How We Protect Your Data

Zero Point Coach handles sensitive personal information. We take that seriously. Here is exactly what we do to keep your data safe.

Your data is yours

Every piece of data you share with Zero Point Coach belongs to you. You can export all of it or delete your account at any time. We do not sell or monetize your personal information. Relevant data is processed by service providers as described below.

Isolation by design

Your coaching conversations, intake profile, and Pattern Map are visible only to you through the user-facing application. Other users cannot access your data. Admins do not have user-content access through the application interface.

Encrypted in transit and at rest

All communication between your browser and our servers uses HTTPS/TLS encryption. Your data is stored in a secure, managed database with encryption at rest.

Real deletion

Account deletion removes linked live application data and the authentication record once completion is confirmed. See Privacy: Data Retention and Deletion for retained records and backup/provider limitations.

Technical Details

For those who want to know the specifics.

1Authentication

Email and password authentication powered by Supabase Auth
Server-side JWT validation on every API request
Session tokens are short-lived and automatically refreshed
Admin access requires a verified role stored in the database, not just a token claim

2Data Isolation

Row Level Security (RLS) enforced on database tables that store user data
Each user can only read, write, and delete their own data
Database-level ownership checks help prevent cross-user data injection
Admin tools are protected by server-verified role checks at both the API and UI layer

3Infrastructure

Hosted on Vercel with automatic HTTPS, DDoS protection, and edge network
Database hosted on Supabase with managed PostgreSQL and encryption at rest
We do not intentionally store coaching content or profile data in browser local storage
Authentication is handled through session mechanisms required for sign-in
API keys and secrets are stored as server-side environment variables, never exposed to the browser

4AI and Coaching Data

Relevant coaching messages and context are sent to OpenAI for response generation and related coaching processing, such as summaries. By default, OpenAI API data is not used for model training unless the customer opts in. Provider processing can include service operation, security, and abuse monitoring; this is not a promise of zero provider retention.
Your intake profile and Pattern Map are used only to personalize your coaching sessions.
Ordinary application logging is designed to exclude coaching content and personal profile details. Separate safety records may contain flagged messages and related context.

What We Do Not Do

We do not sell your data to third parties.

We do not use your coaching conversations for advertising.

We do not share your personal information with other users.

We do not store passwords in plain text.

We do not intentionally include coaching messages or personal profile details in ordinary operational logs. Safety records are separate and may contain flagged content.

We do not report account deletion as complete until linked live application cleanup and authentication-record removal are confirmed. Retained records and external-copy limitations are explained in the Privacy retention section.

We do not require you to provide your real name to use the service.

Your Controls

You are always in control of your data.

Export your data

Download a complete copy of everything we store about you, your profile, conversations, coaching history, Pattern Map, and session summaries, as a single JSON file.

Settings > Export My Data

Delete your account

Request account deletion through Settings. See Privacy: Data Retention and Deletion for retained records and backup/provider limitations.

Settings > Delete Account

Dark mode and accessibility

Customize your experience with dark mode, font size options, and reduced motion settings.

Settings > Appearance

About AI Processing

Service providers process relevant data to operate the service: OpenAI for AI processing, Supabase for database and authentication hosting, Vercel for application hosting, Resend for email delivery, and Stripe for payments and subscription management. Their applicable terms and retention practices govern their own records. Deleting a Zero Point account does not automatically erase all provider-held copies.

By default, data sent through the OpenAI API is not used to train or improve OpenAI's models unless the customer explicitly opts in. Provider security and abuse-monitoring retention may still apply; this is not a zero-retention promise.

Your coaching messages are stored in our database so you can continue conversations and review past sessions. They are protected by the same access controls and data-isolation rules used for the rest of your account data.

Questions?

If you have questions about how your data is handled, or if you want to request data deletion outside of the in-app controls, please reach out.