Privacy
What you write here is sensitive. It is treated that way.
You own your journey
Your check-ins, journals, exercises and insights belong to you.
A coach sees only what you share
A coach or therapist sees agreed parts — after explicit consent.
Your organisation can't read your texts
Administrators handle licences and aggregated statistics, not private journal entries.
Research is anonymised only
No analysis beyond your own journey uses data that points back to you.
You can correct the system
Interpretations are hypotheses. You can always correct, change or delete.
Who is responsible for your data
Burned Illusions AB is the data controller for the processing of your personal data. Questions, correction, access or deletion: info@burnedillusions.com.
What data we process
Account data (email, name or alias, language), content you create yourself (check-ins, journal, events, exercises, insights, experiments, reflections), optional profile data (picture, town for the map), technical data (sign-ins, error logs) and subscription status. We never sell data and never use it for advertising.
Who we share with
Paddle.com Market Ltd is our reseller and receives the data needed for payment, receipts and VAT. We also use providers for hosting, database and AI processing of your own entries. None of them may use your data for their own purposes.
Legal basis
We process your data to perform our contract with you (providing the service and your account), based on legitimate interest (security, troubleshooting and improving the service) and, where required, with your consent (for example AI processing and optional profile data). Consent can always be withdrawn.
How long we keep data
We keep your data for as long as your account is active. When you delete your account or request deletion, your entries, insights and profile data are removed within 30 days. Data that must be kept by law (for example accounting records linked to payments) is kept for as long as the law requires and then deleted or anonymised.
How we protect your data
We use appropriate technical and organisational measures: encryption in transit and at rest, access controls so only authorised staff can reach the systems, and database-level access restrictions ensuring each user can only read their own data. No method is one hundred per cent secure, but we work continuously to protect your information.