Privacy Policy

Last updated: 2026-07-17 (v0.1.0).

1. What we collect

Account information: your email address and password (hashed by Supabase Auth, our real-mode authentication provider). Profile information: display name and timezone. Coaching data: session transcripts, artifacts, progress snapshots, and intake responses you share with Ari.

In real mode, account and coaching data is stored in Supabase (PostgreSQL with row-level security). In demo mode, data stays in the local demo environment and is never sent to any external provider.

2. How conversations are processed

In real mode, your coaching conversations are processed by OpenAI's API. Per OpenAI's API terms, API data is not used to train their models. No third-party model provider beyond OpenAI is used. In demo mode, conversations stay in the local demo environment and are never sent to any external provider.

3. Analytics are metadata only

We use analytics to understand how the program is used. Analytics events contain only metadata (event name, segment, severity bucket, SKU, value) — never message content, quiz free-text answers, email, names, or transcript text. Autocapture is disabled so form inputs and message content are never automatically collected.

In real mode, analytics are captured by PostHog. PostHog receives only the metadata described above and is not used to train AI models, including It Takes One's coaching models or any third-party model. PostHog's session replay and autocapture features are disabled so no message content, quiz answers, or other free text is ever sent to PostHog.

We do not load any third-party analytics script in your browser. Page views are recorded by our own server (page path and referring site only, never the full address or anything you type). To count visits consistently we set one first-party cookie containing a random identifier; it holds no personal information, and if you create an account it is linked only to your account's internal id, never your email or name.

4. Data retention and financial records

We retain your coaching data while your account is active and after deletion only as required for financial-records compliance. Stripe customer records are retained per financial-records norms even after account deletion; coaching data linked to your account is removed. If you pay before creating an account, we keep the email you paid with and the payment reference so the purchase can be attached to your account; you can ask us to delete that record at any time.

5. Account deletion

You can delete your account from Settings. Deletion is permanent and cascades to your profile, assessments, sessions, messages, artifacts, rehearsal profile, progress snapshots, user context, and crisis events. Recreating an account with the same email starts fresh; prior settings, entitlement, archives, and progress are not restored.

6. Data export

You can request a manual export of your data by emailing support@ittakesone.co. Exports are delivered manually.

7. Discretion

It Takes One is password-protected. We do not send marketing emails in this MVP. Browser titles use the configured product name. Crisis and safety resources are always accessible without an account.

8. Contact

Privacy questions? Email support@ittakesone.co.