Legal

Privacy Policy

Last updated 2026-07-10

This product is built on one principle: your data is the product, and it's yours. This page says plainly what we collect, why, and the controls you have. What You Sow is operated by Northpine Labs LLC, the data controller for the processing described here — reach us at [email protected].

What we store

• Account: your email address, used only to sign you in and (rarely) to reach you about the service.
• Your content: your messages, imported notes, and the facts, patterns, and readings derived from them.
• Therapist access: invite tokens you create and an audit log of questions asked through them.

Purposes and legal bases

• Provide the service: account access, interviews, retrieval, exports, sharing you request, and billing — performance of our contract with you.
• Sensitive information: answers may reveal health, beliefs, sexuality, relationships, or mental state. We process this only with your separate explicit consent, recorded before the file opens. You choose what to provide.
• Security and abuse prevention: short-lived rate-limit records, security logs, and irreversible account tombstones — our legitimate interest in protecting the service and enforcing fair-use limits.
• Payments and legal obligations: subscription and transaction metadata needed for accounting, tax, dispute, and compliance duties.
• Optional email: service notices are necessary to operate your account; reminder emails can be disabled in Settings.

How automated processing works

Model providers turn your answers into candidate facts, patterns, questions, and readings. These are automated inferences, not diagnoses or decisions with legal effect. You can dispute, revise, dismiss, or delete the derived record. The service may be wrong; do not use it as the sole basis for medical, legal, financial, employment, or other consequential decisions.

Encryption at rest

Your content — messages, memories, the portrait index, patterns, calibrations, open questions, do-not-ask topics, session summaries, analyses, uploaded import files, and the therapist question log — is encrypted with a per-user key. The master key that unwraps it lives in a separate key-management service, not in the application database. Deleting your data destroys your key, which renders your stored content unrecoverable.

One technical exception: the search vectors (embeddings) derived from your memories are stored unencrypted — that is what makes your base searchable. They are not readable text, but they do mathematically reflect the content they were derived from.

Processors we use

• A model provider (Anthropic) to run the interviewer, synthesis, and readings.
• An embeddings provider (Voyage AI) to make your base searchable.
• An email provider (Resend) to send sign-in links and account notifications.
• A hosting/database provider (Railway) to run the service.
• A payment provider (Lemon Squeezy, our merchant of record) if you subscribe to a paid plan — it receives your email and payment details and issues your receipts; we never see your card number.
• A product-analytics provider (PostHog) — it receives pseudonymous usage events tied to an internal account identifier (feature names, counts, plan tier), never the content of anything you write.

We configure model processors not to use your content for model training. Anthropic does not train on commercial API inputs or outputs by default; the production service also requires Voyage's organization-level data-training and retention opt-out to be enabled. We never sell your data.

Retention

• Your account content remains until you delete the content or account.
• Consent records (version, locale, acceptance, and any withdrawal time) remain with the bare account as evidence of the processing interval and are deleted when the account is deleted.
• Raw import source files are encrypted and retained for up to 30 days for traceability; extracted records remain until you delete them. Queued import payloads are deleted when the job finishes, is cancelled, or permanently fails.
• Model providers may keep transient service copies for the security, abuse-prevention, or legal periods in their applicable commercial terms; those copies are not part of your portrait and are not used for model training under the configuration described above.
• Usage counters are retained for about 60 days; burst-rate buckets for about two days.
• Completed subscription-cancellation jobs are removed after 90 days. Payment providers retain their own transaction records as required by tax and financial law.
• An account tombstone contains only an irreversible keyed email hash and lifetime free-usage counter. It is retained while the free-tier anti-abuse rule remains necessary.
• Backups age out under the hosting backup schedule. Crypto-shredding removes the key needed to read personal ciphertext in any surviving backup.

International transfers

Our processors may handle data in the United States or other countries outside yours. Where required, transfers rely on an adequacy decision, standard contractual clauses, or another lawful safeguard. Contact us for the current processor locations and safeguards applicable to your account.

Cookies and device storage

We use essential cookies for sign-in, language, referrals, app-lock state, and parked promo codes. We do not use advertising cookies or a browser analytics SDK. While you type in chat, a short-lived draft may be stored on your device so a navigation does not destroy it; drafts expire automatically and are cleared on sign-out or data deletion.

Your controls

• Access and portability: download a readable Markdown export or a complete JSON export, including transcripts, derived records, consent history, sharing metadata, and any raw import sources still inside their retention window.
• Delete: deleting the base permanently erases the content and crypto-shreds its key while retaining the bare account and consent history. Deleting the account erases those too. After account deletion, only an irreversible keyed email hash with a lifetime free-usage counter remains; it holds no readable content and prevents free-quota abuse through repeated registration.
• Revoke access: kill any therapist invite in one click.
• Correct, restrict, or object: edit/dispute derived records in the product, or contact us for an account-level request.
• Withdraw consent: “Delete entire base” in Settings erases the sensitive content and records the withdrawal while leaving the bare account open. Processing stops until you actively consent again. You can instead delete the whole account. Withdrawal does not make earlier lawful processing unlawful.
• Complain: you may complain to the data-protection authority where you live or work.

We answer privacy requests after verifying control of the account. Depending on your location, some rights may have legal exceptions. There is no sale of personal data and no targeted advertising.

Contact

Questions or a data request? Reach us at [email protected].

Terms of Use →