Privacy Policy

Last updated: October 10, 2026

1. Information We Collect

When you use Zero Point, we may collect:

  • Account information (email address)
  • Intake assessment responses and derived profile data
  • Coaching conversation messages
  • Pattern Map data and session summaries
  • Feedback you provide about coaching responses
  • Usage data and analytics
  • Consent records including timestamps and checkbox states

Analytics choices

By default, our first-party analytics are session-only and do not use a persistent visitor identifier. If you choose to allow repeat-visitor analytics in Settings, we store one rotating first-party visitor identifier for up to 30 days so we can estimate repeat visits. You can withdraw this consent at any time; the identifier is removed immediately and later analytics return to session-only measurement.

We do not use invasive fingerprinting or store raw IP addresses. Analytics do not include conversation text, prompts, AI responses, email addresses, Pattern Map content, or manuscript content.

2. How We Use Your Information

We use your information to:

  • Provide and personalize the coaching service
  • Generate AI coaching responses based on your profile and conversation history
  • Operate safety features including automated distress detection
  • Improve the quality of the service
  • Send account-related communications
  • Comply with legal obligations

3. Safety-Related Information

If you submit messages or responses indicating possible self-harm, suicidal thoughts, acute distress, or other safety concerns, we may process and store that content and related metadata for limited purposes including safety-feature operation, crisis-resource routing, internal review, security, legal compliance, fraud prevention, and service improvement. Messages are not monitored in real time.

This information may include:

  • Message content that triggered safety detection
  • Timestamps and user identifiers
  • Session and conversation identifiers
  • Automated safety classifications and risk tier assessments
  • Whether a crisis resource screen was displayed
  • Whether safety-related actions were selected by the user
  • Safety question responses

Internal safety alerts, if used, are administrative tools only and do not guarantee real-time review or intervention.

Safety records are separate from ordinary application logs and may contain flagged messages, related context, and safety responses. See Data Retention and Deletion for their deletion scope.

4. AI Processing

Relevant coaching messages and context are sent to OpenAI for response generation and related coaching processing, such as summaries. By default, OpenAI API data is not used for model training unless the customer opts in. Provider processing can include service operation, security, and abuse monitoring; this is not a promise of zero provider retention.

5. Data Security

We implement appropriate technical and organizational measures to protect your data, including encryption in transit (HTTPS/TLS), encryption at rest, row-level security in the database, and server-side authentication on all API endpoints. For more details, see our Security page.

6. Data Sharing

We do not sell your personal information. We may share data with:

  • OpenAI (AI response generation and related coaching processing)
  • Supabase (database and authentication hosting)
  • Vercel (application hosting)
  • Resend (email delivery)
  • Stripe (payments and subscription management)

These providers process relevant data to operate their services. Their applicable terms and retention practices govern provider-held records; see Data Retention and Deletion.

7. Your Rights and Controls

You have the right to:

  • Export your data: Download a complete copy of your profile, conversations, and coaching history via Settings > Export My Data
  • Delete your account: Request removal of linked live application data and your authentication record via Settings > Delete Account, subject to the retained records and limitations below.
  • Control your experience: Customize dark mode, font size, coaching style, and blocked topics via Settings

8. Conversation Deletion

Conversation deletion removes the conversation and its messages from the live application. The full scope, optional full-forget behavior, and backup/provider limitations are explained below.

9. Data Retention and Deletion

Conversation deletion. Completed deletion removes the conversation, its messages, linked session summaries and learnings, linked safety records, and traceable feedback/review copies from the live application. Full forget additionally removes linked intervention history and Pattern Map changelog entries. Account-wide memory, the cumulative Pattern Map, and intake data remain after conversation deletion.

Account deletion. Completed account deletion removes linked live application data and the authentication record, including account-linked safety records. Paid subscription closure is confirmed first. Minimal billing/deletion receipts, email suppression records, and content-free delivery deduplication records remain.

Incomplete cleanup. A shared-record dependency can block deletion. Failures are not reported as completed deletion; retry or contact support. Historical review copies that cannot be reliably attributed are flagged for separate review, not claimed as erased.

Automatic retention. Automatic cleanup remains disabled. Selecting 30 or 90 days does not by itself start deletion or a grace period. Activation requires notice and an export opportunity; already-expired conversations receive the selected grace period from activation. No separate fixed expiry for safety records is established, and a safety flag does not create an indefinite deletion exception.

Backups and external copies. Deletion described here is from the live application, not an assurance that older backups, historical logs, or external-provider copies have been erased. Those copies have separate retention and deletion limitations.

10. Children

The Service is not intended for children under 18. We do not knowingly collect personal information from children under 18. If you believe a child under 18 has provided us with personal information, please contact us.

11. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the Service or by other means.

12. Contact

If you have questions about this Privacy Policy, please contact us at our contact page.