What we keep, what we don't.

HealthBrew is a nightly habit tracker and journal. We collect only what we need to run that ritual for you. We don't sell your data. We don't advertise to you. We don't share what you write in your journal with anyone, ever, outside the AI calls that produce the insights you ask for.

Washington-state residents and other consumers covered by health-data laws: see our Consumer Health Data Privacy Policy for the additional disclosures required by those statutes.

The minimum we collect is the maximum we'll ever have.

• An email address (for login and transactional email).
• An avatar nickname you pick.
• Your timezone, so the 6pm reminder lands at your local 6pm.
• What you write in your nightly Close-the-Day check-in, your journal entries, and any milestones you log.
• If you add child profiles: a nickname and age range. No legal name, weight, BMI, calories, exact sleep duration, or biometric data, ever.
• Subscription status from LemonSqueezy (active / cancelled / past-due). That's the entire field.
• Standard operational data: rotating IP address (rate-limiting and security), browser type, session timestamps.

• No legal name. Not at signup. Not at checkout. Not ever.
• No mailing address.
• No date of birth.
• No gender, race, or ethnicity.
• No Social Security or government ID number.
• No genetic data (we have no DNA upload feature).
• No continuous location data. Stated timezone only.
• Nothing from a child profile beyond the nightly five-item ritual and the “what made you smile today” line.

Most apps collect your legal name, address, and date of birth at signup because their payment processor demands it. We split those two jobs.

LemonSqueezy IE (an Irish company, lemonsqueezy.com) is the merchant of record for every HealthBrew subscription. They collect your legal name, billing address, and tax jurisdiction — they have to, for card processing, sales tax, and chargebacks. That data lives with them, under their privacy policy.

HealthBrew receives exactly one thing back from LemonSqueezy: subscription status, keyed to the email you signed up with. Your name and address never reach our database. We could not produce them if asked, because we never received them.

This is data minimization as architecture, not as a promise. Verifiable in our schema, which is public in git.

We've chosen to use Anthropic as our AI frontier model that we're building on because so far it appears to have the highest morals and ethics as a company, since it refused its AI from being used to do harm by the US Department of Defense.

• To run your nightly ritual and remember it for you.
• To send your daily 6pm reminder, if you have that turned on.
• To pass your check-ins and journal entries to Sophia (our AI companion) when you save an entry — so her replies reflect what you actually wrote. We send only your recent context, never your email or identifiers.
• Your chats with Sophia are not kept. We don't save the back-and-forth. From a chat, Sophia keeps only a short, paraphrased note of what might help you — never your exact words. If a message suggests you're in crisis, we keep that one message so a person can follow up safely.
• To compute the weekly insight summary.
• To bill you through LemonSqueezy after your free 10-close baseline if you keep going.

We do not share your data with advertisers, data brokers, insurance companies, or employers. We do not use what you write for advertising, behavioral profiling, data sales, or anything else.

• Export — download a copy of everything you've written, anytime. (Dashboard → Exports.)
• Delete — close your account from your settings; we delete every row tied to your user_id within 30 days, across check-ins, journal, milestones, your paraphrased Sophia notes, and child profiles. (We don't store raw Sophia chats, so there's no transcript to delete.)
• Correct — edit any entry, anytime. (There's no “legal name correction” right to exercise here, because we don't hold a legal name. Billing-name corrections happen at LemonSqueezy.)
• Change your email — from Settings. This is also how you change the key identity we hold for you.
• Opt out of the daily reminder — one toggle, no friction.

These rights apply globally. We don't make EU users jump through a different hoop than California users than Texas users. The right thing is the same everywhere.

We do not knowingly collect data directly from children under 18. Child profiles are parent-owned — the parent holds the email and password; the child has a nickname and an age range, nothing else. They use the app on a shared device with you watching. We never collect a child's legal name, weight, BMI, calories, or biometric data, ever.

If you believe we've accidentally collected data from a child under 18 outside the parent-owned model, write to [email protected] and we'll delete it.

We use one cookie: the Supabase session cookie that keeps you logged in. No analytics cookies, no ad cookies, no third-party tracking. That's it.

We'll email you before any material change. The previous version stays in our git history forever, public, so you can audit what changed and when.

Email [email protected] or just reply to any HealthBrew email. A human reads it.