Plain language. No legalese. Last updated August 19, 2026.
When you create an account we collect your email address and the password you choose (which we never store as plain text — it's hashed with bcrypt).
When you use the app we store the thoughts you write and the reframes generated for you. That's it. No analytics on the content of your entries.
Your entries live in a managed MongoDB database that only our backend can reach. Every reframe — the thought, the heading, the body, the anchor — is encrypted before it touches the disk using authenticated symmetric encryption (Fernet / AES-128-CBC with HMAC-SHA256).
Even if someone got a copy of the database file, your entries would read as random text without the key, which lives only on our server.
Every read, write, and delete is scoped to your authenticated user ID on the server. There is no community feed, no sharing, no "see what others reframed today" feature — and there never will be. This product has no social surface area by design.
Our team does not browse user journals. We have no admin "view as user" tool. If we ever need to debug a specific bug a user reports, we ask first, work only on the metadata, and never decrypt entries.
We will never sell your entries. We will never share them with advertisers, data brokers, or any third party. We will never use your entries to train an AI model — ours or anyone else's. If that ever changes, this page will say so first, and you'll get an email before it does.
To generate a reframe, your thought is sent from our backend to Anthropic's Claude API. The Anthropic API key is stored as an environment variable on our server — it is never exposed in the frontend code or in any response sent to your browser.
Per Anthropic's published API terms, Anthropic does not use API inputs or outputs to train its models, and prompts/responses are not retained beyond what is required to deliver the response. You can read their terms at anthropic.com/legal/commercial-terms.
In your journal, every entry has a Remove link that permanently deletes it from our database.
On your account page, the Delete account button permanently erases your account and every reframe, every journal entry, every payment record, every session. It cannot be undone, and we don't keep "soft delete" copies.
Subscription payments go directly to Stripe. We receive only the result of the charge (success/failure, plan, expiry). Your card number, CVC, and billing address are handled by Stripe and never touch our servers.
Questions about privacy, requests to export your data, or anything else? Write to privacy@111collective.app.