Privacy

Last updated July 21, 2026.

Therapy is a one-person project, built and run by Joel Sandén. This page describes, in plain language, what data the app collects, what it's used for, who else sees it, and what to do if you want it gone. If anything here is unclear, email me@joelsanden.se — that's a real inbox, not a form that goes nowhere.

Two very different ways you might use this

Most of what Therapy offers — the technique library, session history, mood check-ins — works as an MCP connector inside Claude. When you use it that way, your actual conversation happens inside Claude, and is governed by Anthropic's own privacy policy, not this one. What Therapy's own servers see from that is narrow: which tool Claude called, whether it succeeded, how long it took, and — for technique-related calls — which technique. Never the conversation itself, never your prompt, never Claude's reply.

The paid tier adds a second surface: an in-app AI chat and generated insights/reports that run on Therapy's own servers, not inside Claude. Those are covered in more detail below.

What we collect

Account. Email, and optionally a name/avatar if you sign in with Google. You can also use the app as an anonymous guest without an email at all. If you later sign in for real, your guest data is merged into the new account and the anonymous one is removed. If you never convert it, it isn't automatically deleted — it just sits there like any other account until you ask us to remove it (see Retention and deletion).

Sessions. Signing in creates a session record: a session token, an expiry, and — standard for most web sessions — the IP address and browser user-agent used to sign in. This is what keeps you logged in; it's not used for tracking beyond that.

What you actually log. Mood check-ins (a 1-10 rating plus an optional note), technique usage (which technique, when), and conversation summaries — a short recap Claude writes at the end of an MCP session, not a transcript; the actual conversation happens inside Claude and never reaches our servers at all. This is the data the free tier and most insights are built from. The in-app chat feature (paid tier) works differently — see the next paragraph.

Paid-tier extras. If you're on With Insights: cached AI-generated insights (themes, technique effectiveness, patterns), sent progress reports, your report cadence preference, and — unlike the session summaries above — the full message history of any in-app chat you use, stored as-is so the conversation can pick back up later.

Billing. A Stripe customer ID and a mirror of your subscription — plan, status, renewal dates, and whether you've opted into overage billing — not your card number. See Payments below.

Usage metering. For paid AI features, we record how many tokens each call used — never the prompt or the response, just the count, so usage can be billed accurately.

We do not run any analytics, advertising, or behavioral-tracking script on this site. The only cookies we set are our sign-in system's own — a session cookie plus a couple of short-lived helper cookies used during the sign-in flow itself — nothing for tracking.

How the AI features handle your data

These paid features call a language model on our own servers (not inside Claude), routed through the Vercel AI Gateway. We pick a model per feature mainly for cost and capability, and that choice — including which company's model it is — can change over time. Rather than name a specific provider here and risk this page going stale the next time we do, here's what's actually configured right now:

• openai/gpt-5-mini — In-app AI chat
• amazon/nova-micro — AI insights: themes & emotional trajectory, AI insights: technique effectiveness, AI insights: patterns, triggers & goals, Weekly & monthly email progress reports, Summaries of your in-app chat conversations, Pattern-triggered session-invite emails, Your personal check-in tag suggestions

Insights (themes, effectiveness, patterns) and progress reports are built from your saved summaries and check-ins, put through a filter first, every time:

• Email addresses and phone-number-like text are stripped out automatically before anything is sent. This is a best-effort filter, not a guarantee — please avoid typing someone else's contact details into a note if you can help it.
• You're addressed only as "the user" in these prompts, never by name.
• Timestamps are collapsed to the day, never the exact time.

In-app chat works more like an ordinary AI chat product — what you type goes to the model close to as-is, in real time, so we don't run the same filtering step there. If you ask the assistant to look something up (a past session, a check-in), the tool result — including its exact timestamp — becomes part of what the model sees for that reply. If you'd rather keep something out of a chat prompt entirely, not mentioning it there is the more private option, or use the MCP connector inside Claude instead, which never reaches our model-calling code at all.

