privacy.

the architecture reads the body, not the surface. this page says exactly what we collect, what we never collect, what we never sell, and how to take it all back.

what we collect

when you take the mirror

• your six answers, in text.
• the way you typed them. keystroke timing, pauses, deletions, edits, the cadence under the words. this is the behavioral substrate that returns your spine word.
• the returned word and the rhythm we matched you to.
• your email, if you provided one.
• a session identifier we generated on your device.

when you sign in or open your room

• when you sign in with Pupul or open your room, we add a dated presence beat (session_active) to your own append-only record, at most one every six hours. you can see every beat, and revocation always works.

when you write to her

• the text you wrote.
• your mark, if you have one.
• the timestamp.

when you pay

• your email.
• the product you purchased and the amount.
• stripe holds the payment details. we never see your card number.

what we never collect

• your card number, your bank account, your social security number.
• your location beyond the city your IP suggests.
• your contacts, your photos, your microphone, your camera.
• a profile of your activity across the wider web. we do not buy, sell, or assemble cross-site browsing histories about you. (we do run two standard measurement tools on this site itself, disclosed in the next section.)
• conventional biometric media. we do not store a fingerprint image, a face print, a voice print, or a retina scan. we do collect and store behavioral typing patterns (the timing between keystrokes, pauses, deletions) with your consent, given before your reading begins. these patterns are used to create your reading and, if you enable it, to recognize your sign-in. you can delete them with your account, any time.

measurement and advertising

• this site uses two standard measurement tools: the Meta pixel and Google Analytics 4. they exist only so we can tell whether our own ads and pages are working (a visit, a sign-up, a purchase) and how people move through the site.
• they set cookies and report aggregate events to Meta and Google, governed by those companies' own policies. we do not use them to read your private writing or your reading, and we never sell what they collect.
• you can switch them off: use your browser's tracking protection or a content blocker, opt out at the Meta ad-preferences and Google Analytics opt-out pages, or decline non-essential cookies where prompted. blocking them does not change your reading.

what we never do

• we never sell your data. not to advertisers. not to insurers. not to data brokers. not to governments. not to the highest bidder dressed as a partner.
• we never run ads on top of the architecture.
• we never train a model on your private writing without your explicit consent. your brain dumps stay yours.
• we never publish your reading without your explicit consent. your word is yours.
• we never share your behavioral signature outside the architecture.

how we hold it

your data lives in a single supabase project under our control, in a region we have selected for legal and operational reasons. it is encrypted at rest. it is encrypted in transit. access is restricted to two named operators and to internal endpoints that need it to serve your reading. every access is logged in the audit log.

the patent we have filed (application) covers a hub-and-spoke privacy architecture. that means: no single sensor surface ever holds the full identity model. the hub unifies. the spokes never see the body. as we add hardware surfaces in 2027 and beyond, this constraint will be enforced by the engineering, not the policy.

your behavioral data: how long we keep it, and how we destroy it

this is our written retention and destruction schedule for behavioral (keystroke-derived) data, the one kind of information about you that could be called biometric. we publish it because a company that captures how you type owes you the schedule in writing, not on request.

• what we keep is derived, never raw. we do not store a transcript of your keystrokes, which keys in what order. what we keep is a compact statistical vector built from the timing and rhythm of how you typed. it is tied to your reading and cannot be replayed as a password.
• we take your consent before we capture it, at the start of your reading, not buried after the fact.
• we keep it only while your account is live and serving its purpose: returning your word and, if you turned it on, recognizing your sign-in. we do not sell it, and we never disclose it to a coach or organization without your explicit, revocable, per-relationship consent.
• we destroy it when you delete your account. deletion (the button under "your rights" below) marks your behavioral vector and everything tied to you for deletion immediately, and a daily purge hard-erases it after a 90-day grace during which you can restore. this is the enforced destruction path, and it is available to you at any time without explaining yourself.
• and in no case do we keep it past three years of inactivity. as a standing commitment, the behavioral vector of an account with no activity for three years is destroyed, whether or not you ask. (the automated dormancy sweep that enforces this ceiling is being implemented; today the company is months old, so no account is anywhere near it, and deletion above is the destruction path that actually runs.)

your rights

you may, at any time and without explaining yourself:

and separately from deleting your account, you can see every place your record is currently visible to someone else and close any of them, in one list, at /consent. it shows exactly what a coach or organization can be told about you (computed by the same function that answers them, not a summary of it), and closing a door is free, immediate, and final: the person on the other side loses the link, and any agent that checks it is told it is no longer valid. this is dispute and revocation without deleting yourself.

or programmatically:

export everything

POST /api/data-export with { "email": "you@example.com" }. we send a confirmation link. clicking it downloads a JSON file with every row we hold on you.

delete everything

POST /api/data-delete with { "email": "you@example.com" }. we send a confirmation link. clicking it marks your data deleted immediately. it is hard-purged after a 90-day grace period during which you may restore by replying to the confirmation email. the purge removes your account row, your readings, your kept entries, your observations, every product event tied to you, and your email send log. one thing survives, and we would rather tell you than have you find out: the observation ledger is append-only at the database level, so your accrued beats cannot be deleted, by us or by anyone. what we delete instead is the only record that connects those beats to you. once your account row is gone, a beat is a timestamp against a random identifier with no route back to a person. the count of activity survives; you do not.

see the audit log

your export includes the audit log of every time someone (including you) accessed your data. nothing happens to your body without a record.

the record we derive

from your activity we keep an append-only ledger: dated observations about your record, never the raw text of what you wrote. a ledger row says a thing like "returned on this date, from this product, with this confidence", not the words themselves. this is the derived layer, and it is what powers the four claims below. you can read your own ledger and the claims computed from it at any time, and the thresholds behind every claim are published so you can judge them yourself.

who can see what

• only you can see your six answers, your brain dumps, and your full reading.
• only you and the two named operators of the architecture can see your behavioral signature.
• your spine word and rhythm are visible to you in your account. they are not published. if you choose to share them publicly (the share artifact at /word/your-word.your-mark), that is your choice. you may unshare at any time.
• a coach or organization sees your reading only if you say yes, to that one relationship, at the moment of assessment. consent is recorded per organization and is revocable at any time. the moment you withdraw it, every surface that was reading you goes dark. without your grant, leadership sees k-anonymized aggregate shape only, never an individual, and never below a floor of five contributors.
• the registry answers four narrow claims about you (does activity consistent with one continuous person stand behind this record, have they come back across weeks, has the pattern moved, do they currently stand behind it) and only to an organization you have granted. no grant, no claims. a claim we cannot evidence returns "not established", never a false "no".
• none of this is a consumer report. the registry is a continuity signal. it must never be used for a decision about your credit, employment or hiring, housing, or insurance, and never for a background check. anyone who queries your record agrees to that boundary as a condition of access. the full line is in our terms.

the antichrist question

jurisdiction

the architecture operates from marietta, ohio, united states. data is held under applicable united states law. if you are a resident of the european union, the united kingdom, or california, you have additional rights under GDPR / UK-GDPR / CCPA respectively. we honor those rights without requiring you to prove residency. the export and deletion endpoints above satisfy the typical requests.

changes

this page is versioned in our public source tree. material changes will be announced through the daily line and reflected here. nothing in this policy is retroactive without your consent.