Privacy Policy

What we collect

None of this is sold or used for advertising — this is simply what Within needs to actually work: to remember your conversations so your report makes sense, and to keep your account secure.

When you use Within, we store the following inside our own private database — set up so that no one, not even another Within user, can ever see your data:

• Your email address and password. The password itself is hashed by our authentication provider, so we never see or store the actual password you typed, even internally.
• The text of your conversations with the AI, since that's what your report and Growth Companion are built from.
• The report generated for you, and any behaviors, check-ins, or reflections you save through Growth Companion.
• Your device's local timezone, used only to send optional reminder emails at a reasonable hour for you.

That's the full list — no browsing history, no contacts, no location tracking, no advertising identifiers.

What we don't collect

We don't ask for your real name. You're identified internally by an account ID, not a name — the "private code instead of your name" promise on signup refers to this.

Who we share it with

We use a small number of infrastructure providers to run the product. Each only sees what it needs to do its job:

• Anthropic — processes your conversation text to power the AI and generate your report.
• OpenAI — processes your voice audio if you use voice input or listen to spoken replies (transcribing what you say, and generating speech from the AI's replies). Audio is sent for that one request and isn't stored by us.
• Supabase — hosts our database (your account, conversations, reports, Growth Companion data) and handles login.
• Vercel — hosts the app itself and, if you enable analytics, aggregate, non-identifying usage data (which pages get visited — not your conversation content).
• Resend — sends reminder emails, only if you opt into them and only to the address you signed up with.
• PostHog — product analytics: which pages get visited and specific named events (like "signup completed"), tied to your account. Autocapture and session recording are both off, so it never sees what you type or click.
• Sentry — error monitoring, so we can catch and fix bugs. Configured to never receive your conversation text or other personal data.
• Google Analytics — aggregate site usage data (pages visited, general traffic patterns), via Google Tag Manager. Doesn't see your conversation content.

We do not sell your data, and we do not share your conversation content or report with any other party or use it to train models beyond what Anthropic's own API terms cover for processing your request.

Cookies

We use a small number of strictly necessary cookies to keep you signed in and remember your session — none used for advertising or cross-site tracking. If you enable Vercel Analytics, it counts aggregate page views without individually tracking you.

How long we keep it

Your conversations, reports, and Growth Companion data stay in your account until you delete them or close your account. You can permanently delete your account and everything in it yourself, any time, from Settings.

Your choices

Reminder emails are opt-in and can be turned off at any time from your Growth Companion settings. You can delete your account yourself from Settings, or email us to request a copy of your data.

Contact

Questions about this policy or your data can be sent to hello@heywithin.com.