Privacy & data use

What we collect from your intake

When you use the guided intake at /start, we save the answers you enter so we can match you with a voice and so you can return to the conversation later. That includes:

• The mood you selected (Steady, Wobbly, Heavy, Urgent).
• The focus areas you tapped (for example, Anxiety, Grief, Parenting).
• What you told us would help most (be heard, see it differently, find a next step).
• The free-text description of what's on your mind.
• Optional Portrait fragments (values, notes) you add from your account.

We also record standard account information (email or sign-in provider identifier), timestamps, and lightweight usage counters so we can enforce free-tier limits and keep the service running.

How we process and use it

• Your intake and messages are sent to an AI model provider to generate a voice's reflection. We use the Lovable AI gateway; providers process the content only to return a response and are contractually restricted from using it to train their models.
• Your conversations are saved to your account so you can pick up follow-ups with the same voice from your practices.
• We use aggregate, non-identifying analytics events (which hero message you saw, which starter chip you tapped) to improve the product. We do not attach those events to the contents of what you shared.
• We use Google Analytics as a third-party processor to understand which pages people visit. It receives the page address (with any query text stripped out), your approximate location, and basic device and browser information — never the content of your reflections, conversations, letters, or check-ins, and never your email address. IP addresses are anonymized, and we have turned off Google's advertising and ad-personalization features, so this data is not used to target ads to you.
• If you arrive from a campaign, newsletter, or ad, we record which link referred you. We read only a fixed list of standard marketing tags in the web address (the usual utm_ tags and ad-platform click IDs) and nothing else from it — never anything you typed into the site — and we remove those tags from your address bar once we've noted them.
• Google Analytics also receives simple interaction events so we can see where people get stuck: which button was pressed, which step of account creation you reached, whether an upgrade or support link was clicked. These carry only fixed labels we define in advance (for example pricing_page or age_gate) — never the content of anything you wrote, and never your email address or account ID.
• We do not sell your data, rent it, share it with insurers or employers, or use your conversations for advertising.

Where it is stored

Account data, intake responses, and conversation threads are stored in our managed backend database, protected by row-level security so that only your signed-in account can read your rows. Access is encrypted in transit (TLS) and at rest by the underlying platform. Administrative access inside FindOkay is limited to a small number of staff for support and abuse prevention.

How long we keep it

• Threads and messages are retained until you delete them or close your account.
• Draft reflections you type into a Sanctuary auto-save to your own browser (localStorage) and never leave your device until you submit them.
• Usage counters and analytics events are retained in aggregate form for product analysis.

Deleting your data

You are in control. From your account page you can delete any thread individually, and you can request deletion of your entire account and its associated conversation history. Deletion removes the rows from our live database; backup copies are rotated out on the platform's standard schedule.

If you would rather email us, use the address in terms and we will action a deletion request.

Children and sensitive contexts

FindOkay is intended for adults. The Grove sanctuary is written in age-appropriate language for younger readers who are using the product alongside a trusted adult — it is not a children's service and we do not knowingly collect data from children under 13. If you believe a child has created an account, contact us and we will remove it.

Not medical care, not a crisis service