Back to home
Legal

Privacy notice

Last updated: 16 September 2026

The short version: We collect what's needed to run the service and improve it. We don't sell your data. Your conversations stay yours: nobody here reads them, except at three kinds of moment described below, which are written down as a record. You can download everything you wrote and delete your account whenever you want. Section 6 lists the few things a deletion deliberately leaves behind.

1. What we collect

Account data

Coaching content

Three moments we write down in full

This one is different from everything above, and we would rather say it plainly than bury it. As said above, your conversations are not sent to us at all: we hold a summary and nothing more. Three kinds of moment are the main exception to that, and the only one that happens without you choosing it. They are written down as a record, in full, both halves, meaning what you wrote and what your coach answered. Those exchanges do reach our servers and are kept, so they can be looked at if they ever have to be.

Nothing else from the conversation comes with it. Not the message before, not the one after, not the rest of the session. One exchange, and only when it falls into one of those three.

There is one other way a line from a conversation reaches us, and you do it deliberately: if you save or copy something your coach said, or something you wrote, that line is kept so you can find it again later. It goes with your account and it goes when you delete your account.

Why we keep them: if it is ever asked what this product told somebody at a moment that mattered, there should be an answer, and it should not depend on anybody's memory. It is also how we find out when the coach handles one of these badly, which is the only way it gets better.

Who reads them: nobody at Clarior browses these for interest, and they are not part of support. Two things do happen to them. If a complaint or a legal question is ever raised about what your coach told somebody, we look at the record for that person, which is the reason it exists. And we read them to find the times a coach handled one of these three moments badly, because that is the only way it gets better. A small number of people here can do both.

How long we keep them, and whether they survive deleting your account, are not settled yet. We are taking advice on it. When it is decided this page will say so plainly, and we will tell you before it changes.

That you agreed to this

When you sign up we write down that you agreed to these notices, when, and which version of each one you were shown. It is your account, a date, and two dates saying which wording was live at the time. Nothing you wrote is in it, and you cannot change it, which is the point: a record of somebody agreeing that the same person could edit afterwards would not be worth keeping. It means that if you ever ask what you agreed to, we can show you the exact words rather than whatever this page happens to say today.

Technical data

Unfinished sessions

A coaching session you leave unfinished stays open for seven days and then closes by itself. So that we can write to you before that happens, we keep a short record of the open session on our servers. That record contains only which account it belongs to, which session it is, how far through the conversation you reached, when it started, and when you last sent a message in it.

It never contains your messages, the coach's replies, or any part of what was said. We use it for one thing: a single email, sent about two days before the session would close, so you have the chance to come back and finish it. The record is deleted once the session ends, whether you finished it yourself or it closed on its own. You can switch these emails off at any time in Settings, under Rhythm, with the switch called Session Reminders.

Your device, and what breaks on it

We keep a short technical record: which browser and version you use, whether you are on a phone or a computer, your screen size, your language, and your timezone. We also keep the last few errors the app hit on your machine, meaning what failed and on which screen. This is how we answer you when you tell us something is not working.

We keep your IP address for thirty days, and then it is deleted automatically. We use it only to spot abuse, such as one person creating many accounts. We do not use it to work out where you live, and we do not store your city or any location beyond the timezone your browser reports.

The error records contain what failed, never what you wrote.

What you did, and when

We keep a short list of actions you take in the app: that you started a session, opened a measure, changed a score on your circle, added something to your basket. Each entry is an action and a time, plus the name of the thing it happened to, such as which measure or which part of your circle.

It never contains what you wrote, what you answered, what you scored, or anything the coach said. Two people use it. Your coach reads patterns from it, so it can notice things like work you set aside or a stretch where you did not come back. Our support team can see the list for your account when you contact us, so that a question like "it did not save" can be answered without asking you to remember what you pressed.

It lives with your account, comes out in your data export, and is deleted when you delete your data.

2. How we use it

We use your data to:

3. Where it lives

Your data is stored on managed cloud infrastructure (Supabase). Backups are encrypted at rest. We use HTTPS in transit. AI inference goes to Anthropic (Claude) for the AI processing. Your messages are sent in real time and Anthropic's data policies apply on their end.

