Privacy policy

Anchorly is a support companion, not therapy or a diagnosis. The most sensitive things you might tell it (chat messages, journal entries, drafts, reframe-tool input) are encrypted before they’re stored, are never bulk-read for analytics, and are used only to support you. You can export everything you’ve saved or delete it all, at any time, from Settings.

• Account basics: your email address (via Supabase Auth) and account timestamps. Password authentication is handled by Supabase Auth. Anchorly never sees or stores your raw password.
• Preferences: ADHD mode, notification preferences, and your crisis-resources region. The region is something you set manually in Settings; it is never derived from your device’s location.
• Your attachment-track result: the outcome of the self-reflection flow (or a manual edit), plus your tap-answers so you can see why. This is not a clinical diagnosis and is computed by a simple, deterministic scoring rule, not AI.
• Check-ins: mood/state tags, situational tags (e.g. “delayed reply”), and an optional free-text note.
• Free-text content: chat messages with Sage, reframe-tool input, drafts you write in the draft-and-pause tool, and journal entries.
• Screenshots you attach: if you attach an image (e.g. a screenshot of a text conversation) to Sage (the AI companion) or the reframe tool, we store the image itself and the text our OCR step reads from it. Images are kept under the same retention as your other content (see “How long we keep things”), but you can delete any individual image at any time from a “Delete this image” control shown right next to it. That removes the image and its extracted text immediately, not just from view.
• Crisis-detection events: if something you write matches our crisis wordlist, we log the timestamp, which feature it happened in, and how serious the match was, never the text itself. See “Crisis detection” below.
• Billing: if you subscribe to Anchorly Plus, Stripe (our payment processor) handles your card details directly. Anchorly never receives or stores your full card number. We store your Stripe customer/subscription IDs and plan status.
• Push notifications: if you turn these on, we store the subscription endpoint your browser gives us. The notifications themselves are always short, fixed, pre-written copy (e.g. “Want to talk for a minute?”), never your actual written content.

Everything is encrypted at rest at the infrastructure level. On top of that, the specific columns that hold your free text (chat messages, journal entries, drafts, and reframe-tool input/output) are encrypted a second time at the application layer (AES-256-GCM) before they’re ever written to the database. Even someone with direct database access can’t read that text without the encryption key, which is held separately in the hosting platform’s secret manager, never in application code. Decryption only ever happens server-side, one row at a time, to render it back to you specifically. There is no bulk-decrypt path anywhere in the codebase, including for analytics.

Every table that holds your data enforces row-level security at the database level: your account can only ever read or write rows that belong to it, independent of and in addition to anything the application code does.

Free-text you write in Sage, the reframe tool, check-in notes, journal entries, and drafts is checked against a wordlist for crisis-related language, using plain rule-based matching. It is not AI, and nothing is sent anywhere for that check. The same check runs on the text our OCR step reads out of any screenshot you attach, before that image is ever analyzed further, so crisis detection doesn’t skip images. If something matches, you’re shown crisis resources immediately. We log that this happened (timestamp, which feature, how serious) so we can review how well the detector is working over time, but we deliberately do not store the specific text that matched, only the fact that something did.

Anchorly doesn’t sell your data, and doesn’t use it for advertising. A small number of services process it on our behalf, only for the purpose of running the app:

• Supabase hosts our database and handles authentication.
• Anthropic processes your message (and any screenshot you attach to it) when you use Sage or the reframe tool, in order to generate a response, under Anthropic’s own API terms.
• Text extraction (OCR) from an attached screenshot runs entirely on our own server. No third-party OCR service ever sees your images. The only thing fetched from outside our server for this is a generic, one-time language-recognition file with no user data in it at all, bundled with the app rather than downloaded per image.
• Stripe processes payments if you subscribe to Anchorly Plus.
• Your browser’s push service (e.g. Mozilla or Google’s infrastructure) relays push notifications if you’ve turned them on. As noted above, these never contain your own written content.

People you add (Plus): if you add someone in People, we store the nickname you choose (never a full name or contact details), the relationship type, your own impression of their style, the entries you log about what happened and how you reacted, and an “About us” note Sage keeps from them. All free text is encrypted. It is your own record: used only to support you, never shared with or used to contact that person, never used for analytics or training, and never matched across users. Sage treats it as your account of your experience and never uses it to tell you what the other person thinks, feels, or will do. You can delete any entry, any person, or all of it at any time.

From Settings, at any time: export everything you’ve saved (as JSON or a readable PDF), or delete your account and data. Deletion is prompt, not a “request and wait” process: your encrypted content (chat, journal, drafts, reframe history, people and their history, your notes) is removed immediately on confirmation, and the rest of your account is fully purged within 30 days.

Conversations with Sage, reframe history, and the relationship entries you log are deleted automatically after 6 months, or 3 if you choose that in Settings. Your “About me” and “About us” notes, which carry forward what Sage has learned, stay until you edit or delete them. Journal entries, drafts and check-ins are kept for as long as your account exists, unless you delete them.

If this changes in a way that affects how your data is handled, we’ll update this page and, for material changes, tell you in the app directly rather than relying on you finding this page.