Version 2026-11-05. Personal beta without AI.
Momenira is provided by Annatola AB, company registration number 556908-7553, Kadettgatan 5, 113 33 Stockholm, Sweden.
Contact legal@avbystrom.com about personal data or your rights, and support@momenira.app for help with the app.
Momenira is a private journal for your meditation practice and your own experiences. This early version is available to at most five personally invited participants. Registration does not activate AI analysis.
We process your email address, account identifier, information needed for sign-in and your access to the service to create and administer your account and send necessary account emails. Our legal basis is performance of the contract, GDPR Article 6(1)(b). Your email address is required for sign-in; we cannot provide the account without it.
You choose what to record, such as intentions, meditations and routines, reflections, feelings, experiences, check-ins and your own letters. We store your choices, settings and related dates and times to show your history and the summaries available in the basic service. For days without meditation we store the date, time zone and recording time. The reason, a custom Other reason and a note are optional. You may record just the date.
The basic service you request relies on Article 6(1)(b). Your content may also reveal special categories of personal data about you, such as health or religious or philosophical beliefs. We process this information in the journal only after your separate explicit consent under Article 9(2)(a), given separately from the terms of use. Avoid identifiable sensitive information about other people; your consent does not cover them.
If you contact us, we process your contact details and what you provide to help you with the service under the contract. When handling rights requests, we process necessary information to comply with our legal obligations under Article 6(1)(c). Include only private information needed for your request.
We do not use the content of your journal for advertisements, marketing or technical tests. This beta does not send your journal to an AI provider. We count limited app usage and technical errors without journal text or personal event trails. See the separate app statistics information. Any future AI processing requires separate information and a separate active choice before it begins.
We store the meditation’s date, time zone and actual start time, if provided, to show it on the correct local day and time, including when you travel. When you start the timer, the time zone is obtained automatically from your device. When logging a meditation afterwards, you enter the date and may enter the actual start time and the time zone where you meditated. The start time is optional. Even without a start time, the suggested device time zone may be stored with the date; no start time is created, and the meditation is excluded from time-of-day comparisons.
For older timer sessions without a time zone, Swedish time, Europe/Stockholm, is used as an assumption. This is not a measured record of where you were and may be incorrect if you meditated in another time zone. A time zone is not GPS or a precise location. This feature does not continuously track your location or time zone.
Supabase provides the database and email-based authentication. The primary database is in Stockholm. Scaleway provides the app server in Paris and sends necessary account emails from account@momenira.app. Support emails are handled through Google Groups. When you email support, your address and message are therefore also processed there. You do not need to include journal content in a support request.
Providers process information needed for their tasks. Your records are not published to other participants. Authorised operational, security and support access must be limited to what the task requires. The database's location in Stockholm does not by itself mean that all provider access, logs and copies remain in Sweden or the EU/EEA.
Supabase's contracting entity is Supabase Pte. Ltd. in Singapore, and support and operational access may take place from countries including the United States. Its data processing agreement incorporates European Commission standard contractual clauses for transfers requiring those safeguards. See Supabase's DPA and subprocessor list.
Scaleway services are used here in France. Its DPA governs notice and safeguards for any transfer outside the EU, including standard contractual clauses where required. See Scaleway's contracts and subprocessors.
Google Workspace may process support emails globally, including in the United States. Google's published transfer terms specify the EU–US Data Privacy Framework for transfers to and onwards from the US and standard contractual clauses for other transfers where required. See Google's DPA, transfer safeguards and subprocessors. Contact legal@avbystrom.com for information or a copy of relevant safeguards.
Your account and journal are stored for your continued use. Closing registration does not itself close your account or erase your history. You can delete your own records, export your data and request account closure. Automatic technical test cleanup must not delete your real information.
You may withdraw journal consent at any time under Me → Privacy by choosing “Withdraw and request erasure of all journal content”, or by emailing legal@avbystrom.com. Withdrawal covers the whole journal. Further processing covered by the withdrawal stops and content without another valid basis is erased. Your account and rights remain available. New consent does not restore erased content. Export is optional and is not a condition for withdrawal, erasure or account closure. Withdrawal does not affect the lawfulness of earlier processing.
Deletion from the active database and expiry from backups are separate steps. A pending erasure does not mean every copy has been removed. Information that must be kept on another legal basis must be limited to what is needed for that purpose.
Supabase Pro takes daily database backups with a rolling seven-day window under the current standard service. Deleted content may therefore remain in a segregated backup until it rotates out. Any restoration must respect erasure already requested before data is used again. This does not allow active database erasure to be postponed for seven days.
Necessary technical connection and error information is processed to prevent abuse and detect and resolve operational and security failures. The legal basis is our legitimate interest in protecting the service and your information under Article 6(1)(f). The receiving server at Scaleway rotates its access and error logs daily with 14 rotations. Supabase Pro's standard retention for API and database logs is seven days. This is not a promise that all provider information or security evidence is deleted after seven days.
Scaleway's account email service processes recipient addresses, messages and delivery metadata to send necessary account emails and protect delivery. Under its current service rule, delivery metadata and logs remain for as long as the sending domain is active. Erasure of specific addresses and delivery records can be requested separately from the provider; contact legal@avbystrom.com for help. Message bodies are processed until delivery processing ends, with separate periods for failures and spam handling. See Scaleway's current email privacy policy.
Support and rights requests are retained during handling and afterwards only to the limited extent needed to document action, meet a specific legal obligation or handle an actual legal claim. Consent evidence contains the information, version, time and action needed to show consent or withdrawal. This evidence is not permission to retain journal content that must be erased. On an erasure request we separately assess what genuinely needs to remain and why, and inform you of any applicable exception.
You can request access and a copy, rectification, erasure and restriction. You may have rights to data portability and to object to processing based on legitimate interests, subject to GDPR conditions. These rights do not require Pro.
Contact legal@avbystrom.com. We normally respond within one month and tell you if a permitted extension is needed and why. We may need to verify your identity proportionately. You can complain to the Swedish Authority for Privacy Protection, https://www.imy.se/, or another competent supervisory authority.
This beta does not make solely automated decisions producing legal or similarly significant effects on you. We inform you of material changes in processing. Revised information does not itself constitute consent to a new purpose.