Privacy

What we store

Your email address, the answers you give during onboarding, everything you write in your journal, your conversations with your future self, your goals, and your profile photo if you add one. Alongside that: the messages, affirmations and missions generated for you and their voice recordings, which days you opened the app, and your subscription status.

Your journal entries are the heart of it. They are also what makes the product work — what you write is what your future self later remembers.

We also store when you agreed to our Terms and this policy, and to which version, so we can show you consented and ask again if they change.

SitWeHere is for people 18 and older. We do not knowingly hold data about anyone younger; if you believe we do, email us and we will delete it.

Who can read it

You. Every table is protected by row-level security, so one account cannot read another account's rows even through a bug in our own code.

We do not sell your data, and we do not use your journal to train anyone's models.

Who we send it to

These are the companies that receive or hold your data, what each one gets, and where it is. If we add one, it is added to this list before any of your data reaches it.

Supabase (our database, sign-in and file storage; servers in Ireland): everything in your account. Your profile, journal, reflections, conversations, memories, messages and their recordings, goals, photo and subscription status.

Vercel (runs the app and website; servers in Ireland, company in the United States): every request passes through it, including your IP address. It also counts page views for us, without cookies.

OpenAI (United States): the context needed to write for you. Recent journal excerpts, memories, your onboarding answers, your conversations with your future self, and your voice recordings when you speak instead of typing, which it turns into text. OpenAI's API terms say this data is not used to train their models.

Google Cloud (United States): the text of messages to be spoken aloud, when your voice is one of the Google voices, which most are.

ElevenLabs (United States): the text of messages to be spoken aloud, when you choose one of its voices on Premium. If you use a recorded voice of your own, the recording you make for it, which you can delete from Settings at any time.

PostHog (servers in the European Union): which screens were opened and which features were used. If you accept analytics cookies, that is linked to your account when you are signed in. If you decline, or have not chosen yet, it is counted anonymously, without storing anything on your device. Some events our server records, like signing up or subscribing, carry an identifier for your account either way. It never receives what you wrote. The setting that would let it capture the text on your screen is switched off in our own code, not just in a dashboard someone could switch back.

TikTok (its advertising service; data processed in other countries): only if you accept cookies. Which pages of our website and app you open, and whether you created an account or started a paid plan, so we can tell which of our TikTok ads led to that. When you create an account, it also receives a scrambled (hashed) copy of your email address and of an identifier for your account, which TikTok uses to match the sign-up to an ad you saw. It never receives what you wrote.

Resend (United States): your email address and the emails we send you (sign-in, password reset), and anything you send us through the contact form.

Paystack (Nigeria): your email and card details when you add a card or subscribe. Paystack keeps the card, so the plan you chose can be charged when your free days end and each time it renews. Never your writing. We never see or store your card number.

Flutterwave (Nigeria) and Stripe (United States): only if we move payments to them; nothing is sent to either today. Never your writing.

Google Play (United States): only if you subscribe inside our Android app. Google takes the payment and tells us which plan you bought and whether it is active. We never see your card.

Google (United States): only if you choose to sign in with Google, when Google confirms your email address to us.

Push notification services from Apple, Google or Mozilla, depending on your device: only if you turn notifications on, and only a short notice or reminder, never anything you or your future self wrote.

That is the complete list. Nothing goes anywhere else, and we do not sell your data to anyone.

Cookies and storage on your device

Some things are stored because the app needs them to work, and some only if you say yes. Nothing on your device is ever used to show you ads.

Needed for the app to work: the cookies that keep you signed in, one that remembers whether you ticked "Remember me on this device", and one that remembers your accessibility settings so the app looks right from the first moment it opens. In your browser's storage: whether you have turned the background sound off, a journal entry or a message to your future self that you have started but not sent, so it is still there if you leave, entries written while offline, until they are saved, copies of a few screens so the app can still open when you have no connection, and your answer to the cookie question below.

Analytics cookies, only if you accept them: PostHog stores an identifier so it can recognise your browser between visits, and links it to your account when you are signed in. That is how we learn which parts of SitWeHere get used. If you decline, or until you choose, PostHog counts visits anonymously with nothing stored on your device. Vercel counts page views without cookies either way.

Advertising cookies, only if you accept them: TikTok's Pixel stores an identifier so TikTok can tell whether someone who saw one of our ads went on to sign up or subscribe, and we keep the code from the ad you tapped for 30 days for the same reason. If you decline, TikTok's code is never loaded.

You can change your answer at any time: Cookie settings at the bottom of every page of this website, or in the app under Settings, then Privacy & Data. Signing out asks again, so the next person to use a shared device makes their own choice.

Clearing your browser's data removes all of it. You would need to sign in again, an unsent draft would be lost, and you would be asked about cookies again.

Where your data is kept

Your data is stored in Ireland, in the European Union. Some of the providers above are based in the United States. So wherever you live, your data may be processed in a country other than your own.

Each provider gets only what it needs for its job and protects it under its own security and privacy commitments. Everything travels encrypted.

Email

Sign-in and account emails are sent because you asked for them. Anything else — occasional news about the app — only happens if you tick the box, and you can withdraw that in one tap from the unsubscribe link or the Notifications screen. Not re-ticking a box never counts as withdrawing.

Taking it with you, or deleting it

Settings, then Privacy & Data, gives you a full export of everything we hold as one downloadable file. The same screen deletes your account and its contents.

There is also a reset that clears the identity your future self was built from while keeping your journals, memories and history — for when your direction changes but you do not want to lose the record of showing up.

This is not a medical service

SitWeHere is not therapy, counselling, or crisis support, and nothing it says is medical advice. If you are in danger or in crisis, contact your local emergency services or a crisis line in your country.