Privacy Policy
Last updated: 9 August 2026 Version: 2026-08-09
Alpha notice. Humeur is in invite-only early access, run by one person. This policy describes what the software actually does today, verified against the source code rather than written from a template. It will be revised as the app changes, and you'll be told when it is.
The short version
- Humeur is a mood journal. You record how you're feeling; it stores that and shows it back to you over time.
- Your written notes and hospital-admission markers are encrypted on your device with a key derived from your password. I cannot read them. Nobody with access to the servers can.
- Your daily mood ratings are not encrypted. They are stored in a way that I, and the companies hosting the database, can technically read. This is the most important limitation in this document and I'd rather you know it up front than find it in section 4.
- You can use Humeur with no account at all. Nothing leaves your device in that mode.
- I don't sell your data, I don't run advertising, and I don't share your entries with anyone.
If you only read one section, read What is and isn't encrypted.
1. Who is responsible for your information
Humeur is operated by Dakotah Godfrey, a sole developer based in Ontario, Canada.
Contact: hello@humeur.dev
For the purposes of Canadian privacy law I am the organization responsible for the personal information described here. Where the European General Data Protection Regulation applies to you, I am the "controller."
2. What Humeur is, and what it is not
Humeur is a self-tracking tool. It is designed to help you notice patterns in your own mood and, if you choose, to produce a summary you can bring to a healthcare appointment.
Humeur is not a medical device. It does not diagnose, treat, or monitor any condition. It is not a substitute for professional care, and nothing in it should be read as medical advice. It is not a crisis service and nobody monitors your entries. If you are in crisis, the app links to crisis resources for your region — those are third-party services, not Humeur.
3. What is and isn't encrypted
This is the section that matters most, so it's precise.
When you have an account, each day's entry is stored as a record containing several fields. They are not all protected the same way.
Encrypted on your device — I cannot read these
| Field | What it is |
|---|---|
note | The free-text note you write about a day |
admission | The marker indicating a hospital admission |
These are encrypted in your browser using AES-GCM, with a key that is itself encrypted using a key derived from your account password (PBKDF2). The password never leaves your device, and neither does the decryption key. What reaches the server is ciphertext that is useless without your password or your recovery code.
Consequence you must understand: if you lose _both_ your password and your recovery code, these fields are permanently unreadable. Not difficult to recover — impossible. I cannot reset them, restore them, or retrieve them, because I never had the ability to read them in the first place. This is a deliberate design choice, and it is the direct cost of the protection it provides.
Not encrypted — technically readable by me and by service providers
| Field | What it is |
|---|---|
am, pm | Your morning and evening mood ratings (a value on a seven-level scale) |
entry_date | The date the entry belongs to |
shareNote | Whether you flagged a note for inclusion in a printed summary |
updated_at | When the row last changed |
| Profile fields | Display name, pronouns, theme, preferred calendar view |
| Account fields | Your email address, and when the account was created |
Your mood ratings are stored in readable form so the app can draw calendars and compute averages without decrypting every row. That is a real engineering trade-off, and it has a real privacy cost: someone with database access could see that a specific email address rated their mornings low for a sustained period. For a tool used by people with mood disorders, that is sensitive information.
I do not access this data as a matter of practice, and I have no analytics or reporting built on top of it. But "I don't" is a weaker promise than "I can't," and I'm not going to blur the difference.
Planned change: encrypting the mood ratings as well is on the roadmap. When it ships, this section will be updated and you'll be notified. Until then, treat your ratings as data I could read.
4. Using Humeur without an account
Selecting Continue Locally gives you the full app with no account.
In this mode your entries and profile are stored only in your own browser's local storage. Nothing is transmitted to any server. There is no account, no sync, and no copy anywhere but the device you're holding. Clearing your browser data deletes it permanently, and I have no way to recover it.
If you later create an account, Humeur will ask whether you want to import that local history. It's a question, not an automatic transfer, and declining leaves the local data untouched.
5. What is collected, and why
Information you give me
| What | When | Why | Legal basis (GDPR) |
|---|---|---|---|
| Email address | Account creation | To identify your account, send the confirmation code, and reset a password | Contract |
| Password | Account creation | To authenticate you, and to derive your encryption key | Contract |
| Mood entries and notes | As you record them | To provide the service | Contract |
| Display name, pronouns, preferences | If you choose to set them | To personalize the interface | Contract |
| Consent record | At signup | To evidence that you agreed to these terms, and which version | Legal obligation |
Mood data is health-related information. Under GDPR it is special category data under Article 9, processed on the basis of your explicit consent. Under Canadian law it is sensitive personal information requiring express consent. That consent is what the checkbox at signup records, and you can withdraw it at any time by deleting your account.
