Privacy Policy

Last updated: August 10, 2026

108 Moments is a daily practice app built by Dustin Wells ("we," "us"). This policy covers the 108 Moments app and this website. The app is built local-first: it works fully without an account, and the less we hold, the less there is to get wrong.

The short version

• You can use the whole app without an account. Your practice stays on your device.
• Your well-being check-ins never leave your device for analytics — not the score, not your answers. No third party receives them, in any form.
• We collect basic anonymous usage analytics, and you can switch them off in the app: Settings → "Share anonymous usage data".
• Nothing you write in the app is ever collected — not chime names, not notes, no free text at all. Email you send us is different, and is covered below.
• No ads, no advertising identifiers, no tracking across other companies' apps.
• We do not sell your information. Ever, to anyone.
• This website — the one you are reading — uses Google Analytics and sets cookies. That is separate from the app and is described below.

Using the app without an account

Signing in is optional. Without an account, your practice — your daily bead counts, which practices and levels you have completed, your streak, anything you saved, your chimes, and your well-being check-ins — is stored on your device and is not sent to us. Deleting the app deletes that data. If you later sign in, your on-device practice is synced up to your account.

If you create an account

An account exists for one reason: so your practice can be backed up and carried across your devices. When you have one, we store:

• Sign-in details. Your email address. Sign-in is passwordless — we email you a one-time sign-in link, so there is no password for us to hold. You can instead sign in with Google, in which case Google passes us your email address and name. You can optionally add a display name.
• Practice progress. Your daily bead counts, which practices and levels you have completed, your streak, and anything you saved.
• Your well-being check-ins. Synced to your own account so you can see your own results across your own devices. Visible only to you — see the section below.

Your well-being check-ins

The short well-being check-in is optional, self-reported, and treated as the most sensitive thing in the app.

The score and your individual answers never leave your device for analytics.They are not sent to our analytics provider or to any other third party, in any form — not the five answers, not the total score, not a change from your first check-in. They are stored on your device for you, and — only if you choose to create an account — synced to that account so your own trend follows you between your own devices. Nobody but you sees them.

Analytics do record that a check-in happened and where it fell in your sequence, which is what tells us whether people keep practising. That record carries no score and no answers.

Usage analytics in the app

To see whether the app does what we say it does, we collect basic product analytics using PostHog. That is:

• which screens and features you use,
• how many beads you log,
• general device information — device model, operating system version, app version.

These are tied to a random identifier — a random account id if you have signed in, otherwise a random identifier generated on your device. It is not your name and not your email address.

Usage analytics never include:

• your well-being check-in score or your answers to it,
• anything you have written — chime names, notes, or free text of any kind,
• your location, contacts, photos, or anything else on your device.

Analytics are never sold, never used for advertising, and never joined to an advertising profile.

You can turn this off. In the app, open Settings and switch off"Share anonymous usage data". The app then stops collecting and sending usage analytics. Everything else in the app keeps working exactly as before.

Server logs

Signing in and syncing your account reach our servers. Like any request to a server, those are visible to the server, and standard logs — including IP addresses — may exist briefly for security and reliability. They are not used to build a profile of you and are not joined to your practice data.

This website

This website uses Google Analytics to count visits, so we can tell which of our links and printed QR codes people actually use. It sets cookies in your browser and sends Google the page you are on, roughly where you are in the world, and what kind of device you are using. You can opt out with Google’s browser add-on, and most browsers can block these cookies outright.

This is separate from the app. Nothing measured here is joined to your practice, your account or your check-ins, and none of your practice data is ever sent to Google.

If you write to us

Email is a person’s inbox, not the app. When you write to us — for help, to ask us to delete your account, or to ask for a necklace at the necklace page — we hold your email address and whatever you put in the message, because that is what an email is. A person reads it and replies.

If you ask for a necklace and send us a mailing address, we use it to post the necklace and for nothing else. None of it is used for analytics or advertising, none of it is added to a mailing list, and none of it is joined to your practice, your account or your check-ins. We keep these messages while we still need them to answer you and to send what we said we would send. Ask us to delete your correspondence and we will.

Notifications

Reminders — such as the morning reminder and the 1:08 PM daily line — are local notifications scheduled on your device. They are optional, each one can be turned off in the app, and they do not send your data anywhere.

What the app never collects

• Your location. The app requests no location permission and derives none.
• Your contacts, photos, or anything else on your device beyond what is listed above.
• Advertising identifiers or cross-app tracking data. The app contains no advertising SDKs and does not track you across other companies' apps or websites.

On this website, Google Analytics works out a rough country or region from your IP address. That is the one exception to the location line above, it is nowhere near a precise position, and it is never joined to anything in the app.

How we use what we do collect

Only to:

• sign you in and keep your account secure,
• sync your practice across your devices and back it up,
• show you your own progress, streak, and check-in results,
• understand in aggregate how the app is used, so we can improve it.

We do not sell your information, share it for advertising, or use it for any purpose beyond running the app.

Service providers

We use a small number of infrastructure providers to run the app. They process data on our behalf and are not permitted to use it for their own purposes:

• Supabase — hosts our database and sign-in system (servers in the United States).
• Twilio SendGrid — delivers the one-time sign-in emails.
• PostHog — processes the usage analytics described above (servers in the United States). It never receives check-in scores, check-in answers, or anything you wrote.
• Google — only if you choose to sign in with Google.
• Vercel — hosts this website.
• Google Analytics — counts visits to this website only. It never receives anything from the app.

Deleting your data

In the app: Settings, at the very bottom → Delete account, then confirm. It works whether or not you ever made an account, and it deletes everything:

• your practice on this phone — practice history, bead counts, check-ins, saved days, chimes and settings;
• and, if you have an account, the account itself and everything synced to it.

You start over from day one. It happens immediately and cannot be undone.

You can also email us and we will delete it for you — always within one month of your request. Full instructions, including if you have already uninstalled the app, are on theDelete your data page.

We keep account data only for as long as the account exists. When you delete, your data is removed from our live systems immediately. Encrypted backups of our database are kept for disaster recovery and roll over on our hosting provider's standard schedule; your data ages out with them, and a backup is never read or used for anything else in the meantime. We keep a minimal record that a deletion request was made and when — no practice data — because we have to be able to show that we acted on it.

Security

All data is encrypted in transit. Database access rules mean your rows can only be read and written by your own account. No system is perfectly secure, which is exactly why the app is built to store as little as it can.

Children

108 Moments is not directed at children under 13, and we do not knowingly collect information from them. If you believe a child has created an account, contact us and we will delete it.

Your rights

Depending on where you live, you may have rights to access, correct, export, or delete your personal information. Since the app holds only what is listed above, the fastest path is usually the in-app delete, but you can always email us to exercise any of these rights.

For this website, the controls are in your hands rather than ours: block or clear cookies in your browser, or install Google’s opt-out add-on. We cannot single your visit out of the counts, because nothing here identifies you to us in the first place.

Changes to this policy

If we make meaningful changes to this policy, we will update the date at the top of this page and, for significant changes, note it in the app.

Contact

Questions about privacy? Email us, or see Support.