Privacy Policy

1. What we collect

• Account email and authentication data (via Supabase Auth).
• Subscription status — from Polar on the web, and from RevenueCat, Apple or Google for mobile purchases. We never see or store card numbers.
• Anonymous product analytics if you opt in (PostHog — never story bodies, companion messages or free text; see section 6).
• Story submissions you choose to send us (anonymised before review).
• Recovery Companion entries — check-ins, plan progress, rituals, letters, sessions and companion transcripts (section 2).
• Technical data every web server receives: IP address, user agent and request time, held in short-lived operational logs and used only to keep the service running and to stop abuse.

2. Recovery Companion data

The Recovery Companion asks you for information about your emotional and mental state. Under the GDPR that is special-category data (Article 9). We only process it because you choose to enter it, and our legal basis is your explicit consent — Article 9(2)(a). You can withdraw that consent at any time by erasing your recovery data (section 10); withdrawing does not affect processing that already happened.

What it stores

• Your intake answers and preferences: your situation, what you want most, what you never want suggested, minutes per day, wake and reminder times.
• Your 21-day plan, the activities in it, what you completed or skipped, reflection notes, streaks and grace days.
• Check-ins: mood and energy, intensity, what triggered a moment, urge to contact, and any note you add.
• Behaviours you tap ("I checked their photos", "I slept well"), and behaviours the AI suggests from a session — the suggested ones are marked unconfirmed until you say yes, and are deleted if you never do.
• Your focus list, day closes and the one line you write each evening.
• Thought dumps you choose to keep, and the AI reply if you asked for one.
• Future-self letters and unsent drafts — body and unlock date, sealed until that date.
• Ritual events (burn letter, thought release, closure): that you completed one, its emotional weight and a safety flag — never the text.
• Strength Jar entries and Closure Court verdicts you keep.
• Complete companion sessions: every message you send and every reply you receive, plus the session summary.
• Safety records: a risk level and short signal labels (for example "sleep disruption") with a timestamp — never the message text that produced them.

3. Text that never leaves your device

The burn letter, thought release and the closure ritual (the four-step one, not Closure Court) are destruction rituals, and we treat them literally. What you type there is never transmitted to our servers, never written to our database, and never sent to any AI provider. The safety screening on those rituals runs entirely in your browser; only the resulting yes/no flag is sent, so that we can show crisis resources if they are needed. If you write a thought dump and choose neither to keep it nor to have it validated, nothing is stored at all.

Closure Court is the exception, and it is the only one. The charges and the defence you write there are sent to our AI provider to produce the verdict, and are stored under your account until you delete them. The screen says so before you start typing. If you would rather nothing left your device, use the burn letter instead.

4. AI companion memory

So that the companion does not make you re-explain your life every time, it keeps a small memory. Here is everything it can include — nothing outside this list is sent:

• Memory facts — short lines it wrote after a session ("their sister is still in touch", "wants to stop checking their profile at night").
• The last 20 turns of the conversation you are in.
• A short summary of your plan and where you are in it.
• Your most recent mood check-ins — up to fourteen of them — including their notes, the triggers you tagged and how strong the urge to make contact was.
• The dates, titles and event types of your journal entries, and the mood you tagged them with — never their bodies.
• What you told us at intake: your situation, your no-contact status, what you want most from this, whether there are children, whether you still live together, how many minutes a day you have, and anything you asked us never to suggest.
• Behaviours you confirmed over the last fortnight, as counts only ("checked their profile ×3") — never the message or moment they came from.
• The labels of your thought loops — the short lines you or the Loop Breaker wrote for the thoughts that keep coming back.
• The close of your previous session: its summary, its one takeaway, and the small thing you agreed to carry into the next day.

That context is used for one purpose: generating the next reply. It is never used to train any model, ours or anyone else's, and our AI provider is contractually barred from training on it.

You can see the entire memory on the "What I remember" page: edit any fact, delete any fact, pause memory so nothing new is written, or forget everything at once. A fact you delete stops being sent with the very next message.

5. Who processes it for us

• Supabase — database, authentication and file storage.
• DeepSeek — generates companion replies, thought-dump validation, session summaries and encouragements. We send the message or dump you submitted, the memory context described in section 4, and your interface language. We never send your email address, your account ID, or any text from the burn letter, the thought release or the closure ritual. Closure Court is the one place where ritual text does go to DeepSeek, because a verdict cannot be written about an argument nobody has read. No training on your data is permitted.
• Polar — merchant of record for web subscriptions.
• RevenueCat — receipt validation and subscription status for mobile purchases made through Apple or Google. It receives a pseudonymous app user ID and the store receipt, not your recovery data.
• Vercel — hosting and content delivery.
• PostHog — product analytics, only if you opt in.

These providers act as our processors under written terms. This may involve transfers outside the EEA, made under the European Commission's standard contractual clauses.

6. Analytics

If you accept the analytics cookie, we use PostHog to count page views and feature usage so we can see what is worth building. We do not send it story bodies, companion messages, journal text, moods or any free text you write. We do not run advertising trackers, we do not track you across other companies' apps or websites, and we do not sell or share personal data for advertising. Declining analytics changes nothing about how the app works for you.

7. Your device, notifications and app lock

• Push notifications. If you turn reminders on, we store a push token (a per-install identifier issued by Apple, Google or your browser), the platform, your time zone and your reminder settings, so we can send at the right local hour. Notification text is deliberately discreet — it never names the app's subject, a person, a streak or a story. Turning reminders off deletes the token.
• Device identifier. Our mobile apps use a per-install identifier to link a purchase to your account and to send notifications. It is not the advertising identifier and we do not request one.
• App lock and discreet mode — the PIN or biometric lock and the disguised app appearance are enforced entirely on your device. The PIN never leaves it and we never receive it. They protect you from someone holding your phone; they are not encryption of your account.

8. How long we keep things

Deleting your account deletes all of the above. Backups roll off within 30 days.

9. What we never do

• Expose author identity on published stories.
• Log free-text answers or companion messages in analytics.
• Send burn-letter, thought-release or closure-ritual text off your device. (Closure Court is not one of these — see section 3.)
• Train AI models on anything you write, or let our providers do it.
• Sell personal data, or share it for advertising.
• Read your recovery data for any purpose other than running the service.

10. Your rights

Your account page has an Export button that downloads every recovery record we hold for you as a JSON file, and an Erase button that permanently deletes all of it after you type the confirmation word. Erasing recovery data leaves your account and reading history intact. Account deletion cascades submissions, bookmarks and playback state. Both act only on your own records.

You also have the rights to access, correct, delete, restrict and object to processing, and to data portability. If you are in the EEA or the UK you may complain to your local supervisory authority. We answer requests within 30 days.

11. Children

The service is for adults: you must be 18 or older to hold an account, and our mobile apps are rated 17+. We do not knowingly collect data from children. If we learn that an account belongs to someone under 18 we close it and delete the data. If you believe a child has given us information, tell us through the contact form and we will remove it.

12. Cookies

Essential cookies keep you signed in and remember your theme and language. Optional analytics cookies are set only after you accept the consent banner, and you can withdraw that at any time. We set no advertising cookies. We no longer use a reading-meter cookie or a hashed IP address — stories are free, so there is nothing to count.

13. Contact

Privacy questions and data requests go through the contact form. It is the only channel we operate.

This document is published in English only. Where any translation of it exists, the English version governs.