← Back

Legal

Privacy Policy

For the Enara app and the website getenara.app · Version: 24 October 2026 · Deutsche Fassung

Enara is offered from Germany. That means the European General Data Protection Regulation (GDPR) applies to your data, wherever you live. This English version is provided for your convenience. In case of any dispute, the German version at getenara.app/datenschutz.html is the legally binding one.

1. Controller

Jakov Brekalo (sole proprietorship)
Schwanenplatz 3, 93047 Regensburg, Germany
Email: support@getenara.app

For any question about privacy, reach us at that email address. We have not appointed a separate data protection officer, because we are not legally required to.

2. Overview and basic principle

Enara is an app for journaling, rituals and a personal conversation with an AI companion. We handle your data sparingly. Much of it stays stored locally on your device. Data only leaves your device where a feature needs it to (account, syncing between devices, AI answers, voice recording). This policy explains what happens and when.

3. What data we process and what for

a) Account and sign in

An account is required to use the app. For it we process your email address and a password (stored encrypted). You can also sign in with Google or Apple, in which case we receive an identifier and your email address from those providers.

The emails about your account (confirming your sign up, resetting your password) are sent on our behalf by the service Resend. For that, Resend receives your email address and the content of the message in question, sent from hallo@getenara.app through servers in Ireland. Marketing emails do not go through this channel (see section 3l).

• Purpose: providing the account, signing in, syncing between devices, delivering account emails.
• Legal basis: performance of a contract, Art. 6(1)(b) GDPR.
• Processors: Supabase and Resend (see section 5).

b) Your content (journal, rituals, profile, conversations)

Your journal entries, ritual answers, your profile (among other things your name, date of birth for the zodiac sign, your wish, your life area) and your conversations with the companion are first stored locally on your device. With your account, they are additionally stored on our server (Supabase) so they are available on your devices. Transmission is encrypted (TLS). On the server, the data center's standard encryption and strict access rules (access only through your account) protect your data. Enara does not currently offer end to end encryption, meaning encryption where even we would be technically unable to read the content.

• Purpose: the core function of the app, backup and syncing of your entries.
• Legal basis: performance of a contract, Art. 6(1)(b) GDPR.

c) Special categories and sensitive content

What you write in Enara can allow conclusions about your mental state or your health (Art. 9 GDPR). We only pass such content to an AI service if you have explicitly consented (Art. 9(2)(a) GDPR). We ask for that consent once, before Enara answers you for the first time, in a separate step during onboarding. It is voluntary: if you say no, your rituals, your journal, your affirmations and the Library stay fully usable, Enara just will not write her own answers.

You can withdraw your consent at any time with effect for the future, in the settings under “Let Enara answer”. From the moment you withdraw it, no text leaves your device toward an AI service.

Separately from that, the setting “Let Enara read what I write” controls whether your pages you write on your own feed into the conversation at all.

d) AI companion (coach)

When you write to the companion, your message, the rest of the current thread of the conversation (up to 80 messages) and a package of context from your account are sent to Anthropic (Claude models) so the answer can be written.

That package contains: your profile (your name, your focus area, your zodiac sign, your constellation, the strength of your belief), your wish, your starting point and your first affirmation, your answers to the weekly questions, up to five favorites and three affirmations of your own, the number of pictures on your Vision Board and how many have come true (never the pictures themselves), your place in the course, the getting-to-know-you conversation, your weekly summaries and your answers from recent ritual days, including your line from the day check in. As long as you leave the setting “Let Enara read what I write” on, up to fourteen of the pages you write on your own come along, including your new moon letter, your harvest and the captions on your Vision Board. How much of it travels depends on what you are doing: in a conversation it is up to six weekly summaries, seven ritual days and ten pages; with “Ask your journal” it is up to twelve weekly summaries, fourteen ritual days and fourteen pages. Turn the setting off and none of the pages you write on your own go along, while your ritual answers still do. Whatever went into a weekly summary before you turned it off stays part of that summary.

The same service also handles the following, sometimes without you asking for it: the daily nudges, the morning and evening greetings, the suggestions for your intention in the morning ritual and Enara’s note after a ritual. Those four send the same package of context as a conversation. On the lock screen in “Private” mode, only your name goes along, nothing else. Three more features also run through Anthropic but send NO package of context, only the text itself: the getting-to-know-you conversation during setup, the optional polishing of a journal entry and “Your wish”.

