Privacy Policy

1. What we collect

When you create an account, we collect your email address and a password — which we store only as an irreversible encrypted value, never as plain text. To compute your Baseline, we collect your date, time, and place of birth. We also store your chat threads and subscription status.

2. How we use it

Your birth data is used for one thing only: computing your Baseline with the NASA/JPL Horizons API. Your chat history exists to keep your conversations available to you. Your email is used for account verification, password resets, and receipts.

3. Who sees your data

We do not sell your personal data. It reaches only the providers needed to run the Service:

• Cloudflare — hosting, and the encrypted databases and storage your account lives in.
• Cloudflare AI — the model that writes your answers. When you send a message, the text you wrote, a plain-language summary of your Baseline, and a summary of any connection who has agreed to be included are sent to this model to produce the reply. It is used to generate that one answer. When you ask Sovereign whether someone else's published experience would work in your family, that post's words go to the model as well, shown only under the author's handle.
• Stripe — payments and subscription billing.
• Resend — transactional email (verification, receipts, support replies).
• NASA/JPL Horizons — the planetary positions used to compute your Baseline. Only the date, time, and place are used to ask for them, and nothing about you is stored there.

Your data — including your conversations, Baseline, and birth information — is never used to train, fine-tune, or otherwise feed any third-party AI system, and we never allow a provider to use it for their own purposes. We also actively block automated scraping of the Service (see our Terms of Service).

4. When you show your words to other people

Two features let you put what you wrote in front of someone else, and they are private in very different ways.

“Get on the same page” spaces. A space holds one topic between you and one connection you chose to link: what each of you wrote about it, plus a short picture Sovereign drafts from both Baselines. Only the two of you can open it, and it is never published anywhere — not even after you have both agreed to the picture. The other person is still a person: they can copy what they were shown, and deleting the space cannot unshow them it.

“Shared experiences”. A stream of posts that account holders write about real family situations — what happened, and what helped. The stream is openly readable — anyone can open the page without an account — because a post carries a handle and nothing else, so there is no name in it for a reader to take. Only signed-in accounts can write. The page is absent from our sitemap and tells search engines to leave it alone.

There you post under a handle like u/steady-harbor-19 instead of your name. The handle comes from your account id and a server secret run through a one-way hash, so your name, email, and account id are never written beside a post or an answer, and a copy of the database on its own does not reveal who wrote what. The same handle follows you from topic to topic so that advice has a history people can weigh — which is why we call it a pseudonym rather than anonymity, and why anyone who can read the stream can read everything you have published in it.

Email addresses, phone numbers, links, and @handles are taken out of a post before it is published. What is not taken out: real names, towns, schools, employers, and everything else that makes a situation recognisable — no program can tell a person's name from any other word in a sentence. Only you can judge what gives someone away, so write it so that a stranger could not pick you or your family out.

Nothing here changes section 3: what you publish goes to the other people in that room, and to the providers needed to show it to them, and nowhere else.

5. Where it lives, and how it's protected

Your account, Baseline, and conversations live in Cloudflare's encrypted database and storage, protected in transit and at rest. Passwords are stored only as a salted, one-way hash using industry-standard password hashing — nobody, including us, can read them back. Sign-in sessions use signed cookies that web pages can't read, and signing out or resetting your password cancels every other signed-in session on your account.

Beyond your account records, we keep a small amount of short-lived operational data in Cloudflare's storage: a counter of how many answers you've used today, throttling records keyed by a one-way hash of your IP address and, for sign-in attempts, the email address you typed (kept for up to an hour), and markers that stop duplicate payment emails from being sent (kept for up to 30 days). None of it is used to profile you and all of it expires on its own.

Server or device-only. By default your conversations are stored on our servers, so you can pick a thread up on your phone and finish it on your laptop. If you would rather your conversations never reach us at all, you can switch your account to device-only mode in Settings: your history is then encrypted on your own device with a key that never leaves it, and answers are generated and returned without being stored. In that mode, history does not follow you between devices — that is the trade. You can switch back at any time, and you can export everything first.

On your own device. A few things live only in your browser, and never on our servers:

• Your unsent message. A chat draft you typed but didn't send is kept in your browser's own local storage (under a plain label named sovereign-chat-draft, scoped to your account), so it survives an accidental reload, and is cleared the moment you send.
• Install-prompt state. If you dismiss the “add to home screen” suggestion, that choice is remembered in your browser's local storage (under the label sovereign-install-dismissed) so we never ask again.
• The device-only vault. If you choose device-only memory, your encrypted conversation history is kept in your browser's own encrypted local storage (an on-device database named sovereign-memory), with the key held only on your device — we could not read it even if we wanted to.

