists, access the data, correct what is wrong, ask for a copy, ask for erasure, know who we share with, and withdraw consent.

You exercise all of them inside the app, under Your data, or by writing to [email protected]. We answer within 15 days.

Withdrawing consent for syncing does not wipe the app: it goes back to working on your device only, as it did at the start.

Age

Cabana is for people aged 14 and over, and the app says so before you begin.

Creating an account follows the age of consent where you live. In the European Union and the European Economic Area it is 16 today, and the app says so before asking for any data. The whole app remains for people aged 14 and over: the account age does not change the product age.

If you are between 14 and 18, your data has reinforced protection by law, and our rule is the one the law sets: collect the minimum, in your best interest, and never make using the app conditional on giving more data than needed. That is why the whole app works without an account.

We have no social layer with strangers, no leaderboard, no comparison with other people and no advertising.

Security

What you write is encrypted on the device before it is stored, and stays encrypted if it goes up to the server. The key sits in your phone operating system keystore.

Database access is scoped per account: one account cannot reach another account row.

If a security incident occurs that could put you at risk, we will tell you and Brazil's National Data Protection Agency.

Cabana is not a health service

Cabana is not a medical device and does not diagnose, treat, cure or prevent any medical condition. Nothing here replaces a healthcare professional — if you need help, look for one, and the app has a door to support lines that is always visible.

What the app does is keep what you write and show it back to you. It does not read your journal, does not interpret what you felt and makes no assessment about you.

If this policy changes

A change that alters the purpose of the processing is announced inside the app, before it takes effect, and you may refuse it.

This version is dated 2026-09-17.

Talking to us

[email protected] — for any request about your data, and for any question about this policy.

ALC Intermediação e Representação Ltda. · CNPJ 66.279.691/0001-12 · Brasília/DF, Brasil.