Privacy Policy

Confide Draft v0.1 — not yet published. For review by [LAW FIRM] before launch. Effective: [DATE] · Last updated: [DATE]

The short version

You write something true. Up to three strangers read it and write back. We never learn who you are, because we never ask.

We don't have accounts. We never ask for your name, your email, or your phone number. We don't run ads, we don't have advertising trackers on this site, and we will never sell or share what you write. No AI reads your words — every entry is checked by wordlists running on our own systems before any person sees it. That's how we keep entries about serious danger from landing on a stranger, and we explain exactly how it works below.

The rest of this page is the detail. It's written to be read, not to be survived.

Who we are

Confide is operated by [ENTITY NAME], a [STATE] limited liability company, in the United States. You can reach us at privacy@confide.app.

Confide is currently offered in the United States. We don't market it elsewhere.

What we never collect

We think this list matters more than the one after it.

• Your name. There's no field for it.
• Your email address or phone number, beyond the one reason below. The only place either exists is the optional "notify me" step, and it is deleted automatically once your entry has received its third reply — see What we do collect. [CHANGED 2026-08-29 — reverses the earlier no-contact position (launch item 1). Attorney must re-review this section, the TCPA consent language for texting, and the MHMDA implications before publication.]
• An account or password. There's nothing to log into.
• Your contacts. We never request or read your address book.
• Your location. No GPS, no location permission, no location inference.
• Advertising identifiers or device fingerprints. No ad SDKs, no advertising trackers, no analytics pixels, no session-replay scripts anywhere on this site.
• Payment information. Confide is free.
• Your voice. If you speak instead of typing, the recording is transcribed and discarded — see Speaking instead of typing below.

What we do collect

What you write. The text of your entry, and the text of any reply you send as a listener. If you spoke it, we keep the transcript you reviewed and approved — not the audio.

What our screening concluded about it. Before your entry goes anywhere, wordlists on our own systems — not AI, not a third party — assign up to three subject labels (family, work, money, health, grief, love, loneliness, identity, anxiety, other) and check for crisis signals. Those labels are data about you, so we're naming them here. When an entry is deleted on the regular schedule, its subject labels are kept — but cut loose from everything else first: no entry text, no link, no session. What remains is a count of what subjects people bring here, and it can't be traced back to you or your words.

A random token in your browser. When you first visit, we set one cookie containing a random string. It links your entries and replies to each other within your browser. It isn't derived from anything about you, it isn't shared with anyone, and it can't be looked up in any other database. Clearing it makes you a new visitor to us. This cookie is strictly necessary to run the service, which is why there's no cookie banner — it's the only one we set.

A random link for your entry. Each entry gets an unguessable address. Holding that link is how you get back to your entry, from any device, without logging in.

Whether an entry was typed or spoken. A single flag. Both end up as text; we track it only to learn how people prefer to use Confide.

What listeners did. If you listen, we record one row per entry you saw: whether you replied, skipped, or flagged it as worrying. That's how we avoid handing you the same entry twice.

A way to reach you, if you ask for one. If you choose to be notified when someone replies, we hold the phone number or email you give. It is stored apart from your entry text, used only to tell you a reply arrived, and deleted automatically once your entry has received its third reply — the moment the room is full. It is never used for anything else, joins no list, and is also deleted if you delete your entry or close the room. [CHANGED 2026-08-29 — see the note under "What we never collect". Delivery vendor not yet selected; name it here before publication.] If you turn on browser notifications instead, your browser issues a random delivery address and two encryption keys, none of it derived from you, deleted the moment your one notification is sent.

Server logs. Like every website, our host records requests, which includes IP addresses. We never write IP addresses or entry identifiers into our own application logs, and we never join server logs to what you wrote. [DECIDE: state your host's retention window — "these are kept for N days and then deleted."]

Speaking instead of typing

If you record a voice note, the audio is sent to our transcription provider (OpenAI), converted to text, and discarded. It exists in memory for the length of one request. It is never written to storage, never saved in our database, and never kept by us or by them — we use a configuration that keeps no copy after transcription.

You see the transcript before anyone else does, and you can fix anything it got wrong. Only the words you approve are submitted.

We ask your permission before the microphone is ever turned on, because recording first and explaining afterwards would mean you'd already said the hard thing before learning where it goes.

Who else touches your words

Every company that processes anything you write, and what they do:

Each of these is bound by a contract that lets them process your data only to provide their service to us, and for nothing else. Any AI provider we use is contractually barred from using your words or your voice to train their models. We do not sell your data, we do not share it for advertising, and we do not provide it to anyone for research.

We will update this table before adding anyone to it.

The safety screen, and what happens if it flags something

Every entry is checked before any human sees it — by wordlists running on our own servers, not by AI. One list labels the subject, so listeners only see topics they said they could sit with; another looks for signs of immediate danger — suicidal thoughts, self-harm, or someone at risk right now. Your entry is not sent to anyone else to be screened, and no AI model — ours or anyone's — reads it. If that ever changes, this policy changes first.

If it finds those signs, your entry is not passed to a listener. Instead you'll see a page with crisis resources, and our team receives an alert containing the entry's ID, its subject labels, and the time — and no part of what you wrote. That guarantee is built into the code: the alert has no field for your words, so they can't leak into an inbox even by mistake.

