Version 3 — in force on 3 November 2026. En français
Archea is a private journal. This document says exactly what we keep, who we entrust it to, and what we can read of it — which is nothing.
Your pages are encrypted on your phone before they leave it, with a key that never leaves your devices. We host data we are technically unable to read.
This is not a promise not to look. It is a property of how the application is built: we hold nothing that could decrypt anything.
Rhincodon Development OÜ (registration in progress), a company incorporated under Estonian law.
Until registration is complete, Archea is published by Sam Henrotay, independent developer, who remains the person you deal with. On the day of registration, the two lines above will be filled in and the version number at the top of the page will change: you will therefore know the exact date on which the publisher changed.
That company is, or will be, the data controller within the meaning of the GDPR. The undertakings in this document do not change with it: they hold because of the way Archea is built.
Your pages, your notebooks, the sentences in your coffer and your settings are first saved in the application's private storage, unencrypted, on your device. That is where you read them, and it is what lets you write without a network.
They leave it encrypted, towards your account, so that you find them again elsewhere. Uninstalling the application erases the local copy; the server's copy remains, and you find it again by signing back in.
This consequence is worth knowing: a backup of your phone — iCloud, or a copy made from a computer — therefore contains that local copy, readable. The key is not in it: it is held in the device's keychain, which is not backed up and cannot be restored elsewhere. In other words, what we host stays unreadable to us, but anyone who obtained an unencrypted backup of your phone could read your pages. Encrypting the local copy as well is work still to be done, and we would rather write it here than let you find out.
| Data | Why | Readable by us |
|---|---|---|
| Your email address | Identify the account, confirm the address, write to you if needed | Yes — and if you enter through Apple and choose to hide it, what we see is Apple's relay address, never yours |
| A fingerprint of your secret phrase | Check that it is you, without keeping the phrase | No — it is a one-way fingerprint |
| Your pages, encrypted | Give them back to you on your other devices | No |
| An identifier, a kind, dates, a size | Know what to send, and in what order | Yes |
| Your encryption key, itself sealed | Let you reopen your pages on another device | No — we have nothing that unseals it |
You can open your account, or enter it, with Apple or with Google rather than with an address and a password. Apple or Google then learns that you use Archea, and passes us an identity token — a signed proof that this account is yours. We see only what you agreed to let us see: an address, and a name if you gave one.
Apple lets you hide your address: we then receive a relay address at
@privaterelay.appleid.com, and the mail we send there reaches
you without our knowing where.
This path concerns entry only. Neither Apple nor Google receives anything from your pages, and neither holds your secret phrase: it does not leave your phone, and it alone opens the vault. Entering through a third party therefore never replaces the phrase.
You can write to one of Archea's four voices and receive an answer. It is one of the three things in this application that leave your phone unencrypted — the other two are a dream reading and the weekly Mirror, below. It leaves only if you have agreed: a screen asks before the first time, and you can go back on that agreement at any moment in the settings.
What leaves:
Nothing else: not your pages, not your other notebooks, not your first name. A voice does not read your journal.
A voice's notebook is written by the model from what you entrusted to it, then encrypted on your phone like the rest. You can read it and erase each item, voice by voice, inside the application.
Everything that leaves passes through our servers, then through those of Anthropic, an American company whose model we use. Anthropic trains no model on what we send it or on what it answers — that is its contractual commitment for the service we use. This text is, however, kept for up to thirty days, then deleted.
Your conversations themselves stay encrypted on your phone like the rest of your pages.
We do not read them either. Our server passes things on and keeps nothing — not even a trace of what was said. It only counts how many times you have spoken, or had a dream read, within the month, to hold the allowance — two hundred exchanges a month. Archea is free today and contains no purchase: that count only bounds the spending.
You can ask for a reading of a dream from your notebook, in the manner of Jung. This is the second thing that leaves your phone unencrypted, and it asks for its own agreement: having agreed to speak with the voices does not agree to your dreams being read. A screen asks before the first reading, and you can go back on it at any moment in the settings.
What leaves:
What does not leave: your pages, your other notebooks, your conversations with the voices, and dreams older than a month, except what the thread kept of them. The readings themselves never leave again: they come back to your phone, and each new reading starts from the images, never from what was concluded before.
The text follows the same path as for the voices — our servers, then Anthropic's — where it is kept for up to thirty days, then deleted, and trains no model. The reading comes back and is stored encrypted in your notebook, with the dream. The thread of images stays on your phone: it does not join your account, and you can read it and erase it, image by image or entirely.
