Privacy Policy

Selfwise is operated by Beh.Dev UG (haftungsbeschränkt). It is built so that the most personal thing in it — your answers, your goals, your journal — lives on your device. Something leaves it only when you use a feature that needs to send it: the companion, reminders, sync (which uploads a copy we cannot decrypt), or contributing to a reference set. Each is described below with exactly what it sends, and the end of the Settings tab lists the ones you have switched on.

The short version

• Your questionnaire answers, compass scores, goals, tasks and journal entries are stored in your browser. We do not have a copy, unless you switch on the reference-set contribution described below — which is off unless you turn it on.
• When you talk to the companion, your message goes through our server to an AI provider to get a reply. We keep a count, not the words. Details below.
• You can use the whole app without an account, an email address, or a payment.
• We collect an email address only if you give us one — for the waiting list, or to buy a subscription.
• We do not sell data, we do not run advertising, and we do not use third-party trackers.
• You can delete everything, on your device and on our server, from Settings — at once, or after a week in which you can change your mind.

What is stored on your device

Everything you enter lives in your browser’s local storage as a “vault”: item responses, compass snapshots, goals, tasks, journal entries, and any API key you choose to add. In anonymous mode this is stored unencrypted, which means anyone with access to your browser profile can read it. If you connect a wallet, the vault is encrypted with a key derived from your signature, and we never see that key.

Because it is local: clearing your browser data deletes it, and we cannot recover it for you. Use “Download my data” in the Settings tab to keep a copy.

What reaches our servers

If you join the waiting list

We store the email address you typed and which page you typed it on. Nothing else.

Anonymous usage measurement

To know whether the product works, we count how many people reach each step (opened the page, answered a question, signed up). Each event is exactly three fields: a step name, a random identifier that exists only for that browser tab and is never stored on your device, and a timestamp. There are no cookies, no persistent identifier, and no third-party analytics service. We cannot link two visits to the same person, and we do not try to.

If you subscribe

Payment is handled by Stripe. We never see or store your card details. We store the email address Stripe reports, your Stripe customer and subscription identifiers, and a licence key. That is what lets us restore your key if you lose it, and let you cancel.

If you use the AI companion

Where your messages go depends on how you set up the companion.

Through our service (a trial or a subscription, without your own key). To answer you, the companion needs context. Your message, the conversation so far, and what the companion needs to know about you — your compass, your goals and tasks, and the notes it keeps — go through our server to one of our AI providers: Google (Gemini) or Anthropic (Claude).

We record how much you use it, not what you say: the number of messages and, for subscribers, their size in tokens, so the included allowance can be enforced. We do not store your message or the reply. The one exception is sync, if you turn it on: it holds an encrypted copy of your data that we cannot read (see Sync across devices).

Both providers handle the request under their terms for paid API use:

• It is not used to train their models.
• The provider may hold the request briefly in memory, so the next message in the same conversation is answered faster.
• The provider keeps a log of requests for a limited period, only to detect misuse and to meet legal obligations.

With your own key. If you enter your own Google AI API key, your browser talks to Google directly and the request never reaches our servers. Google’s terms for your own account apply. On Google’s free tier, those terms let Google use your content to improve its products.

If the companion speaks

Voice replies are off unless you turn them on. While they are on, the text of each reply is sent to Google through our server, and audio comes back. We record only a count of the speech used, so the allowance can be enforced. Neither the text nor the audio is stored by us. Google processes the request under their API terms: API content is not used to train their models, and they keep it only for a limited period to detect abuse. Some browsers can speak a reply with a voice built into the device instead; that never reaches us.

The companion's own messages can arrive as voice messages instead of text, if you choose that in Settings. They take the same road: when you play one, or open its notification so that it is ready to play, its text is sent to Google through our server and audio comes back, and we record only a count. The recording is kept on the device that made it — never synced, never stored by us — and deleting your data deletes it.

Talking to the companion

Speaking to the companion is not available yet, and the app does not use your microphone. When voice input arrives, this page will say where your voice goes before the feature reaches you.

Your journal

Journal entries stay in your browser and are not sent anywhere by default — not to us, and not to the companion.

There is one switch, in the Journal panel, that lets the companion read your five most recent entries so it can suggest things to do. It is off unless you turn it on. While it is on, those entries are sent to our AI provider with your message, exactly like the rest of the conversation, and are not stored by us. Turning it off stops it immediately.

The weekly check-in (optional)

Both reminder channels are strictly opt-in and independent of everything else here.

Notifications: if you enable them, your browser gives us a push endpoint — a URL that lets us ring that one browser and nothing more. It identifies no person and links to nothing else we hold. Turning notifications off deletes it; endpoints the push service reports dead are pruned automatically.

