Privacy Policy

Last updated: 2026-07-17 (v0.1.0).

1. What we collect

Account information: your email address and password (hashed by Supabase Auth, our real-mode authentication provider). Profile information: display name and timezone. Coaching data: session transcripts, artifacts, progress snapshots, and intake responses you share with Ari.

In real mode, account and coaching data is stored in Supabase (PostgreSQL with row-level security). In demo mode, data stays in the local demo environment and is never sent to any external provider.

2. How conversations are processed

In real mode, your coaching conversations are processed by OpenAI's API. Per OpenAI's API terms, API data is not used to train their models. No third-party model provider beyond OpenAI is used. In demo mode, conversations stay in the local demo environment and are never sent to any external provider.

3. Analytics are metadata only

We use analytics to understand how the program is used. Analytics events contain only metadata (event name, segment, severity bucket, SKU, value) — never message content, quiz free-text answers, email, names, or transcript text. Autocapture is disabled so form inputs and message content are never automatically collected.

In real mode, analytics are captured by PostHog. PostHog receives only the metadata described above and is not used to train AI models, including It Takes One's coaching models or any third-party model. PostHog's session replay and autocapture features are disabled so no message content, quiz answers, or other free text is ever sent to PostHog.

4. Data retention and financial records

We retain your coaching data while your account is active and after deletion only as required for financial-records compliance. Stripe customer records are retained per financial-records norms even after account deletion; coaching data linked to your account is removed.

5. Account deletion

You can delete your account from Settings. Deletion is permanent and cascades to your profile, assessments, sessions, messages, artifacts, rehearsal profile, progress snapshots, user context, and crisis events. Recreating an account with the same email starts fresh; prior settings, entitlement, archives, and progress are not restored.

6. Data export

You can request a manual export of your data by emailing support@ittakesone.co. Exports are delivered manually.

7. Discretion

It Takes One is password-protected. We do not send marketing emails in this MVP. Browser titles use the configured product name. Crisis and safety resources are always accessible without an account.

8. Contact

Privacy questions? Email support@ittakesone.co.