Oracle — Privacy Policy
Effective date: 3 November 2026
At a glance
Oracle is a goal-oriented AI journaling service. You can record your goals, plans, actions, reflections and progress; Oracle uses this material to suggest plans and help you review your progress. Your journal content is personal, and some entries may include sensitive information.
- We use journal content and relevant earlier entries to provide the AI features you request.
- We use service providers to host Oracle, handle authentication, process AI requests and manage subscriptions.
- Payment details are collected by our payment provider, Stripe; Oracle receives the subscription and payment-status information needed to administer your plan.
- We do not offer your journal entries for sale or targeted advertising.
- You can request access to, export or deletion of your information, subject to applicable law and technical retention limits.
1. Who operates Oracle and how to contact us
Oracle is operated as a UK sole-trader business under the trading name Oracle. The sole trader is the data controller.
For privacy enquiries, requests to access, correct or delete information, or complaints, contact contact@postonomy.net. This mailbox also handles Oracle billing and support enquiries.
This policy applies to the Oracle website, account, journaling and AI features and related subscription and support activities. It does not cover third parties' own websites or services, which have their own policies.
2. Information we collect
Information you supply. We may process your email address, authentication and account information, support messages, and the material you choose to put into Oracle, including goals, success criteria, baseline descriptions, timeframes, milestones, plans, tasks, daily reflections, journal entries, corrections and descriptions of outcomes or obstacles.
Information Oracle generates. Oracle may create AI-generated summaries, suggested actions, observations, progress events, insights, weekly reviews, and associations between your entries. These outputs can be imperfect; they are not independent proof that something happened.
Subscription information. If you begin a free trial or subscribe, we receive identifiers and status information from Stripe, such as a customer reference, subscription/trial status, renewal and cancellation details, and payment or invoice status. Stripe collects and handles card information in its checkout services. We do not intend to store complete card numbers or card security codes in Oracle's application database.
Technical and usage information. Hosting and authentication services may process IP addresses, device/browser information, timestamps, log-in events, security events, request diagnostics and essential session identifiers. Oracle may store limited internal feature-use events needed for its operation and troubleshooting.
Before account registration. Oracle may create an anonymous/guest account to preserve onboarding progress.
3. Sensitive journal information
Your entries may reveal information about your physical or mental health, beliefs, sexual life or orientation, or other subjects protected by privacy law. Oracle is designed for personal goal reflection, not for collecting medical records or making clinical diagnoses, but we recognise that users may choose to describe sensitive experiences.
When information qualifies as special-category personal data under UK GDPR, we will only process it where we have identified a valid Article 6 lawful basis and an applicable Article 9 condition. For AI-assisted journal processing, Oracle asks for separate, explicit, affirmative consent before saving journal material for that purpose. The consent wording and timestamped decision history are recorded against the user's account. Consent can be withdrawn in Settings; withdrawal prevents new journal processing and AI generation, but does not retroactively undo processing already completed or automatically delete existing journal history. You can export or request deletion of that history. This consent does not replace our need to identify an Article 6 lawful basis and correctly apply an Article 9 condition for the particular information and purposes involved. Merely writing sensitive material in a journal or accepting general Terms is not, on its own, a reliable substitute for explicit consent.
We will not use sensitive journal content for advertising or sell it to data brokers.
4. How and why we use information
We use personal information for the following purposes and identify an appropriate lawful basis for each where UK GDPR applies:
| Purpose | Typical information | UK GDPR basis — subject to final operator review |
|---|---|---|
| Create and secure accounts; remember sessions | Account identifiers, email, security/session records | Performance of a contract; legitimate interests in account security |
| Save and display your journals, goals, plans and progress | User-provided content and stored history | Performance of a contract |
| Provide AI goal suggestions, reflection analyses and reviews | Relevant user entries, goals, historical context and generated outputs | Performance of a contract for ordinary personal data; explicit consent is requested for AI journal processing involving special-category data, subject to applicable legal requirements |
| Administer trials, payments, cancellation and support | Stripe references, account and subscription metadata | Performance of a contract; legal obligations for required financial records |
| Prevent misuse and diagnose service problems | Limited diagnostics, usage and security records | Legitimate interests in protecting the Service, subject to a balancing assessment |
| Comply with applicable law and respond to valid requests | Relevant account, transaction and correspondence records | Legal obligation; legal claims where applicable |
| Send optional marketing, if introduced | Email and marketing preferences | Consent or another lawful basis only where the relevant marketing rules permit it; an opt-out where required |
We do not intend Oracle's suggestions or progress assessments to make solely automated decisions that have legal or similarly significant effects on users.
5. How AI uses your journal content
Oracle uses the OpenAI API to generate relevant suggestions, reflections and reviews. To do this, Oracle may send the text of your current entry, goal or task, relevant earlier journal material, approved plans and other context needed for the requested analysis. This may include names or sensitive details you wrote in your entries; we do not promise that everything is anonymised before it is sent.
