Privacy

The short version

The Mirror, Separation, and Duality keep nothing unless you choose to keep a Mirror session.
Everything you write, record, or keep is encrypted with a key that belongs to your account alone.
Nothing is public unless you publish it, one entry at a time, and you can take it down whenever you like.
Your words are sent to AI providers only to answer or map them — never sold, never used for advertising.
You can download everything, or erase everything, from your Account at any time.

Without an account

The Mirror, Separation, and Duality work without signing in. What you type is sent to Anthropic to produce each reply. The Mirror also sends your words to OpenAI to read their structure. We don’t save these conversations to your account unless you choose to keep a Mirror session. Otherwise the conversation lives in your browser tab and disappears when you close it. Provider retention is described below.

Duality remembers word pairs (like “hot → cold”) in your browser and, briefly, in our server’s memory, so the same word needn’t be asked twice. If you choose “Keep it — create account” at the end of a Mirror session, the session waits in your browser for up to two hours while you sign up, then is saved to your new account or cleared.

What an account keeps

Who you are: your name, email address, the date you joined, any intentions you chose when you joined (we no longer ask), your Mirror preference, and which sign-in methods (Apple, Google) you’ve connected. We never receive a password — there isn’t one.
Where you’re signed in: for each session, the device’s browser description and IP address, so you can see and end sessions in Account. Sessions expire after 30 days.
What you bring: notes, recordings, uploaded files, links you import, their transcripts, and Mirror sessions you choose to keep.
Your portrait, if you make one: the portrait at three sizes, when you kept it, how it was made (the prompt version and model), what it cost, where the face sits in it, kept only as a box, and how you framed it in its circle. Never your photo: it’s deleted as soon as the portrait is made or the attempt ends. A portrait you don’t open within a day is deleted, and one you replace or remove is deleted with its files. Nothing is used to recognise you.
Your public page, if you make one: its address, the name shown on it, its about line, your two choices (whether it shows your portrait, and whether search engines may list it), and a copy of each entry you publish: its title, its words as you published or last updated them, the day you wrote it, and its cover, if it has one.
What we read from it: statements, supporting relationships, possible premises, language patterns, source quotations, and comparisons across entries. We also keep your corrections, encrypted numeric representations used to find potentially related statements, and where each concern sits on your Field, so it looks the same each time you open it.
Running records: the cost of each AI call per entry and portrait, and a short log of security events (sign-outs of other devices, exports, deletion) that records only a one-way hash of your account id.

How it’s protected

Your text — titles, entries, transcripts, kept sessions, and every phrase in your structure — is encrypted (AES-256-GCM) with a key made for your account when it’s created. That key is itself encrypted by a master key held outside the database, so the database alone reads as noise. The copies on a public page are encrypted the same way, and decrypted only to show the page to the people who visit it.

Recordings, files, and your portrait are stored privately and are only ever served to you, signed in. There are two exceptions, both your choice: the cover of an entry you publish, and your portrait if you show it on your page. Anyone with the link can load those. Where the same idea appears across entries, we use keyed hashes and encrypted numeric representations (“embeddings”) to find possible connections. Embeddings and analysis results are encrypted with your account’s key. Our service has to decrypt your words to show them to you and to send them to the providers below.

Who helps us run it

We share only what each service needs to do its part:

Anthropic — writes the Mirror’s, Separation’s, and Duality’s replies from what you type in them.
OpenAI — transcribes recordings, reads the structure of your entries and live Mirror words, and compares selected passages across entries. It also creates the numeric representations used to find candidate connections. If you make a portrait, the photo you choose goes to OpenAI to check it shows one adult’s face clearly, then, with our reference image, to make the portrait, which is checked once more.
Neon — hosts our database (the encrypted records above).
Vercel — hosts the site and stores recordings, files, and portraits (Vercel Blob, private).
Resend — sends your sign-in and change-of-address emails.
Inngest — schedules the steps that map each entry and make each portrait. It sees ids and counts, never your words or images.
Upstash — keeps short-lived counters that stop the site being flooded, keyed by a hash of your account id or IP address. They expire within a day.
Apple and Google — only if you choose to sign in with them.

Anthropic and OpenAI receive your words through their business APIs, which by default don’t use it to train their models; each may retain it for a limited time under its own policy. OpenAI may keep your photo and portrait in its abuse-monitoring logs for up to 30 days. We don’t sell your data, show ads, or use tracking or analytics scripts.

Cookies and your browser

We set one cookie to keep you signed in and one that remembers your time zone so dates read correctly. Your browser also holds a few small things for convenience — Duality’s word pairs, a loop you’re carrying from Structure to the Mirror, a Mirror session waiting for sign-up. Nothing is used to follow you elsewhere.

Taking it back, letting it go

Export: Account → Privacy → Download gives you every entry, its map, and your structure as one archive, decrypted. Your recordings, files, and portrait are inside it.
Delete an entry: removes it and its readings from your account and schedules its files for erasure. Storage failures are retried.
Download your portrait: Account → Portrait → Download gives it to you as a JPG, as framed in its circle or in full, with nothing else in the file.
Remove your portrait: Account → Portrait → Remove deletes it and its files, and your initial comes back.
Unpublish an entry: its ● Published panel → Unpublish… takes its page down at once. Its address then says the page isn’t here, and it stays in your journal, unchanged.
Delete a published entry: its page comes down with it.
Delete your account: removes entries, maps, your portrait, sessions, and sign-in methods, and schedules all account files for erasure. Opaque deletion and spending records remain so interrupted cleanup can resume and recovery cannot silently restore deleted material.
Change your details: name and email can be changed in Account.

Deleting your account takes your public page down, and its name is held for 30 days, so no one else can take it over and your links can’t lead to someone else’s words. A cover, or a portrait you showed, can stay in browsers’ and networks’ caches for up to 10 minutes after it comes down. We can’t recall copies other people made while your page was up.

Copies may remain in provider backups until their retention period ends. Service recovery must reapply deletion records before accounts can become active; backups are not a way to restore an individual deleted account.

This isn’t care

Breath of My Breath is a contemplative tool, not therapy or medical care. If you’re in crisis, please reach a local emergency number or a crisis line near you.

Changes and questions

If what we keep or who helps us changes, this page changes first, with a new date at the top. Questions, or a request we haven’t made self-serve: write to hello@breathofmybreath.com.