Privacy
What happens to what you write
You cannot use a product like this honestly unless you can predict it. So here is the whole model, including the parts that limit us.
Three levels
Every entry, check-in and note carries one of three levels. You choose it before you save, and you can see it on the entry afterwards.
Used in the conversations you have together, and in shared summaries and exports.
Only you. Your own guide can use it to help you. You can choose to share it later, one item at a time.
Never shown, quoted, summarised, counted in a total, hinted at, or exported to them, and no notification is sent when you write it. Your own guide can still use it to understand you.
What “never shared” actually means
The strongest level is the one worth being precise about, because a vague promise here is worse than no promise. It is called never shared rather than “100% private” because that is the promise we can actually keep without an asterisk: the other person cannot see it, and cannot tell it exists. When you mark something never shared, it is:
- not shown to them, on any screen, list or export
- not quoted, paraphrased or summarised to them
- not included in anything their shared AI session can read
- not counted in any total, average, streak or chart they see
- not included in a shared export
- no notification is sent because you wrote it
- no “last active” time changes because you wrote it
- no hint, implication or “there may be something on their mind” — they are never told the entry exists
That last one is the hard part, and it is the one most products get wrong. A sentence like “your partner may not be telling you everything” reveals the existence of a secret even though it names nothing. We treat that as a leak.
There are two limits, and neither is about the other person: a small number of serious safety cases can reach a reviewer on our team, and we are not above the law. Both are described below, in full, rather than hidden behind a percentage.
Two different paths, not one path with a filter
This is the part that makes the promise mean something. A conversation you share is not built by loading everything you have written and asking the AI to keep the private parts to itself.
Your private guide
Only you ever see the answer.
A session you share
Built by different code, from different data.
A shared session runs through separate code that can only read shared content. Your private and never shared entries are not loaded into it at all — so there is nothing in the request for the model to reveal, be tricked into revealing, or accidentally allude to. Every request is checked against that rule before it is sent, and the check fails loudly rather than quietly filtering.
The same boundary is enforced in the database query, so a bug in a screen cannot expose something the query never returned, and an automated test suite plays the role of a determined partner trying to detect hidden entries through every available surface.
Two people, two guides
Your guide never briefs the other person.
You each have your own. It reads what you have written and what has worked for you, and it is not a shared assistant holding both of you — the same situation can produce differently framed guidance for each of you, and neither guide reveals that the other had anything to say.
Their guide says
Your guide says
Conversations are not kept
A conversation with your guide is not written down anywhere. It lives while it is open and ends three ways — the End session button, thirty minutes without a message, or eight hours outright, whichever comes first. Closing the tab is not on that list, because closing a tab is not something a server can see; what a server can see is silence, and silence ends it.
Nothing is extracted from it either. There is no list of things the product has concluded about you, because nothing draws one up. What carries from one conversation to the next is what you wrote yourself, how you have said you like to be spoken to, and how things actually went afterwards — all three of which you can see and change.
This is a stronger promise than a deletion schedule. A table with a job attached still exists between the writing and the deleting, and that gap is what a backup taken at the wrong minute, a replica, or a query somebody wrote for support actually reaches. None of those reach something that was never written down.
Recording takes everybody
The one exception is a record you choose to keep, and choosing is not one person’s decision. ALL PARTIES CONSENT Recording means exactly that: a record starts only when every member of the space has agreed, after each of them has read the same sentence saying what will be kept and for how long. Until the last person agrees, nothing is recorded — and anyone can withdraw before it starts.
A record keeps what was shared in the space, never anything private and never anything somebody marked Never shared. You choose 30, 60 or 90 days when it starts; when the clock runs out the lines are deleted rather than hidden, and the space goes back to keeping nothing.
It will offer you different words. It will not use them for you.
When what you have written is likely to make your point harder to hear — a generalisation, a motive assigned to somebody who has not been asked, contempt standing in for a complaint — the guide offers the same point said another way, and says what the original wording will probably do rather than judging you for writing it.
It is an offer. Nothing is rewritten on your behalf, nothing is sent, and sending exactly what you wrote is always available and never remarked on. Most messages get no suggestion at all: a product that questioned every sentence would teach you to ignore it, which would waste the one time it mattered.
Your guide can still use it
Private does not mean useless. Your own guide can read everything you have written to understand your history, what sets you off, what you have already tried, and how you like to be spoken to. That is the point of having a private space rather than a locked drawer.
Sharing is always a decision
Nothing is ever promoted from private to shared automatically. If something you wrote privately might help to say out loud, you may be offered the option — and you choose whether to keep it private, share a summary, share the whole thing, or have a version drafted that you can edit before anyone sees it. You approve exactly what leaves.
Connecting and disconnecting
Joining a space never back-fills history. If someone joins in June, they cannot see what was shared in March — not because it is hidden, but because the query that fetches shared content is bounded by when they joined.
Disconnecting ends shared visibility in both directions immediately. It deletes nothing you wrote and exposes nothing that was private. Leaving is meant to be a safe action.
The limits
Two, and they are the reason the level is called “never shared” rather than “100% private”. Neither of them is the other person.
Serious safety
Your private notes stay private from the other person in this space. That does not change. There is one limit worth knowing about. If something you write suggests someone is in immediate danger, we may show you crisis resources, and in a small number of serious cases a reviewer on our team may look at the relevant entry. That access requires a restricted role and is recorded in an audit log. We are not an emergency service. We cannot call anyone for you, and we do not contact the police. If someone is in danger right now, contact your local emergency number.
We show this before you use the strongest privacy level for the first time, not only here. We would rather you know the limit up front than discover it later. More detail is on the safety page.
Lawful process
We are a company, not a jurisdiction. A valid legal order can compel us to produce data we hold, and no product design changes that — anybody telling you otherwise is selling you something. What we can say is what we actually do: content is encrypted at the application layer before it reaches the database, so what exists to be produced is what our own systems can decrypt, and nothing more. We do not volunteer content, and we do not scan accounts on anyone else’s behalf.
Your data, concretely
- Entries, notes and transcripts are encrypted before they reach the database, so a backup or a stolen replica is not readable.
- Voice recordings are deleted once transcribed, unless you turn that off.
- You can download everything you have written.
- You can delete individual entries, or your whole account.
- Deleting your account does not delete the other person's own entries — those are theirs.
- Analytics record that a check-in happened, never what it said.
- Notifications never put your content on a lock screen unless you switch that on.
The companies that process data on our behalf — AI inference, transcription, email, payments, hosting — are listed individually, with what each one receives, on the subprocessors page.
Questions about any of this: privacy@onbetterterms.com. The formal version is the privacy policy; if the two ever disagree, tell us, because this page is what OnBetterTerms intends to do.