Two more texts are written automatically. Once a week, after the week is over, Enara summarizes it for herself (up to 4,200 characters: each day with its intention, what was good, what moved you, what you let go of and both of your belief levels, plus the pages you write on your own that week, your new moon letter and your harvest, if “Let Enara read what I write” is on). That summary becomes Enara’s long term memory. With Enara Plus, a letter is written at the end of each month as well (up to 5,800 characters from that month’s weekly summaries, the number of days you showed up, your constellation motif, your own affirmation and how your belief moved across the weeks). Both go to Anthropic.

The same goes for the personal line on your task for today (Enara Plus): for that, your wish, your focus area, the strength of your belief and the task already set for today go to Anthropic, once a day.

• Purpose: generating the companion’s personal answers and texts.
• Legal basis: your consent, Art. 6(1)(a) GDPR, and for sensitive content additionally Art. 9(2)(a) GDPR (see section 3c).
• What Anthropic may do with it: content submitted through the programming interface is not used to train the models. According to Anthropic, inputs and outputs are deleted automatically within 30 days. Anthropic names one explicit exception: content flagged by their automated safety systems is kept for up to two years. That can affect exactly the kind of text that touches on self-harm or suicidal thoughts. A data processing agreement including EU standard contractual clauses is part of the terms of service.
• Note: Anthropic is based in the USA (see section 6 on transfers to third countries).

e) Voice input (transcription)

If you use voice recording, the recorded audio file is sent to Groq to be turned into text (Whisper transcription). The recognized text then lands in your input field, where you can edit it. We do not store this voice input recording. The sentences you deliberately record for "In your own voice" are different, see section 3g.

• Purpose: turning your speech into text.
• Legal basis: your consent, Art. 6(1)(a) GDPR, and for sensitive content additionally Art. 9(2)(a) GDPR (see section 3c).
• What Groq may do with it: For our account, storage is switched off entirely at Groq (“Zero Data Retention”). The recording and the recognized text are therefore not stored at Groq, only processed for the conversion. Without that setting it would be up to 30 days.
• Note: Groq is based in the USA and, by its own account, runs its data centers in the USA, Canada, Finland, Australia and Saudi Arabia; we do not control which location handles a given request (see section 6). A data processing agreement is in place; DP-Dock GmbH, Ballindamm 39, 20095 Hamburg, is named as the EU representative.

f) Voice message from your future self (Enara Plus)

When you ask for a voice message, it is made in two steps. First, a language model from Anthropic writes a short first person text from your wish, your life area and how firmly you believe right now (as described in section 3d). Then only that finished text goes to ElevenLabs, where it is turned into spoken audio. ElevenLabs does not receive your name, your email address or any account ID from us. The request comes from our server, not from your device, so ElevenLabs does not see your IP address either. The text never mentions you by name. Because it grows out of your wish, it can still reveal something personal, for example about your health, a relationship or money.

The finished recording and its text are kept in your private area at Supabase (Frankfurt) and as a copy on your device, so you can listen offline. The storage path starts with your account ID, and the access rules only let your own account in. You can delete each message in the app. "Start over" and deleting your account remove all of them.

• Purpose: a personal voice message that you request yourself.
• Legal basis: your consent, Art. 6(1)(a) GDPR, and for sensitive content additionally Art. 9(2)(a) GDPR (see section 3c). Without that consent, Enara does not record a message.
• What ElevenLabs may do with it: ElevenLabs files every request, text and audio, in the history of our account. Our server deletes that entry automatically a few seconds after the recording. According to ElevenLabs, this removes the text and the audio from its database right away. Technical logs for debugging and abuse checks may still hold data, and backups for up to 30 days. We have switched off the use of our content for model training in our account. ElevenLabs offers a mode with no storage at all ("Zero Retention") to enterprise customers only, which is why we delete right after each request instead.
• Note: Our contracting party is Eleven Labs Inc., New York, USA. By its own account the provider stores customer data in the USA, and a request may be processed in the USA, the EU or Singapore (see section 6). A data processing agreement including standard contractual clauses is part of the terms of service. The voice is artificially generated, no human is speaking. The app tells you so right where it happens (see also section 3j).

g) Your own voice recordings ("In your own voice")

You can record your sentences in your own voice to listen to them later, for example in the morning or before sleep. These recordings are only made when you tap record yourself. They are saved as an audio file on your device and additionally kept permanently in your private area at Supabase (Frankfurt), so they stay with you on a new phone. The storage path starts with your account ID, and the access rules only let your own account in. Your voice recordings are never sent to an AI service, never turned into text and never analyzed.