Each week, when it ends, the Mirror has your pages read, without your asking for anything. It is the only thing in Archea that leaves that way, without a gesture from you.
That is exactly what the Mirror's agreement asks, and it is distinct from the other two: having agreed to speak with the voices, or to have your dreams read, does not agree to your pages leaving every week. The question is asked the first time the Mirror opens, and you can go back on that choice at any moment in the settings.
What leaves, each week:
What does not leave:
These pages follow the same path as for the voices — our servers, then Anthropic's, in the United States — where they are kept for up to thirty days, then deleted, and train no model. The reading comes back encrypted, and follows you from one device to another like your pages.
So that a week is not read twice, our server remembers which week has already been read for your account — a year and a week number, nothing else. Without this agreement the Mirror still exists: it shows what the phone counts on its own, and nothing leaves.
Your secret phrase never reaches us. On your phone it computes two distinct things: an authentication secret, which the server receives, and an encryption key, which stays with you. Neither allows the other to be found.
Your pages are encrypted with that key before being sent. What the server stores is a run of bytes meaningless to anyone who does not hold your phrase.
The cost is real, and we prefer to write it here: if you forget your secret phrase, your pages are permanently unreadable. We cannot recover them. There is no fallback procedure, and there cannot be one: a door for us would be a door for anyone.
Since October 2026 you can make a card from a dream already read: an image you share wherever you like. It does not go through our servers — your phone draws it, and hands it to the application you choose.
What it carries:
What it never carries: the text of your dream, your first name, the date, and any sentence you did not elect yourself. We do not know that a card was made, nor what it said.
We do not read your pages, but the server knows that an account exists at your address, how many items it holds, of what kind — journal page, notebook, dream, coffer sentence — and on what dates they were written or changed. Conversations with the voices, their notebooks and the Mirror's weeks are part of this: the server knows they exist and when they change, never what they say. We do not exploit this information, but we hold it, and pretending otherwise would be false.
| Provider | Role | Where |
|---|---|---|
| Supabase | Hosting of the database and of authentication | Ireland |
| Resend, and Amazon SES | Sending the address confirmation message | Ireland |
| Expo | Application updates; sees the IP address during a check | United States |
| Apple | Distribution of the application, crash reports if you allowed them, and “Continue with Apple” if you enter that way | Per Apple |
| “Continue with Google”, if you enter that way — and only then | Per Google | |
| Anthropic | The model that makes the voices speak and that reads dreams, if you enter a conversation or ask for a reading — and only then | United States |
| Cloudflare | Network routing; sees encrypted traffic pass, never its content | Worldwide network |
Your pages do not leave the European Union. They are hosted in Ireland, and they are encrypted there. Three things are the exception and go to the United States: what you say to a voice, the dreams you have read, and the week's pages if you accepted the Mirror. Each is asked of you for itself before the first time it is sent, and each is kept there for up to thirty days before being deleted.
Two of these providers are companies established in the United States, even where the hosting is European; and application updates do pass through Expo's servers. These transfers rest on the European Commission's standard contractual clauses, and never concern the content of your pages — which stays unreadable everywhere it passes.
A data processing agreement is signed with Anthropic, framing what the company may do with the text we entrust to it and carrying the transfer clauses. We hold it available for any authority that asks.
Those thirty days call for two clarifications, which we prefer to write rather than leave to be discovered.
We would have preferred zero retention — Anthropic offers it under a separate agreement — and we do not have it. Until we do, this page says thirty days.
You have a right of access, rectification, erasure, restriction, objection and portability. Write to info@archea.page; we answer within a month.
We cannot give you a readable copy of your pages, since we cannot read them. This right is exercised from the application itself: Settings → Take my pages with me produces a document readable anywhere, from your device, where the key is. It is more complete than anything we could send you.
Deleting your account permanently erases what the server holds of it — your encrypted pages and your sealed key — with no possibility of restoration. The pages on your devices stay there.
You may also lodge a complaint with your national supervisory authority (in France, the CNIL).
Archea is for adults only — eighteen or over. We do not knowingly collect a minor's data, and we delete any account we find. The reasons for that choice are in the terms of use.
Any change to this document will be dated at the top of the page.
And if the change touches what leaves your phone — another provider, one more reading, a new fact about you — the application will ask you again before sending anything. Each permission carries the version of the facts it was given on; a permission given on facts that have since changed no longer holds, and the screen comes back. This is not an intention: it is how the permissions are written.