What happens to what you tell us.
This app holds people’s private reflections about their own lives. That deserves a plain description of where it goes rather than a page of legal cover.
What is stored
The options you click in the interview, your journal entries and their ratings, the rabbit holes you save, the experiments you run and their debriefs, and any optional notes you write. Also the derived rows the engine reasons over — the evidence behind every insight the app shows you.
Your email address and a hashed password, so you can sign in. The password itself is never stored; what is stored cannot be reversed into it.
Most of what the app keeps is not prose. Because nearly everything is answered by clicking, the bulk of your data is category tags and numbers rather than writing. Free text is optional everywhere.
Where it is stored
In a Cloudflare D1 database in eastern North America, owned by whoever runs this site. It is not on a shared analytics platform and it is not in a data warehouse.
What is never done with it
It is not sold. It is not shared with anyone. It is not used to train any model. There is no advertising, no tracking pixel, and no third-party analytics — the site’s content security policy would block them even if someone added one by mistake.
Cookies
One: a signed session cookie so you stay logged in for thirty days. It contains an identifier and nothing about you. There are no other cookies, so there is no cookie banner to dismiss.
The AI coach, which is off unless you turn it on
Every pattern, hypothesis and confidence level in this app is computed by a rule engine running on the server. No AI model is involved in deciding what your evidence means.
If you switch on AI phrasing in Settings, findings that have already been computed are sent to Anthropic’s API to be rewritten as prose, along with up to four of your most recent journal notes for texture. The model is instructed that it may not add a claim of its own, and that anything you wrote is quoted material rather than an instruction to it. Nothing is sent while the setting is off, and every answer works without it.
Sent through Cloudflare, only for confirming your address and resetting your password. Those messages contain a link and nothing else — no part of your journal ever appears in an email. There is no newsletter and no marketing.
Bot protection
The sign-up form uses Cloudflare Turnstile, which sees the request in order to judge whether it came from a browser or a script. It is a privacy-preserving alternative to a CAPTCHA and does not track you across sites.
Getting it back, and getting rid of it
Settings shows the exact count of everything held about you, table by table. You can export all of it as a single JSON file — including the derived evidence rows, because an export that hides the machine’s own working is not really an export.
You can delete any single entry, delete all your data while keeping your account, or delete the account entirely. All three happen immediately. There is no waiting period, no confirmation email, and nothing retained afterwards for anyone’s benefit. Deleting an entry also deletes the evidence it produced, and the profile recomputes without it.
How long it is kept
Until you delete it. There is no other expiry.
If something goes wrong
This is a small project, not a company with a security team. It has been built carefully — hashed passwords, rate limiting, a content security policy, single-use expiring reset links — but you should weigh that when deciding what to write in it. Write what is useful to you, not what would be catastrophic to lose.