You can delete each recording individually in the app, which also removes the copy in your account. "Start over" and deleting your account remove all of them.

• Purpose: playing back your own sentences in your voice, backup and syncing between your devices.
• Legal basis: performance of a contract, Art. 6(1)(b) GDPR. A voice recording can allow conclusions about who you are; we use it solely to play it back to you.
• Processor: Supabase (see section 5).

h) Subscription, free days and purchases

Every new account gets 7 free days with full access, and no payment data is collected for that. If you complete a morning or evening ritual on five days during your first week, you receive three more free days as a one time gift. Our server checks whether that condition is met against the ritual days saved in your account, and the gifted days are recorded in your account. A subscription ("Enara Plus") is handled through Apple's App Store or Google Play. Apple and Google process the purchase and payment data under their own responsibility. Through our service provider RevenueCat we only receive the status of your subscription, never complete payment data.

• Legal basis: performance of a contract, Art. 6(1)(b) GDPR.

i) Notifications

If you switch them on, reminders and nudges are scheduled and shown on your device. For that the app needs the system permission for notifications.

• Legal basis: consent, Art. 6(1)(a) GDPR (switched on in the app and in your system settings).

j) Please note: you are talking to an artificial intelligence

Enara is not a real person. Her answers, greetings and nudges are generated by a language model. We tell you this before you speak with her for the first time, and permanently visibly in the conversation area of the app. This fulfills the transparency obligation under Article 50 of Regulation (EU) 2024/1689 (the AI Act), which applies from 2 August 2026.

Enara does not replace therapy, medical treatment or professional advice. If your words point to a crisis, she names places that can help and does not continue the coaching conversation.

How that works, and what it stores: the app checks the text you send for a fixed list of wordings that point to suicide or self harm. That check runs on our server before the language model is called, and it is the same list for everyone. Where the wording is ambiguous, Enara asks you what you meant instead of assuming. Grief, a loss, a breakup, an illness or losing a job are not treated as a crisis, and Enara stays in the conversation there.

When the check does apply, we store a short lived note that a crisis was detected, so that the protection also holds if you write again later or through another part of the app. That note contains no text of yours. It holds a pseudonymous key, the level, and a timestamp, nothing else. Neither the wording that triggered it nor any journal entry is stored, and the note is deleted automatically after twelve hours. Only our server can read it.

• Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in not answering a crisis with generated text, and Art. 9(2)(c) GDPR where the note allows conclusions about your health.
• Retention: twelve hours, then deleted automatically.

k) Contacting us

If you write to support@getenara.app, we process what you send us in order to handle your request. The mailbox is operated through Zoho (EU).

• Legal basis: Art. 6(1)(b) and (f) GDPR (handling the request, or legitimate interest in communicating with you).

l) News by email (optional)

If you turn on the switch "News by email" in the app settings, we use your email address to occasionally send you news about Enara (for example new features). We store the time of your consent as proof. Without that consent you receive no such emails from us. Pure account and contract messages (for example about signing in or about changes to the terms) are not affected by this.

• Purpose: information about news and features of the app.
• Legal basis: your consent, Art. 6(1)(a) GDPR in conjunction with Section 7(2)(2) of the German Act Against Unfair Competition (UWG).
• Withdrawal: at any time with effect for the future, directly in the app settings or by message to support@getenara.app.

m) Vision board (your photos)

In the vision board you can place your own photos. You pick them yourself from your device's media library. The app does not search your library and only sees the images you select. Every photo is scaled down before saving and stored locally on your device first. With your account, a copy is additionally stored encrypted (TLS) in your private area at Supabase, so your board stays available on your devices. The storage path starts with your account identifier, and the access rules only allow your own account in.

If you delete an image or clear the board, the app removes the copy in your account with it. If you delete your account, all photos are deleted too.

