Skip to content

Privacy policy

Last updated 26 September 2026

LifeCanvas is a private journal. This policy explains what we collect, why, and the control you have over it. LifeCanvas is run by Beesam Systems Ltd (“we”, “us”), which is the data controller for your personal data under UK data protection law (UK GDPR and the Data Protection Act 2018).

The short version

  • Your entries, moods and photos are yours. We don't sell them, show ads, or use them to train AI.
  • Nobody at LifeCanvas reads your journal. The only exception is if you ask us to look at a problem with a specific entry.
  • Anything you share (a canvas link, an invite, a farewell email) is shared only because you chose to.
  • You can download everything, including original photos, and delete your account at any time from Settings.

What we collect

  • Account details: your email address, a securely hashed password, and optionally a display name, profile photo and hobbies.
  • Your canvas: date of birth and target age (to draw your weeks), time zone (so reminders arrive at the right time), and settings.
  • What you write and add: journal entries, moods, stickers, reflections, chapters, time capsules and photos. Photos are re-encoded when uploaded, which removes location and camera metadata.
  • Emails you send through LifeCanvas: addresses you enter for invites or a farewell message, used only to send that message.
  • Technical data: IP address and basic request logs for security and rate limiting, kept for a short time. If analytics are enabled we use Umami, which is cookie-free and doesn't identify you.

Why we use it (and our legal basis)

  • To provide the service you signed up for - storing and showing your journal, sending the reminders and digests you turn on (contract).
  • To keep accounts secure and prevent abuse, for example limiting login attempts (legitimate interests).
  • To reply when you contact us (legitimate interests).
  • Optional AI features, such as a letter about your year, run only when you ask for them (consent - you can simply not use them).

Who helps us run LifeCanvas

We use a small number of providers (“processors”) who act only on our instructions:

  • Hosting: our cloud provider stores the database and photos on servers we control.
  • Resend sends emails (reminders, digests, password resets, invites).
  • Anthropic generates AI letters when you request one. The text of the relevant entries is sent for that request only and is not used to train models.
  • Stripe handles payments if you subscribe to Pro. We never see or store your card number.

Some providers may process data outside the UK. Where they do, we rely on UK adequacy regulations or the UK International Data Transfer Addendum.

How long we keep it

We keep your data while your account is open. When you delete your account, your entries, photos and profile are deleted immediately from the live service. Short-lived server logs expire on their own.

Your rights

You can, at any time:

You also have the right to object to or restrict processing, and to ask us about anything in this policy - contact us. If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office (ico.org.uk).

Security

Connections are encrypted with HTTPS, passwords are hashed with bcrypt, photos are only served to their owner, and sessions can be ended on every device from your profile. No system is perfectly secure, but we take protecting your journal seriously.

Children

LifeCanvas isn't intended for children under 13, and we don't knowingly collect their data.

Changes

If we change this policy in a meaningful way we'll tell you by email or in the app before the change takes effect.