Oracle's inspected API integration requests processing with store: false, which limits persistent application-state storage for supported API features. However, this setting is not a Zero Data Retention (ZDR) agreement and does not itself eliminate provider abuse-monitoring records. OpenAI's published API data-controls policy states that API inputs and outputs are not used for model training by default unless the API customer opts in, and that standard abuse-monitoring logs may be held for up to 30 days, with exceptions.
The generated material is stored in Oracle when needed to show you your progress and provide personalised later insights. AI output can be inaccurate or speculative and should be checked by you.
We do not claim that Oracle is end-to-end encrypted, HIPAA compliant, independently audited, or covered by a provider-specific ZDR arrangement unless such a claim is independently verified.
6. Organisations that help provide Oracle
We use or plan to use the following providers for the indicated purposes:
| Provider | What it does | Personal information likely involved |
|---|---|---|
| Supabase | Account authentication and hosted PostgreSQL application data | Account, session, journal and generated data stored for the Service |
| Vercel | Hosts the web application and server-side functions | Network/security logs and information processed in service requests |
| OpenAI | AI generation and text analysis | Relevant user content and context submitted for AI features |
| Stripe | Checkout, subscription management, invoices, payment processing and fraud prevention | Customer/billing references, subscription and payment information |
| Transactional email provider (where used) | Verification, recovery and service messages | Email address and essential message content |
We may share information with professional advisers or competent authorities where reasonably necessary and lawful, or in connection with a lawful business transfer, subject to appropriate protections. We do not sell personal journal entries or supply them to advertising networks.
7. Cookies, sessions and similar technologies
Oracle uses essential cookies and browser storage to maintain signed-in sessions, preserve necessary state, protect accounts and support the journaling experience. The inspected server-side identity implementation uses Secure, HttpOnly and SameSite session cookies for hosted production.
We have not identified a separate advertising-tracking implementation in the inspected application source. If we add non-essential analytics, advertising pixels or comparable tracking, we will update this notice and request consent where required before activating those technologies.
You can adjust cookies in your browser, but blocking essential storage may prevent account access or make parts of Oracle unavailable.
8. International transfers
Oracle's primary Supabase database is hosted in the London (eu-west-2) region. Other providers supporting Oracle may process information outside the United Kingdom, including in the United States or other regions. The exact regions and applicable contractual protections vary by provider and deployment configuration. Where UK GDPR requires it, international transfers must be covered by an applicable adequacy arrangement or appropriate safeguards, such as an International Data Transfer Agreement or relevant addendum to standard contractual clauses.
9. How long we keep information
We generally retain account information, journal entries, earlier journal revisions, goals, plans and generated analysis while your account remains active and you want your history preserved. Cancelling an Oracle Plus subscription is not the same as deleting your account or journal history. You may still be able to view or export stored information after your paid AI access ends.
If you request account deletion, we will process that request in line with applicable law, subject to verification and necessary exceptions. Active application data, authentication records, payment records, diagnostic logs and provider backups may have different deletion schedules. Some invoices, financial or fraud-prevention records may be retained for applicable legal requirements. The deletion of a journal from Oracle's active database does not necessarily remove a prior provider abuse-monitoring log or backup immediately.
10. Security and access
We use technical and organisational measures intended to protect Oracle, including HTTPS connections, access-controlled databases, server-side authentication, separation of runtime roles and restrictions that aim to keep one user's records separate from another's. Access to account content should be limited to people and providers with a legitimate operational need and appropriate permissions.
No system can be guaranteed completely secure or continuously available. We do not claim that stored content is inaccessible to every system administrator, or that Oracle has undergone an independent security audit.
11. Your privacy rights
Depending on applicable law, you may have rights to be informed about personal data processing, access your data, request correction or deletion, restrict or object to certain processing, obtain a portable copy of qualifying information and withdraw any consent on which processing relies. Withdrawal does not make earlier lawful processing unlawful, but may prevent continued provision of features requiring that data.
Oracle provides an account-linked export mechanism for user data. You can also contact contact@postonomy.net about requests. We may need to verify your identity before disclosing or deleting account information. In the UK, you can complain to the Information Commissioner's Office (ICO) at https://ico.org.uk/.
12. Children
Oracle is intended for adults aged 18 or older. We do not knowingly offer accounts to children. If we discover a child has provided personal data without an appropriate legal basis, we will take appropriate steps consistent with law.
13. Changes to this policy
We may update this Privacy Policy as Oracle changes or legal requirements develop. We will publish an updated version with its effective date and provide additional notice where required for material changes. An update will not remove legal rights already held by users.
14. Contact
Privacy and deletion enquiries can be sent to contact@postonomy.net. Oracle is the trading name, not a separate legal entity.