Your reflections should feel private.
Positive Friend is designed to collect only what is needed to save your journey and respond to support requests you choose to make.
operator_legal_name, operator_address and privacy_contact in config.php before public launch.Who controls the data?
Positive Friend is intended to be the data controller for information collected through this installation. Privacy contact: positivefriend@kijobe.com.
What we collect
Before registration, introductory answers are kept only in the temporary server session. After registration, the application stores your name or nickname, email address, password hash, language preference, introductory answers, course progress, reflections, legal acceptance record, your optional gentle-reminder preference, and any coach/support requests you intentionally submit. If you choose to provide it, the site may also store a broad age band and voluntary life-experience contributions that you explicitly offer for possible anonymous sharing. It does not ask for your date of birth. Temporary password-reset tokens may be stored for up to one hour.
Please keep reflections appropriately private
You do not need to provide medical records, diagnoses, treatment details, identification numbers, financial information, intimate secrets, or other highly sensitive information to use this course. Keep reflections as general as possible. If you voluntarily enter sensitive information, it will be stored with your account until you remove the account or it is otherwise deleted under the operator’s retention process.
Why we use the information
- To create and secure the account you requested.
- To save progress and reflections so you can return later.
- To remember your language preference.
- To offer optional life-experience prompts based on a broad age band.
- To review voluntary life-experience contributions and, only with explicit permission and human review, share a short essence without your name or exact age with other users.
- To send necessary account/security messages, confirm coach interest, and, only when you opt in, send up to three gentle course reminders after periods of inactivity. Reminders can be turned off at any time.
- To respond to coach/support interest when you explicitly ask to be contacted.
- To protect the service from abuse and maintain security.
Legal basis
The intended bases are providing the account/service you requested, the operator’s legitimate interests in securing and operating the service, and consent where the site specifically asks permission to contact you about support or to review and share the essence of a voluntary life-wisdom contribution. The operator must confirm the correct legal bases for its actual organisation, hosting and countries of operation before launch.
Optional life-wisdom contributions
If you choose to contribute, your original wording is first stored privately in a moderation queue and is never published directly. A human moderator may reject it or create a short, positive, de-identified essence. After approval, the active wisdom record removes the original wording and keeps only the approved essence plus limited technical linkage needed so you can withdraw it. Other users are not shown your name, email address or exact age. You can withdraw a pending or approved contribution from the Account page.
Although the public note is de-identified for other users, the approved record remains linked internally to your account until you withdraw it or delete the account. The operator should therefore treat the feature as personal-data processing, not claim mathematical anonymity, and review the consent/retention design before public launch.
Where and how data is stored
This version stores user records in server-side files rather than a public database. Passwords are hashed. The private data directory can and should be moved outside the public web folder. The hosting provider may also process ordinary server logs and backups under its own infrastructure arrangements.
Who receives it?
The application does not include advertising trackers, analytics pixels, social-media pixels, or data-sale features. Access should be limited to the site operator and service providers genuinely needed to host, secure or support the site. If the operator later adds analytics, marketing, embedded services or additional processors, this notice must be updated before those tools are enabled.
International transfers
Whether personal data leaves your country or the EEA depends mainly on the hosting provider, email provider and any future service providers chosen by the operator. The operator must document any required transfer safeguards before launch.
How long is it kept?
Account data is kept while the account remains active. Support requests and pending life-wisdom contributions should be reviewed and deleted when no longer needed. Password-reset tokens expire after one hour. Hosting logs and backups may have separate retention periods set by the hosting provider. The operator should define and document a specific review/deletion schedule before public launch.
Your choices and rights
Logged-in users can export their stored account file and permanently delete their account from the Account page. Depending on applicable privacy law, you may also have rights to access, correct, erase, restrict, object, obtain portability, withdraw consent, and complain to a data-protection authority. Contact the privacy address above to exercise rights that are not available directly in the account screen.
Cookies and security technology
Positive Friend uses one strictly necessary session/login cookie plus browser-local storage for language and light/dark mode. It uses no advertising or analytics cookies. See the Cookie Notice.
Security
No website can promise absolute security. Production use should require HTTPS, private storage outside the web root, restrictive file permissions, protected backups, a secret application key, current PHP/security patches and restricted server access.
Changes
If the way data is processed materially changes, the operator should update this notice and, where required, notify users or obtain new consent before the new processing begins.
Supervisory authority
If the operator is established in Norway, users may have the right to complain to the Norwegian Data Protection Authority (Datatilsynet). Users elsewhere may have a different competent authority.