← Return to the well

Privacy

Draft launch policy: update the business name, contact details, retention periods, and vendors before production.

Private by default

Wishes are stored on the visitor’s device unless cloud storage is configured. Share cards contain only the generated echo, not the original wish.

AI processing

When an AI provider is connected, wish text is sent to the server and then to that provider to create a response and perform safety screening. API keys are never exposed to the browser.

Cloud storage

When Supabase is connected, wishes and responses may be stored under a random anonymous session identifier so they can be recovered by the same browser. Account-based storage can be added later.

Payments

Payments are processed by Stripe when enabled. The site does not store full card numbers.

Control

Visitors can export or clear the journal from the Journal panel. When cloud storage is connected, clearing also requests deletion of the anonymous cloud profile and its wishes.