Information collected automatically
| What | Source | Purpose |
|---|---|---|
| Page views, performance metrics | Vercel Analytics | Understanding whether the app is working and being used. Aggregate, and not linked to your entries |
| Approximate country | Request headers, via the hosting provider | Showing crisis resources relevant to your region |
| Bot-detection signals | Cloudflare Turnstile, on auth forms only | Preventing automated account creation and abuse |
| Server logs | Hosting providers | Diagnosing failures and security incidents |
Humeur does not use advertising trackers, third-party marketing pixels, or cross-site tracking cookies.
Cookies and local storage
| Name | Purpose | Lifetime |
|---|---|---|
| Supabase auth cookies | Keeping you signed in | Session, refreshed automatically |
humeur-guest | Remembering you chose to continue without an account | 30 days |
humeur:theme, humeur:preferred-view | Interface preferences | Until cleared |
| Guest entries and profile | Local-only journal data | Until cleared |
| Trusted-device key (IndexedDB) | Skipping the password prompt on a device you marked as trusted | 30 days, then automatically discarded |
The trusted-device entry holds your decryption key on that device. It survives signing out — deliberately, since signing out and un-trusting a device are different actions. Don't mark a shared or public computer as trusted.
6. Who else can see your information
I don't sell your data, share it with advertisers, or disclose it to anyone for their own purposes. The following companies process data strictly to make Humeur work:
| Provider | What they handle | Where |
|---|---|---|
| Supabase | Database and authentication — your account, encrypted notes, and unencrypted mood ratings | United States (AWS, us-east-1) |
| Vercel | Application hosting and analytics | United States, with a global edge network |
| Resend | Sending invite, confirmation and password-reset email | United States |
| Cloudflare | Bot protection on authentication forms | Global |
| Geoapify | Finding healthcare providers near a location, only when you use that feature | European Union |
Provider search: when you search for care providers, the coordinates you supply — either from your browser's location permission or from a place you type — are sent to Geoapify to find nearby results. This happens only when you actively run a search. Your mood data is never sent with it, and Humeur does not store your location.
Cross-border transfers. Your data is stored in the United States, which means it may be accessible to US authorities under their laws. If you are in Canada, this is disclosed to you under PIPEDA. If you are in the EEA or UK, transfers rely on the providers' Standard Contractual Clauses.
Legal disclosure. I would disclose information if legally compelled by a valid order. I would tell you unless prohibited from doing so. It is worth noting that for encrypted fields, compliance would produce ciphertext I cannot decrypt.
7. How long things are kept
| Data | Retained |
|---|---|
| Account and entries | Until you delete them |
| Deleted data | Removed immediately from the live database; may persist in provider backups for up to 30 days |
| Invite records | Kept after redemption as a record of consent |
| Server logs | Per provider defaults, typically 30 days |
| Local-only (guest) data | On your device until you clear it. I never receive it |
8. Your rights and how to use them
You can access, correct, export, and delete your information. Two of those are built into the app and don't require asking me:
- Export — Settings → Export produces a copy of your entries, decrypted, in a portable format. Available without a paid plan, always.
- Delete — Settings offers two options: erase your entries but keep the account, or delete the account and everything in it. Deletion is immediate and irreversible.
For anything else — access requests, corrections, objections, or a complaint — email hello@humeur.dev. I'll respond within 30 days, as Canadian law requires.
If you're in the EEA or UK you also have rights to restrict or object to processing, and to data portability. If you're in Quebec, Law 25 gives you additional rights including data portability and the right to be informed of automated decisions — Humeur makes no automated decisions about you.
Complaints. In Canada you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca). In the EEA or UK you may complain to your national supervisory authority.
9. Security
- Notes and admission markers are encrypted before leaving your device.
- All traffic uses HTTPS.
- Database access is restricted by row-level security, so one account cannot read another's rows.
- Passwords are stored as salted hashes by Supabase Auth. I never see your password.
- Administrative database credentials are held server-side only and are never exposed to browsers.
No system is perfectly secure. If a breach occurs affecting your information, I will notify you and the Office of the Privacy Commissioner of Canada as required, without undue delay.
If you find a security problem, email hello@humeur.dev. I'd rather hear it from you than from an incident.
10. Children
Humeur is not for anyone under 16. I don't knowingly collect information from children under 16, and will delete any such account on discovery.
11. Changes
If this policy changes materially — particularly anything affecting what is encrypted or who receives your data — I'll notify account holders by email before it takes effect. The version identifier at the top is recorded against your consent so it's always possible to tell which version you agreed to.
12. Contact
Dakotah Godfrey — hello@humeur.dev
A real person reads that address.