How we handle your privacy and data

Shared responsibility

Innerya runs on managed cloud infrastructure provided by Lovable Cloud / Supabase. That platform secures the servers, databases, network, and backups. Build From Within is responsible for the application code, how data is collected and used inside Innerya, and the choices we offer you. You remain in control of the account email you use, the words you choose to reflect with, and when you delete your data.

Authentication

• Innerya uses passwordless email verification. You enter your email and confirm a one-time code we send you.
• Session tokens and verification codes are stored only as one-way cryptographic hashes in our database. The original values exist only on your device and in the email we send.
• Sessions expire after 30 days, or 90 days if you choose "remember this device".

Data collection and use

Innerya stores the reflections, journal entries, and check-ins you choose to save, along with the email you signed up with and your preferences (preferred name, language, reminder settings).

Your entries are used to generate your own personal reflections, summaries, and insights. They are not sold, not used for advertising, and not used to train third-party AI models on your behalf.

Access controls

• Row-Level Security is enabled on every table that holds your personal entries. Only authenticated server logic acting on your verified session can read or modify your rows.
• Anonymous (logged-out) access is denied by default on personal data tables.
• Admin tools used by Build From Within are protected by a separate admin key and short-lived hashed session tokens.

Subprocessors & integrations

We rely on a small set of trusted providers to operate the service:

• Lovable Cloud / Supabase — hosting, database, edge functions, storage.
• Resend — transactional emails (verification codes, exports, summaries).
• Lovable AI Gateway — language model inference for reflection and synthesis.
• Shopify — checkout for physical and digital books.
• Notion — internal subscriber and content records.

Cookies & analytics

We use only the minimum cookies needed to keep you signed in and to remember your preferences. Lightweight analytics help us understand how the site is used in aggregate. You can clear cookies and local storage at any time from your browser.

Retention & deletion

You can export your entries as a personal letter at any time, and you can request deletion of your account and associated data by writing to me@build-from-within.com. Verification codes expire within 10 minutes; expired sessions are cleared automatically.

Reporting a security issue

If you believe you have found a security vulnerability in Build From Within or Innerya, please email me@build-from-within.com with as much detail as possible. We will respond, investigate, and address valid reports as quickly as we can.

A note on certifications

Build From Within is an independent project and does not claim SOC 2, ISO 27001, HIPAA, or PCI compliance. We rely on the security posture of our cloud platform and apply the controls described above at the application layer. If you have specific compliance questions before using Innerya, please reach out.