Two honest things about this:

We cannot reach you. We hold no email address, no phone number, no account. Nobody receiving that alert can contact you. The alert tells us how often this happens and whether our screening is calibrated — it is monitoring, not rescue. Confide is not a crisis service and is not a substitute for one.

The screen is not perfect. A wordlist misses entries written calmly, in metaphor, or in a second language. That's why listeners can flag an entry that worries them, which withholds it the same way. If a listener reports an entry, a person on our team reads that entry to decide whether it keeps circulating.

Every listener reply is held and read by a person before it reaches you — approved replies go out, harmful ones don't. A person reviewing a reply sees the reply, not who wrote it.

Confide is not healthcare

Confide is not a healthcare provider, not a therapy service, and not a crisis line. We are not covered by HIPAA, and we will never claim to be. The listeners here are ordinary people volunteering their attention, not clinicians, and nothing on Confide is medical advice, diagnosis, or treatment.

Because what you write here concerns your wellbeing, we treat it as sensitive health information under state consumer health data laws — see our separate Consumer Health Data Privacy Policy, which is linked from our homepage.

How long we keep things

One exception, required by federal law: if we're ever required to report content to the National Center for Missing & Exploited Children, we must preserve that specific content for one year, regardless of the schedule above.

Your choices

Delete what you wrote. Open your entry link and choose Delete this entry. It removes the entry, every reply to it, and its labels from our live systems immediately. Deleting is permanent — we can't restore it, and the link stops working. [DECIDE: what backups exist and how long they hold deleted data — state it once it's operationally real, not before]

See what we hold. Your entry link shows you everything attached to that entry. If you want a fuller answer, email privacy@confide.app.

Withdraw your consent. Deleting your entry withdraws consent for it. To stop entirely, delete your entries and clear this site's cookies from your browser.

Turn off notifications. Your browser controls this; revoking permission there stops them, and we delete the address after one send anyway.

We answer requests within 45 days. Because we don't know who you are, holding your entry link is how we know an entry is yours — please don't share it with anyone you wouldn't want reading that entry.

Security

Your words are encrypted in transit and encrypted at rest. Our database holds no names, emails, or phone numbers, which means a breach of it would expose text with no identity attached — that's a deliberate design choice, not an accident.

Access to our internal tools is limited to [DECIDE: number] people, protected by two-factor authentication, and logged. Our internal tools do not display the text of entries; they show operational information and, when a reply needs review before release, that reply.

No system is perfectly secure, and we won't pretend otherwise. If a breach affects your information, we'll notify you as required by law — and since we have no way to contact you, that notice will appear prominently on our website and at entry links.

Children

Confide is for adults. You must be 18 or older to use it. We don't design or market Confide for children, and we don't knowingly collect information from anyone under 13. If we learn that an entry came from a child under 13, we delete it and the associated session.

Changes

If we change this policy, we'll update the date at the top. If a change materially affects how we handle what you write, we'll tell you inside the product before it takes effect — not just by quietly editing this page.

Contact

privacy@confide.app · [ENTITY NAME], [ADDRESS]

Notes for review — delete before publishing

Decisions this draft is waiting on

1. Entity name, state, and registered address — step 2 of the launch list.
2. Retention for cleared entries and replies. Currently indefinite in the schema. Recommendation: 90 days after a room closes. Needs a sweep job like the existing withheld-entry one.
3. Session record retention. Recommendation: 12 months of inactivity.
4. Server-log retention window — read your Vercel plan's actual number; don't guess it in a policy.
5. Database host — name it in the processor table.
6. Number of people with admin access — state a real number or drop the sentence; don't estimate.
7. Domain and email — confide.app and privacy@confide.app are taken from .env.example; confirm both are yours and that the mailbox exists before this publishes.

Assumptions baked in — if any changes, this policy changes

• The phone/email notify toggle is not shipping. This policy states flatly that no column holds an email or phone number. If that feature returns, several sections need rewriting and the "what we never collect" list loses its best line.
• No AI reflection or listening co-pilot yet. If either ships, add a section: what it is, that it's AI, that it never sees crisis-flagged entries, and (for the co-pilot) that listeners' drafts are processed as they type.
• Zero-data-retention is actually configured at Anthropic and OpenAI. The sentences about training and about audio not being kept must match the contracts you sign. If a provider retains text for abuse monitoring, say so with the number of days.
• No third-party analytics. The "strictly necessary cookie, no banner" reasoning collapses the moment anything else is added.

For the lawyer

• Confirm the Washington MHMDA analysis and that the companion Consumer Health Data policy satisfies RCW 19.373.020's required contents.
• Connecticut's amended CTDPA (July 1, 2026) applies with no volume threshold to sensitive-data processing — confirm the consent moment satisfies it.
• Review whether the 45-day backup-purge commitment is operationally achievable before it's a published promise. Removed 2026-08-21 (Alena) — the promise is pulled until it's operationally real; an inline [DECIDE] marks where it'd return.
• Confirm the "we are not covered by HIPAA" framing and that nothing in product copy implies otherwise.
• Advise on whether to add a California/other-state rights section now or on crossing thresholds.