Knowing when something breaks

The app checks itself constantly while you use it: around forty small rules about whether a number adds up, whether a screen is showing what it should, whether something you typed was saved. When one of those rules is broken, the name of the rule is sent to us, along with which screen you were on and roughly which browser you use. That is the whole list.

We do not receive anything that identifies you, not even an anonymous identifier, so we cannot tell whether one person met the same fault ten times or ten people met it once. We also do not receive the details the check produced, which often include your own numbers. "The progress figure disagrees between two screens" is a fact about our software and is sent; the figures that disagreed are yours and stay in your browser. Nothing you wrote, nothing from your brief, and nothing from a session is ever part of this.

Checking a password against known breaches

When you choose a password, we check whether it already appears in public data breaches, because a password that has leaked elsewhere is the first thing an attacker will try here. Your password is never sent anywhere. It is converted into a fingerprint inside your own browser, and only the first five characters of that fingerprint are sent to the Have I Been Pwned service, which returns every leaked fingerprint beginning with those five characters. The comparison happens in your browser. Those five characters match many thousands of different passwords, so the service cannot work out which password you chose, or whether you were checking one at all. If the service cannot be reached, your password is accepted and nothing is blocked. You can read their commitments at haveibeenpwned.com.

4. Who sees it

Within Clarior, only the small team operating the service has access, and only when investigating a support request, debugging an issue, or as required by law. There is one addition, described in section 1: a small number of us read the record of those three moments, either because a complaint has been raised about what a coach told somebody, or to find the times a coach handled one of them badly. That is the only reading of anybody's words that happens here, and it is limited to those exchanges. We do not sell your data. We do not share it with advertisers. We do not look at your conversations for fun or for content moderation other than safety screening required by law.

5. Your rights

You can:

6. Retention

We keep your coaching content as long as your account is active so coaches retain context. After account deletion, content is removed from primary storage immediately and from encrypted backups within 30 days.

Deleting your account removes your login and everything you wrote: your sessions, your brief, your coach, your goals, habits, homework, journal, notes and plan. If you had asked to be told when we opened, that request goes too.

Four things are deliberately left behind, and none of them contains anything you wrote. The record that a safety check fired and which helpline you were shown, described above. The note of which member of staff deleted the account, so that what was done to it cannot be erased along with it. A payment record with your name taken off it, kept because tax rules require us to account for money that moved, and reduced to an amount, a date and a plan belonging to nobody. And one line saying an account ended, how long it lasted, which plan it was on and how far through the brief it got, with your email address replaced by a fingerprint of it: we cannot read that fingerprint or use it to list who left, but if you write to us later about something, the address you give can be matched against it so we can answer you.

The one thing still being decided is the record of those three moments, described above. We are taking advice on whether it should be deleted with your account, and this page will say what was decided.

7. Children

Clarior is not for users under 16. We don't knowingly collect data from anyone younger. If you believe a child has created an account, contact us and we'll delete it.

8. AI processing: what to know

Your conversations are sent to Claude (Anthropic) to generate coach responses. We do not use your conversations to train AI models without your explicit consent. That is a narrower promise than it sounds, so it is worth separating two things. Training means your words changing how the model itself behaves, and that does not happen. Separately, a small number of us read the record of those three moments, described in section 1, to find the times a coach handled one badly and to change the written instructions it works from. That is people reading a handful of exchanges and rewriting guidance, never your words going into a model. Anthropic's API policy at the time of writing also commits to not training on customer API content; you can verify their current commitments at anthropic.com.

Research consent: If you opt in to the research setting in Settings, which asks whether anonymised parts of your sessions may be used to improve coaching, we may use de-identified, aggregated excerpts to improve coaching quality. This is off by default. You can withdraw consent at any time from Settings.

9. Security incidents

If we discover a breach affecting your data, we'll notify you within 72 hours of confirming it and tell you what happened, what's affected, and what we're doing about it.

10. Changes to this notice

We'll notify you by email or in-product when we make material changes. Continued use after notice means you accept the updated notice.

11. Contact

For privacy questions or to exercise any data right, email info@clarior.ai.

Note: This is a starter template, not legal advice. Have a privacy lawyer review before launch (especially if you have EU, UK, or California users).