6. Your rights

Everything you can ask us for, you can do yourself, without asking: view, correct, export, and delete your data, all on your Account page. To update your email address, or for any privacy request you'd rather make by hand, write to sovereign@defrag.app:

• See it. “Download my data” on your Account page gives you one file with your Baseline, every conversation, your connections, the invitations you've sent, every “Get on the same page” space you are in — your side of it, never the words the other person wrote — and everything you have published under your handle in the Shared experiences stream.
• Take one post down. Every post and every answer you wrote in the stream has a “Take it down” control, and you do not have to explain it to us or delete anything else. It removes your words, the votes on them, and the answers other people wrote underneath — those live inside your post, so they go with it.
• Delete it. Deleting your account removes your Baseline, conversations, connections, invitations, passkeys, subscription, per-day usage counters, journey events, your private conversation search index, every “Get on the same page” space you are either side of, and every post, answer, and vote you left in the Shared experiences stream — immediately. There is no undo, and no copy is kept for recovery.

Two things survive a deletion, and we would rather say so than let you assume otherwise: payment records (invoices and receipts) are held by Stripe, as our payment processor and as required for tax and accounting; and if you invited someone, their side of that connection stays on their own account, showing your name and role and no other detail. Short-lived operational records also expire on the schedule in section 5.

7. Cookies, storage, analytics, and email

We use one first-party cookie: it keeps you signed in, can't be read by other websites, and expires after 7 days. Beyond that, two vendors may set their own security or checkout cookies when you actually meet their surfaces: Cloudflare Turnstile (our bot-safety check, on account creation, served from challenges.cloudflare.com) and Stripe (our payment processor). On our on-site payment form, Stripe's secure script loads from js.stripe.com and its card fields render inside Stripe's own payment frames on elements.stripe.com; when Stripe's hosted payment page is used instead (the fallback while the on-site form is not enabled), that page is served from checkout.stripe.com. Card details are typed straight into Stripe's fields and never reach our servers. We do not use advertising or third-party tracking cookies, and we do not build profiles or follow you across the web. What your own browser keeps locally is listed in section 5.

We do use two unobtrusive forms of measurement, so you know about them:

• Cloudflare Web Analytics — aggregate page views only. It sets no cookies and does not identify you.
• Email measurement — our email provider records whether a message was opened and which links were clicked. This applies to account and billing emails, and it exists to confirm delivery. If you would rather it were off, tell us and we will turn it off for your account.

Because the only cookies the Service itself sets are strictly necessary for authentication, and the third-party cookies above fire only when you interact with Turnstile or Stripe on their own surfaces, we do not display a cookie-consent banner. There is nothing optional to consent to. If we ever add a non-essential cookie (a preference or a marketing tag), a consent banner will appear first.

When the Terms or Privacy Policy changes materially, we version them and ask every existing account to re-affirm on the next visit. Your stored affirmation is a version string and a timestamp, never the text itself.

8. How long we keep things

Your account, Baseline, conversations, and connections are kept until you delete them — from your Account page or by deleting your account, which removes the rows immediately and completely. A “Get on the same page” space is kept while either of you still has an account, and goes the moment one of you deletes. What you publish in the Shared experiences stream is kept until you take it down or delete your account, and the votes on it go at the same moment. Short-lived operational records expire on their own: rate-limit and throttling counters within an hour, email-delivery markers within 30 days, unused invitation and reset tokens when their link lapses. Payment records (invoices and receipts) are retained by Stripe for as long as tax and accounting law requires. Nothing else is kept “just in case.”

9. International transfers

Sovereign OS is operated from California in the United States, and the Service runs on infrastructure located in the United States and worldwide: Cloudflare (hosting, database, AI), Stripe (payments), Resend (email), and NASA/JPL (planetary position lookups). Your personal data is therefore processed and stored outside your country, including in the United States, under the safeguards these providers publish. We send only what each provider needs to do its job, and nothing about you is retained by NASA/JPL.

10. CCPA / CPRA notice (California)

We do not sell or share your personal information as those terms are defined by the CCPA/CPRA, and we never have. The categories we collect — identifiers, commercial information, and the personal information described in Cal. Civ. Code § 1798.80(e) that you give us for your Baseline — are used only as disclosed in sections 1–5. You have the right to access, delete, and correct, and to exercise both through your Account page without contacting us. Exercising any of these rights will never cost you a lower service level or price.

11. Complaints to a regulator

If you feel we have mishandled your personal information, you may complain to the consumer-privacy authority for your region — in California, the California Attorney General; in the EU or UK, your local data-protection supervisory authority; in Canada, the Office of the Privacy Commissioner (privacycommissioner.gc.ca). We would rather hear from you first — write to sovereign@defrag.app and a real person will read it.

12. Responsible disclosure

Found a security issue? Tell us privately at sovereign@defrag.app (our security.txt carries the same address) before disclosing it publicly, and we'll work to fix it fast. Please don't probe other people's accounts or data — that is the one thing the Service never tolerates.

13. Children's privacy

The Service is not directed to individuals under 18, and creating an account requires an affirmation that you are at least 18 (see our Terms of Service). We do not knowingly collect personal information from minors.

14. Contact

Questions about this policy can go to sovereign@defrag.app or our support page.