Crisis-safety detection in in-app chat — the in-app chat scans your message text for language that may indicate acute distress or self-harm risk, using a deterministic keyword match — not a clinical or diagnostic assessment — so it can proactively lead its reply with crisis-support resources (a local hotline number). Only a content-free record that this check occurred is stored (never the message text itself). This check runs only for the in-app chat, not for conversations through the MCP connector in Claude.

Across both: prompt and response content is never logged or stored by us beyond what's already described on this page — there's no separate "AI request log." What we keep afterward is a token count, for billing, and — for insights — the resulting structured output (e.g. "recurring theme: work stress"), not the raw text that produced it. In-app chat is the one exception: the messages themselves are kept in full as your chat history, as described above, so the conversation can continue later.

None of this is a clinical read on you. It's reflection tooling built on top of what you've already shared — it doesn't evaluate, diagnose, or treat anything. See how the insights actually work for the full picture, including what they can't tell you.

Who else sees it

We don't sell data, and we don't share it for advertising. The below are the outside services this app relies on to run at all — each sees only what it needs to do its job:

• Neon — hosts the Postgres database everything above lives in.
• Vercel — hosts the app itself, and routes AI model calls through the AI Gateway described above.
• Anthropic — the free tier runs inside Claude, Anthropic's product; see Two very different ways you might use this.
• Whichever model provider(s) are configured for paid AI features — see the live list in How the AI features handle your data, which is the one place on this page that names a specific model, kept accurate automatically rather than hardcoded here.
• Resend — sends the three kinds of email this app sends: a sign-in link when you log in, (paid tier, opt-in) progress report emails, and (paid tier, opt-in) check-in reminder emails.
• Stripe — handles all payment processing for the paid tier.
• Google — if you choose to sign in with Google rather than email.

Payments

If you subscribe to the paid plan (With Insights), Stripe handles the actual payment. We never see or store your card number — only a Stripe customer ID and your subscription status (active, canceled, and so on), which is how the app knows what you're entitled to.

Emails we send

Three types: a sign-in link when you log in without a password, a weekly or monthly progress report (paid tier, opt-in), and a daily or weekly check-in reminder (paid tier, opt-in). Every email that's recurring has a one-click unsubscribe link that works without logging in, and the same toggling is in your account settings. Turning off any of these doesn't touch any saved session or check-in data — it only stops those specific emails.

Check-in reminders — an optional email that nudges you if you haven't logged a mood check-in yet during the current day (if you picked daily) or the current week (if you picked weekly). It's off by default, and only runs for paid subscribers who've explicitly enabled it. If you've already checked in that period, the reminder won't send — it's meant to gently help a habit form, not add pressure. Like progress reports, each reminder carries a one-click unsubscribe link that works without logging in.

Retention and deletion

Right now, deleting your account isn't a self-service button in the app yet — email me@joelsanden.se and ask, and we'll delete it. The data model behind the app is built so that once an account is deleted, everything tied to it — sessions, check-ins, conversation summaries, cached insights, reports, chat history, usage records — is deleted along with it in the same operation, not left behind in some other table.

If you'd rather just stop receiving something specific, see Emails we send above for reports, or email us for anything else.

Your choices

• Use it anonymously. You don't need to hand over an email to try the free tier.
• Ask what we have. Email us and we'll tell you.
• Ask us to delete it. See Retention and deletion.
• Turn off emails. See Emails we send.

If you're in a jurisdiction with specific data rights (for example the EU/UK's GDPR or California's CCPA) and want to exercise them formally, email us and we'll do our best to help — this is a small, independently run project rather than one with a dedicated legal/privacy team, so please be patient with us.

Not a clinical service

Therapy — the app and this policy both — is reflection tooling, not clinical assessment, diagnosis, or treatment, and using it doesn't create a relationship with a healthcare provider. If you're struggling, please consider reaching out to a qualified mental health professional, or, if you're in crisis, a local emergency service or crisis line.

Changes to this page

If this policy changes in a way that matters, we'll update the date at the top. Checking back occasionally is the best way to stay current.

Contact

me@joelsanden.se — for anything on this page, including data requests and deletion.