Privacy Policy

Last updated July 13, 2026

This is a plain-language explanation of what Within collects and why, written to be read, not skimmed past. It is a reasonable starting point for a small product, not a substitute for a lawyer — if you're scaling this or charging money for it, have a professional review it before then.

What we collect

When you use Within, we store:

  • Your email address and password (the password is hashed by our authentication provider — we never see or store it in plain text).
  • The full text of your conversations with the AI, since your report is generated from them.
  • The report generated for you, and any behaviors, check-ins, or reflections you save through Growth Companion.
  • Your device's local timezone, used only to time optional reminder emails to a reasonable hour for you.

What we don't collect

We don't ask for your real name. You're identified internally by an account ID, not a name — the "private code instead of your name" promise on signup refers to this.

Who we share it with

We use a small number of infrastructure providers to run the product. Each only sees what it needs to do its job:

  • Anthropic — processes your conversation text to power the AI and generate your report.
  • OpenAI — processes your voice audio if you use voice input or listen to spoken replies (transcribing what you say, and generating speech from the AI's replies). Audio is sent for that one request and isn't stored by us.
  • Supabase — hosts our database (your account, conversations, reports, Growth Companion data) and handles login.
  • Vercel — hosts the app itself and, if you enable analytics, aggregate, non-identifying usage data (which pages get visited — not your conversation content).
  • Resend — sends reminder emails, only if you opt into them and only to the address you signed up with.

We do not sell your data, and we do not share your conversation content or report with any other party or use it to train models beyond what Anthropic's own API terms cover for processing your request.

Cookies

We use a small number of strictly necessary cookies to keep you signed in and remember your session — none used for advertising or cross-site tracking. If you enable Vercel Analytics, it counts aggregate page views without individually tracking you.

How long we keep it

Your conversations, reports, and Growth Companion data stay in your account until you delete them or close your account. You can permanently delete your account and everything in it yourself, any time, from Settings.

Your choices

Reminder emails are opt-in and can be turned off at any time from your Growth Companion settings. You can delete your account yourself from Settings, or email us to request a copy of your data.

Contact

Questions about this policy or your data can be sent to hello@heywithin.com.