Timed reminders: if you set a reminder for a particular time, your device sends us that time and a random id, so we know when to ring your browser. We are not told what the reminder is about. The words you see come from your own device, which keeps them; the notification is a doorbell, not a letter. Your timezone and any repeat pattern stay on your device too — it works out the individual moments itself and sends only those, so we hold a list of alarm times and cannot reconstruct the schedule behind them. Each entry is deleted the moment it is used, and turning notifications off deletes any still waiting.

Email: if you enter an address, we store it as pending and send one confirmation mail. Nothing is ever sent unless you click the link in it (double opt-in), and every reminder afterwards carries a one-click unsubscribe that deletes the address outright.

If you send us a suggestion or a problem

Only when you press send, and only the words you approved. The server stores the message, the language it was in, and a reference like SW-4K7P2Q9B that your device made up. It stores nothing that links the message to you — no licence key, no device id, no address — so we cannot find you to reply. Your device asks about the reference it holds, and that is how it learns what became of the message. If you put something personal in one by mistake, “Delete my data” removes it, using that reference.

Once a day our server emails us a notice of how many messages arrived, with their references, through our email provider (Resend). The notice never contains what you wrote; we read that on our server.

Free months

We sometimes give a month of premium as thanks for a suggestion we built that helps people in general. It works without us knowing who you are.

• A voucher is a random code. We store only a fingerprint of it, never the code, and when it is used we record that it was used — not by whom. The code waits on the message’s row until your device collects it. Only a device that holds the message can: it proves this with a fingerprint of the reference and the words you sent, so someone who only knows the reference cannot take it. The code is removed from that row the moment it is spent, and afterwards nothing connects the code to the message.
• A free month is a licence with an end date and nothing else: no email address, no payment details. When it ends, you are back on the free plan; there is nothing to cancel. It is deleted 90 days after it ends. A second free month starts where the first ends, never alongside it.
• If you already subscribe, the voucher moves your next payment a month later instead. Stripe records the extra month as a trial on your subscription, with a marker that is meaningless outside our system; no money changes hands, and Stripe is not told why.

One honest limit: a reward collected at almost the same moment your device checks on a message could, in principle, be matched by timing. We do not do this and have built nothing that would.

The free trial

Trying the companion without paying needs some way to count your free turns, and we have no accounts and no IP logs to count against. So the server issues a random token — it identifies nothing about you, is not derived from your device, browser or address, and cannot be linked to any other token. Your browser keeps it, and we store it alongside a count of the turns used.

The honest consequence: clearing your browser data discards the token and earns a fresh trial. We know, and we have chosen this rather than fingerprinting you to prevent it.

Sync across devices (optional, off by default)

Sync exists so your journal and goals can follow you from a phone to a laptop. It is the only feature that stores your content on our servers, and it does nothing until you turn it on in Settings.

What we hold. One encrypted blob and one handle. The blob is encrypted with AES-GCM-256 on your device before it is sent. The handle is what tells us which blob is yours; it is derived from your sync key through a one-way function, and it cannot be turned back into that key.

What we cannot do. Read it. The encryption key is derived from a sync key that is generated on your device, shown to you once, and never transmitted. We considered deriving it from your licence key instead, which would have spared you a second secret — and rejected that, because we store licence keys, so we would then be able to decrypt every journal on the service while this page claimed otherwise. There is no recovery path, for us or for you: if you lose the sync key, the data on our server is permanently unreadable.

What is excluded. Your licence key, your own API keys, and your trial token are never included in the blob. They stay on each device.

What we do not link it to. The handle is not stored alongside your licence, your email, or any identifier. If you hold a subscription your licence key is sent with an upload so we can apply the larger size limit, and it is discarded once that check is done — it is not written next to the blob. We log no IP address against it.

Deleting it. “Turn off and delete from server” in Settings issues a real deletion of the row, not a flag. Sync data is also removed after twelve months without a single sync, since a blob nobody can open and nobody is using is a liability rather than a service.

Legal basis. Consent under Art. 6(1)(a) GDPR, given by switching it on and withdrawn by switching it off, which also deletes the stored copy.

Contributing to a reference set (optional, off by default)

The compass reports a score but cannot say where that score sits compared to anyone else, because we have no reference data. Building that reference set is only possible if people choose to contribute to it. In the Settings tab you can turn this on. It is off until you do, nothing else switches it on, and the app works identically either way.

What is sent when it is on: your answers to the questionnaire items, the axis scores computed from them, how much of each bank you have answered, the language you answered in, and two numbers — how many tasks you have created and how many you have marked done.

What is never sent: your journal entries, your conversations with the companion, the titles of your tasks, your goals, your email address, or your licence key. Nor your IP address, which our servers do not store for any purpose.

Pseudonymous, not anonymous. A random identifier is generated on your device and sent with the answers. It is stored only in your vault, and we hold nothing that connects it to your name, email or subscription. It exists for one reason: so that if you change your mind we can find exactly your contribution and delete it. We use the word pseudonymous because an identifier that makes deletion possible also makes the records linkable to each other, and calling that “anonymous” would overstate it.