• Purpose: displaying your Vision Board, backup and syncing between your devices.
• Legal basis: performance of a contract, Art. 6(1)(b) GDPR.
• Processor: Supabase (see section 5).
• Note: your photos are not sent to an AI service and are not analyzed.

n) Sharing sentences

When you tap "Share" on a sentence, the app creates an image with that sentence on your device and hands it to your system's share sheet. Where it goes is your decision there, for example to Instagram, to WhatsApp or into your own photos. Nothing is transmitted to us and nothing is stored. Once you have picked an app, that app's privacy policy applies.

• Purpose: passing on a sentence as an image at your explicit instruction.
• Legal basis: performance of a contract, Art. 6(1)(b) GDPR.

o) App lock (fingerprint, face or your own code)

You can set Enara to ask for your fingerprint, your face or a four digit code when you open her. If you use fingerprint or face, your device checks it and tells the app only "recognized" or "not recognized". We never receive biometric data, and it never leaves your device. If you choose a code, we do not store the code itself but a check value derived from it, combined with a random value. It lives in your device's protected key store (Keychain on iOS, Keystore on Android) and is not synced to your account. On a second device you therefore need to turn the lock on again.

If you forget your code, we cannot reset it, because we do not know it. The way back is to sign out and sign in again. Your entries live in your account and stay where they are.

• Purpose: protecting your entries from other people who can already unlock your device.
• Legal basis: performance of a contract, Art. 6(1)(b) GDPR. This processing happens entirely on your device.

p) Rating in the App Store

Enara occasionally asks you for a rating, at most twice a year and only after a moment where something was finished. The dialog itself comes from Apple or Google, not from us. We do not learn whether it was shown to you, whether you rated the app, or what you wrote. The stores give us those numbers only in aggregate.

So that the app does not ask too often, it remembers on your device when it last asked and in which version. These counters stay local and are deliberately not synced to your account. Settings also holds a permanent entry, "Rate Enara", that takes you straight to the store.

• Purpose: helping other people find Enara.
• Legal basis: legitimate interest, Art. 6(1)(f) GDPR. Apple and Google are responsible for what happens inside the store itself.

q) Visiting our website (getenara.app)

Our website is served through GitHub Pages (GitHub, Inc., USA). When you visit it, GitHub processes technically necessary connection data (in particular IP address, date and time, the file requested, browser identifier) in server logs, in order to deliver the page and keep the service secure. We ourselves collect no personal data when you visit the website.

• No cookies: the website sets no cookies and uses no analytics or tracking services from third parties. A cookie banner is therefore not required.
• Counter on the download page: when you open getenara.app/laden.html, for example through a link on Instagram, the page sends two pieces of information to our server at Supabase in Frankfurt once, before it forwards you to the App Store or Google Play: which link you came from (for example vamari, or ohne_quelle without a link) and whether you use an iPhone, an Android phone or another device. The page needs the device type anyway to send you to the right store. Only these two values and the time are stored, no IP address, no cookie and no identifier. We cannot tell who you are from this, nor link individual visits together; we only see totals, such as “12 visits via Instagram on this day”. On receipt, Supabase and Cloudflare technically process connection data such as the IP address, as described in section 5. The legal basis is our legitimate interest in knowing which of our pointers to Enara are actually used (Art. 6(1)(f) GDPR).
• Your language choice stays on your device: so the site can greet you in the language you last chose, it stores a single value in your browser's local storage (enara-sprache, holding either de or en). This is not a cookie, and nothing else is stored there. That value is never sent to us, it cannot be used to recognise you across websites, and it serves no analytics purpose. No consent is required for it, because the storage is strictly necessary for the service you asked for (section 25(2) no. 2 TDDDG). You can delete it at any time in your browser settings.
• Fonts served locally: all fonts are hosted on our own web space. Visiting the site opens no connection to Google Fonts or any other font service.
• Legal basis: Art. 6(1)(f) GDPR (legitimate interest in delivering the website securely and reliably). GitHub is certified under the EU-US Data Privacy Framework (see section 6).

4. No advertising, no tracking

Enara uses no advertising networks and no tracking. That holds for the app and for the website. The only counting is the counter on the download page (section 3q): it stores only totals by link and device type and never recognises you. We only send news by email if you have explicitly consented (section 3l).

5. Service providers we use (processors)

We use carefully selected service providers. With Supabase, a data processing agreement (Art. 28 GDPR) is in place as part of the terms of service, since 1 August 2026. For the other providers, data processing is governed by their respective data processing addendum; where it forms part of the terms of service, that is stated with the provider below.

