Last updated July 13, 2026
Within asks about your life, your relationships, and your decisions — things most people wouldn't say out loud to a stranger. That only works if you trust what happens to it afterward. Here's the honest, plain-English version of how that trust is backed up technically, not just promised.
Every table in our database that holds personal data — your conversations, your report, Growth Companion check-ins — has row-level security enabled at the database layer, not just checked in application code. That means the database itself enforces that a query can only ever return rows belonging to the person making it. Even a bug in our application code couldn't accidentally serve one person another person's conversation, because the database refuses the query before it gets that far.
We don't read individual people's conversations as a matter of routine. The only reasons we'd ever look at account-level data are debugging a reported problem or responding to a legal request — and even then, we're working from an anonymous internal account ID, not your name (Within never asks for your real name).
Every connection — your browser to our servers, and our servers to the database — runs over TLS. Nothing about your conversation travels in a form that could be read by anyone intercepting the connection.
A small number of infrastructure providers see what they need to do their specific job, and nothing more:
We don't sell your data, and we don't use your conversations to train models beyond what each provider's own API terms cover for processing your request. Full detail is in our Privacy Policy.
Settings has a permanent delete-account option. It removes your account and everything tied to it — conversations, reports, Growth Companion data — immediately, without needing to email anyone or wait on us. This isn't a soft deactivation; it's a real delete.
Within is a small product in active testing, not a large company with a dedicated security team yet. We've built the fundamentals — database-enforced access control, encryption in transit, self-service deletion — carefully and deliberately. As the product grows, so will this page: things like independent security audits and additional safeguards are on our roadmap, not yet done. We'd rather tell you that plainly than overstate where we are.
If anything here isn't clear, or you want to know more about how a specific piece works, email hello@heywithin.com.