Privacy
Last updated 9 August 2026
&mote is a place to keep how you feel. That only works if you can be honest in it, so this page is specific about what is kept, what we cannot read even if asked, and what never leaves your device at all. &mote is an iPhone app, and this covers it. The website is where you read about &mote, play a sample year, and see a light somebody has shared with you.
How you feel is health data, and some laws say so explicitly. What &mote holds, works out, and never does with it has its own page: consumer health data.
What &mote keeps
Your email address. There are three ways in: an email address and a password, Sign in with Apple, or Sign in with Google. We hold the address and an account identifier. If you use a password we never see it, only a hash your password cannot be recovered from, and we check it against a list of passwords known to have leaked so you are not handed one that is already public.
Your moods. For each day you log: the date, which moods you chose, and the time of each moment. This is the mosaic. It is stored on our database in a readable form. It is not end-to-end encrypted, because the year has to be assembled and synced across your devices. It is protected in transit, encrypted at rest by our host, and access rules mean no other account can read it.
Your settings. Which palette you chose, any mood names or colours you changed, the shape you chose for a day, the dates you sat down with somebody, and what you call the people you share with.
The marks you put on a moment. When you mark a moment to bring up next time you sit down with somebody, &mote keeps that you marked it, when you marked it, and whether you ticked it off afterwards.
Those last two are stored readable, like your moods, so &mote and Supabase can read them. A mark has to work while your journal is locked, so it cannot live in the vault. None of them holds what you felt or what was said: the reason you marked a moment is in your note, and your note is encrypted.
What &mote cannot read
Your journal notes, your voice recordings, and their transcripts. These are encrypted on your own iPhone, with a key derived from your passphrase, and only the encrypted result is ever uploaded. The passphrase is never sent anywhere and is never stored. What our server holds is a block of ciphertext and a wrapped key it has no way to open.
This is not a promise about how carefully we handle your writing. It is a statement that we are not able to read it. Nobody at &mote can, and neither can anyone who obtains the database, lawfully or otherwise.
The consequence is that if you forget your passphrase, your journal cannot be recovered, by you or by us. There is no reset link, because a reset link would mean we could get in.
What never leaves your device
The unlocked journal key, whether sound is muted, whether the app asks for Face ID, and whether motion is on. These describe the phone in your hand rather than your account, so they stay on it, in the Keychain.
Voice notes are transcribed where they were recorded. Never on a server, and never by a transcription service. &mote uses Apple’s offline model and refuses to transcribe over the network, so if your phone has no offline model for your language it will say it cannot transcribe rather than send your recording away.
What Health and the weather answer, if you turn either on. On iPhone, &mote can read what Apple Health already keeps, and can look up what the sky was doing over the days you kept. Both stay on the phone and neither is sent to our server. The weather is the one thing &mote asks anybody else: to look a day up it needs roughly where you are, so it takes the coarsest location iPhone offers, makes it coarser again to an area about five kilometres across, and sends that area and nothing else to Apple’s weather service. Nothing you have logged goes with it. Turning the weather off deletes what came back. The health data page has the whole of it.
What you choose to show somebody
Nothing here happens unless you set it up, and everything here can be stopped by you alone. Both need an account on both sides.
A connection. Somebody you give a code to can see one blended mote for each of your days, and can open a day to see the moments it held, in order, with the time each was kept at. Today is there too, as it happens. Nothing from before you gave them the code. No mood names you have changed, no notes, no recordings, and never the fact that a note or a recording exists at all. You can pause it or stop it at any moment, and they are not told either way.
A session you send. When you hand somebody the moments you marked, they receive the day, the mood and the time of each one, frozen as they were when you sent it. Never a note, never a recording, and never that either exists. Taking it back, or ending the connection, stops them reading it.
What you call somebody stays in your own settings. The person you share with is never shown the name you wrote for them, and neither is any other account. It is stored readable, so &mote and Supabase can read it.
What is counted
Nothing. &mote does not count which screens you open or what you do in them. If that ever changes we will ask you first, on its own screen, and it will stay off unless you say yes.
How you feel would never be counted. Not the mood, not its name, not a tally by mood, not a number standing in for one.
Who else is involved
Supabase hosts the database, sign-in, and the encrypted files. They hold what is described above, including the ciphertext they cannot read.
Vercel hosts andmote.com and collects anonymous, aggregate traffic figures for the website itself. That happens whether or not you have an account, and it is separate from the counts above.
Apple, for two things. If you sign in with Apple, Apple tells us an account identifier and an email address, and if you chose to hide your address it is a relay address rather than your own. And if you turn the weather on, Apple’s weather service receives the five kilometre area described above and nothing else.
Google, if you sign in with Google. Google tells us an account identifier and the email address on that account. Neither company is ever sent your moods, your writing or your recordings.
That is the whole list today. If &mote ever adds counting or crash reporting, this page names the company and what it receives before it starts, and no such company will ever receive your moods, your writing or your recordings.
There are no advertisers. Nothing here is sold, shared for marketing, or used to build a profile of you.
What you can do
Take it with you. Export your year, and download your journal decrypted, from Account and settings.
Erase it. “Start fresh” deletes every day you have kept. To delete your account and everything attached to it, write to privacy@andmote.com and it will be removed.
Ask. Depending on where you live you may have rights to access, correct, or erase your data, or to object to its processing. The same address reaches us.
Children
&mote is not directed at children under 13, and we do not knowingly keep data from them.
Changes
If this policy changes in a way that affects what is kept or who can read it, the date above changes and the app will say so rather than quietly updating this page.