Withdrawing. Turning the setting off sends a deletion request and removes the records. If that request fails, the setting stays on and tells you so, rather than showing you an off switch while the data is still here. Legal basis is your consent under Art. 6(1)(a) GDPR, which you may withdraw at any time under Art. 7(3).

Request logs

Our servers can see your IP address, browser, and country on every request, as any web server can. We store none of it in our database: there is no visitor table, no device fingerprint, and no profile built from your behaviour.

Our server runs on Cloudflare Workers with Cloudflare’s request logging switched on, because without it we cannot see when the service breaks. For each request it records the address requested, the time, the outcome, and connection details Cloudflare attaches, which can include your IP address and country. It never records what you wrote, what the companion replied, or the contents of a synced vault. Cloudflare deletes these logs after a few days, and we use them only to find faults. Your licence key is sent in a request header, not in the address, so it does not appear in them.

The check when a free trial starts

The first time the companion starts a free trial for you, the app runs Cloudflare Turnstile, a check that tells a person from a script, so that nobody can use a program to take every trial. It loads only at that moment, never if you have a licence or your own key. Usually you see nothing; occasionally it asks for a click. Cloudflare reads signals from your browser to decide, and says it does not use them for advertising. We receive only whether the check passed. Our legal basis is our legitimate interest in keeping free trials available to people (Art. 6(1)(f) GDPR).

Your rights

Beh.Dev UG (haftungsbeschränkt) is established in Germany, so the GDPR (DSGVO) applies directly and we are the controller (Verantwortlicher) for the data described here. You may request a copy of the personal data we hold, ask us to correct or delete it, restrict or object to its processing, and receive it in a portable form. In practice we hold very little: an email address, and subscription identifiers. Write to privacy@selfwise.space and we will action it within 30 days.

Deleting your data

There is no account, so nothing for you to close. “Delete my data” in the Settings tab deletes the vault on your device and everything our server holds for it: the synced copy, reference-set contributions, notification and reminder entries, your free-trial count, and any feedback you sent. You choose when:

• Now. Everything goes at once and cannot be brought back.
• In 7 days. Nothing is deleted for a week, and a banner on every screen lets you keep your data until then. Sync, contributions and reminders stop at once. When the week is up our server deletes its copy whether or not you open the app again, and your device deletes its copy the next time you open it.
• This device only (with sync on). Removes the copy on this device and leaves the synced copy, which you can bring back with your sync key.

Deletion asks our server first. If it cannot be reached, nothing is deleted anywhere and the app tells you, so it never shows you an empty app while your data is still on our server. Other devices that share your sync key are told the next time they sync, and asked whether to delete their own copy too.

Two things it cannot reach. An email address for reminders: we do not know which address is yours, and every reminder mail has a link that deletes it. Billing records: if you subscribed, we keep the records tax law requires, and deleting your data does not cancel a subscription — cancel it in the billing portal first. For either, write to us at the address above.

You also have the right to complain to a supervisory authority (Aufsichtsbehörde). In Germany that is the data-protection authority of the federal state in which we are established; you may also contact the authority where you live.

Legal bases (Art. 6 DSGVO): performing our contract with you for subscription and companion processing (Art. 6(1)(b)); your consent for the waiting list (Art. 6(1)(a), withdrawable at any time); and our legitimate interest in knowing whether the product works, for the anonymous step counts (Art. 6(1)(f)).

Retention

• Waiting-list emails: until you ask us to remove them, or launch.
• Usage counters: the current month and the two before it, then deleted.
• Reference-set contributions: kept until you withdraw them or delete your data. Because they carry no identity beyond a random id, we cannot expire them on your behalf — the switch and “Delete my data” in the Settings tab are the controls.
• Sync data: until you delete it, or after twelve months without a sync.
• Free-trial tokens and their counts: until you delete your data.
• Vouchers: an unused one expires after 180 days; the record that one was used carries no identity and is kept for our counts. Free-month licences: deleted 90 days after they end.
• After a deletion, we keep the sync handle alone for 400 days, with no data, so a device that missed the deletion cannot upload your vault again. It is a one-way value and identifies nothing.
• Subscription records: for as long as the subscription is active, plus the period tax law requires us to keep invoices. Daily backups of these records are kept for 30 days.
• Request logs: a few days, deleted by Cloudflare.

Children

Selfwise is not intended for people under 16 and we do not knowingly collect their data.

Not a medical service

Selfwise is a self-reflection tool. It is not a medical device, it does not diagnose anything, and it is not a substitute for professional help. If you are struggling, please talk to a doctor or a local support service.

Changes

If we change what we collect, we will change this page and update the date at the top. Material changes will be announced in the app.

Contact

privacy@selfwise.space