Random Unit
ItsJustMe Employer

ItsJustMe Privacy Policy

Last updated: 6 October 2026

ItsJustMe is a personal-timeline app for Android and the web. You build your life story from entries called "neurons" (goals, memories, beliefs, values, skills, hobbies, jobs, places, and people such as family, friends, partners and pets), each with a title, description, dates and optional photos, videos or voice recordings. The entries are shown as nodes in an explorable neural network on a timeline, and you can connect them. There is also a messenger and a voice assistant. This policy explains what information the app handles and what choices you have. Other pages: Terms of Service and Data deletion.

1. Who we are

The controller of your personal data is Rando Udris, trading as RandomUnit, Lääne 3, 50605 Tartu, Estonia. Email: randomunitsupport@gmail.com. We have not appointed a data protection officer; this email is the contact for all data requests.

2. What data we collect

Account

Email address, username, birthdate (asked at first login and used to place your entries on the timeline), an "About me" text, an optional uploaded profile picture, your privacy settings and your storage-mode choice. Passwords are stored only as a salted hash (bcrypt). Accounts created with Google have no password until you add one in settings.

Sign-in with Google

From Google we use your name, email address and Google account id. We do not use your Google profile picture, contacts or birthday, and we never see your Google password.

Timeline entries

Titles, descriptions, dates, names of people and places, and optional images, videos and audio. These can be sensitive, for example beliefs, values, relationships, memorials and health-related memories, and they can describe other people (see section 12).

Storage mode

You choose. In cloud mode your entries are stored on our server. In local mode your entries stay only on your device and are never sent to us; your account itself is still stored on our server.

Messaging

Friends and friend requests, chat requests, one-to-one and group chats and invitations, messages (text, images, video, voice), polls and votes (votes can be anonymous), read receipts, typing and online status (you can hide online and typing status), and muted or archived chat preferences.

Notifications

A push-notification token for each device (Firebase Cloud Messaging), only if you allow notifications.

Technical and security data

Login sessions store your IP address and device or browser type for the life of the session (30 days) and are kept until your account is deleted. Separately, our server keeps request logs: one line per request with the time, method, path (no query string), status, duration and, when you are signed in, your account's opaque id. Errors are logged with a stack trace. We do not log your IP address in these logs, and we never log passwords, tokens, request bodies, message text, timeline content or voice-assistant content. If you turn on two-factor authentication, we send a 6-digit code by email and store trusted-device tokens in hashed form.

Logs you send us

In Account Settings, "Send logs to developers" lets you upload the app's technical log. It holds errors, failed requests and notification set-up only, never messages or entries. You confirm each time and nothing is sent automatically. It is stored with your account id and device type.

3. Why we use it, and the legal basis

  • Running your account, timeline and messenger: performance of a contract (GDPR Art. 6(1)(b)).
  • Security, abuse prevention and logs: our legitimate interest (Art. 6(1)(f)).
  • Push notifications and the voice assistant: your consent (Art. 6(1)(a)). You can withdraw it at any time by turning off notifications or not using the microphone.
  • Sensitive entries (beliefs, relationships, health, memorials; Art. 9): we process these only on your explicit consent, which you give by choosing to write such entries. You can withdraw it by deleting the entry or your account.

We do not sell personal data, do not use it for advertising, and do not use your timeline content to train AI models. We do no profiling and make no automated decisions with legal effect.

4. The voice assistant

You tap the microphone button and speak. Speech-to-text is provided by Google (the Android speech recognizer or your browser's built-in speech API), and your audio may be sent to Google for recognition under Google's own terms. The resulting text is sent to our own server, where a language model that we run ourselves (Ollama, on our hardware) turns it into a draft entry. The text is not sent to any outside AI service and is not used to train AI models. We do not store or log what you say to the assistant. An entry is saved only if you confirm it at the end. Spoken replies use your device's or browser's built-in text-to-speech.

5. Where data is stored

Our backend and database run on our own server (located in Estonia), reached through Cloudflare, which carries traffic between the app and our server and may host the web app. The server is not hosted on Cloudflare's infrastructure. In local mode your entries stay on your device. Timeline entries, messages and stored media are encrypted by the application (AES-256) before storage, and the whole database is encrypted at rest.

6. Who we share it with

  • Google: Firebase Cloud Messaging (push notifications), and sign-in and speech recognition if you use them.
  • Cloudflare: carries traffic between the app and our server and may host the web app.
  • Google (Gmail): sends verification, two-factor and password-reset emails.
  • Authorities, when required by law.

Google API Services User Data Policy

ItsJustMe's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements. Information from Google is used only for signing you in.

7. International transfers

Google and Cloudflare may process data outside the EU/EEA. Where they do, transfers rely on safeguards such as the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.

8. Cookies and local storage

The web app stores data in your browser (local storage or secure storage, and a service worker for push notifications) for sign-in sessions and settings. These are strictly necessary for the app to work. The app shows no advertising and uses no analytics or tracking cookies.

9. Retention

We keep your account data while your account exists. You can delete your account instantly inside the app, or by email, in which case we delete it within 30 days (see Data deletion). Deleting your account removes your timeline entries, friends, chats, sessions, push tokens, profile picture and media from one-to-one chats. Messages you sent in group chats are not removed and remain visible to the other group members; you can delete individual messages before deleting your account.

Server logs and logs you chose to send are deleted automatically after at most 30 days, and we use them to diagnose faults and secure the service (legitimate interest). Deleting your account does not remove log lines already stored; they expire within 30 days. Cloudflare keeps its own logs under its own policy. We keep backups of the database for up to 30 days, so deleted data may remain in backups for up to 30 days before it is overwritten.

10. Security

We use HTTPS in transit, application-level encryption and database encryption at rest, hashed passwords and sign-in tokens, rate limiting on sign-in and codes, and optional two-factor authentication. No system is perfectly secure. If a breach affects you, we will notify you and the Estonian Data Protection Inspectorate as the law requires (the authority within 72 hours).

11. Your rights

You have the right to access, correct, erase, restrict, object to and port your data, and to withdraw consent. In the app you can edit your profile, change username, email, birthdate and About me, upload or remove a picture, control privacy settings (searchable, show online status, show avatar to friends, notify on friend requests) and delete your account. For anything else, including a copy of your data, email us and we will answer within one month. You may complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee).

12. Other people's data

Entries can mention other people, such as family members, friends, exes, children or pets, including names and birth or death dates. Only add what you are comfortable sharing. Each entry has a visibility setting that controls who can see it. Anyone mentioned in an entry can email us to ask for it to be removed.

13. Age

ItsJustMe is meant to be suitable for all ages. In Estonia, a child under 13 needs the permission of a parent or guardian before we can process their personal data, so younger children should only use the app together with, and with the permission of, a parent or guardian.

14. Changes to this policy

We will update the date above whenever this text changes and will notify users of significant changes.

15. Contact

randomunitsupport@gmail.com, Rando Udris / RandomUnit, Lääne 3, 50605 Tartu, Estonia.