Privacy, plainly

Your account. Username, display name, a hashed password (never the password itself), your edition and subscription state. Lawful basis: contract. Kept while your account exists.

Billing. Payments are handled by Stripe; your card details go to Stripe, never to our servers. We hold your Stripe customer reference and subscription status. Lawful basis: contract, and legal obligation for accounting records.

Your day, your journal, your trading record. What you log is stored so the app can serve it back to you. Journal entries and counsel material are sealed with encryption keys derived per user; the pattern is: your private things are ciphertext at rest.

The Counsel and Listening Rooms. Everything you bring is encrypted with your key. Voice notes are transcribed on our own private server, never sent to a third-party transcription service, and the audio is deleted the moment the text exists. Counsel sessions are sent, encrypted in transit, to Anthropic's model API to generate the counsel itself; Anthropic's API terms do not permit training on this data. Deleting a session deletes it and everything the counsel learned from it.

Couple features. The channel, calendar, shared board, checkup and appreciation log are sealed with a key belonging to the couple. Monthly checkup answers are sealed with each person's own key; your spouse can never read yours, only the shared reading. Unlinking deletes everything shared, at once, and either of you can do it.

Cycle awareness (Her edition, optional). This is health data, and it is treated with the most care of anything in the product. Nothing is stored until you give explicit consent inside the app. Every event, including its date, is sealed as encrypted data. It is never sent to any AI model, never included in any notification, and never visible to a linked partner: these are properties of how the system is built, and one of them is enforced by an automated test in our release process. You can download all of it as a file from the cycle screen, and withdrawing consent deletes every trace immediately. Backup copies are automatically deleted within 30 days. The feature is informational only: not medical advice, not a diagnosis, and never a method of contraception or conception.

Notifications. If you enable them, your device's push subscription is stored to deliver them. Anything private is deliberately vague on the lock screen. You can disable them in your device settings at any time.