• Supabase (account, database, file storage, server functions). Server location Frankfurt am Main, region eu-central-1. Provider: Supabase, Inc., USA. Data processing including EU standard contractual clauses is part of the terms of service.
• Cloudflare (subprocessor of Supabase). Every connection between the app and Supabase passes through Cloudflare's network, which receives the requests, shields them from attacks and delivers the pictures on your Vision Board and the audio files (listening pieces, your voice recordings, voice messages). In doing so Cloudflare sees the connection data (IP address, time, requested address) and may set a purely technical cookie to protect against automated access. Cloudflare only passes the data through and secures it; your data stays stored at Supabase in Frankfurt. Provider: Cloudflare, Inc., USA, with data centers in Germany as well. The transfer relies on the standard contractual clauses Supabase has agreed with its subprocessors (see section 6).
• Resend (sending account emails: sign up confirmation, password reset, see section 3a). Receives your email address and the content of the message in question. Sent through servers in Ireland. Provider: Plus Five Five, Inc. (Resend), San Francisco, USA. Data processing including standard contractual clauses under the provider's data processing addendum.
• Anthropic (the companion’s AI answers). USA. Data processing including EU standard contractual clauses is part of the terms of service.
• Groq (voice transcription). USA. A data processing agreement is in place, EU representative: DP-Dock GmbH, Hamburg.
• ElevenLabs (the voice of the message from your future self, see section 3f). Eleven Labs Inc., USA, certified under the EU-US Data Privacy Framework. Data processing including standard contractual clauses is part of the terms of service.
• RevenueCat (technical handling and status management of the subscription). USA. Data processing including standard contractual clauses under the provider's data processing addendum, which forms part of the terms of service.
• Apple (Sign in with Apple, App Store, subscription).
• Google (Sign in with Google, Google Play, subscription).
• Zoho (email mailbox for support). EU data center.
• Expo (technical foundation of the app, app delivery).
• GitHub (hosting of the website getenara.app). USA, certified under the EU-US Data Privacy Framework.

6. Transfers to third countries (USA)

Some service providers (in particular Anthropic, Groq and ElevenLabs, possibly also Apple, Google, Supabase, Cloudflare, Resend, RevenueCat) process data outside the EU. Such transfers take place on the basis of appropriate safeguards under Art. 44 et seq. GDPR. For Anthropic, Groq, Supabase and RevenueCat those are the standard contractual clauses of the EU Commission: none of these four is certified under the EU-US Data Privacy Framework (as of 30 July 2026, checked against the official participant list). For Cloudflare (as a subprocessor of Supabase) and Resend we likewise rely on the standard contractual clauses in the respective data processing agreement; both providers additionally state that they are certified under the EU-US Data Privacy Framework. A Data Privacy Framework certification does exist for GitHub, where this website is hosted, and for ElevenLabs (Eleven Labs Inc., active since 9 February 2026, checked against the official participant list on 21 September 2026). For ElevenLabs the standard contractual clauses from the data processing agreement apply in addition. You can request a copy of the standard contractual clauses from us.

7. Storage period

We store your data for as long as your account exists and it is necessary for the purposes named above. Through the function "Start over (delete everything)" in the app you can delete your content on the device and in the cloud. If you delete your account, the associated data is deleted, unless statutory retention obligations (for example under tax law) prevent that.

8. Children and teenagers

Enara is intended for people aged 18 and over. We do not carry out a separate age check when you sign up. If we learn that an account was created by a person under 18, we delete it together with all its data. Parents and guardians who suspect such a case can reach us at support@getenara.app.

9. Your rights

Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21). You can withdraw consent you have given at any time with effect for the future (Art. 7(3) GDPR). To do so, write to support@getenara.app.

You can also exercise your right to erasure yourself and immediately: in the app under Settings, at the very bottom, with "Delete account for good". That removes your access, all entries, your photos, your own voice recordings, your voice messages, your settings and your conversation, on the device and on our server. It cannot be undone. A running subscription is not cancelled by this, that runs through your App Store account. Next to it there is "Start over", which only empties the content and leaves your account in place.

10. Right to complain

You have the right to complain to a data protection supervisory authority. The authority responsible for us is: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.

11. Changes to this privacy policy

We adjust this policy when the app or the legal situation changes. The version available here and in the app at the time applies.