Privacy Policy

Clear Headed (clearheaded.app) is run by [LEGAL ENTITY NAME], [ENTITY ADDRESS]. We are the “data controller” for the information described here. You can reach us at hello@clearheaded.app.

• Email address — when you ask for your free report or create an account.
• Quiz answers — your goal, how often and how much you use, what it costs, when you tend to use, and why you want to change. Plus your country and confirmation that you’re old enough.
• Journal entries — sessions you log, evening check-ins, cravings, limits you set, and any notes you write, including messages to the coach.
• Account and billing status — which plan you’re on, when your trial ends, and whether the subscription is active. Card details never touch our servers; Stripe holds those.
• Usage data — pages viewed, buttons tapped, rough device and browser type, and the ad or link that brought you here. This is funnel analytics, not your journal content.

We don’t ask for your name, your address, or your location. We don’t read your contacts, photos, or anything else on your phone.

• To build your report and email you the link to it.
• To run the journal: show your logs, streaks, limits, and the money and hours you’ve got back.
• To personalise the coach and daily reflections around your goal and your entries.
• To bill you for the plan you chose and to let you cancel.
• To send you the emails you signed up for (report, trial welcome, daily reminder) and to reply when you write to us.
• To understand which parts of the site work, so we can fix the parts that don’t.

Under GDPR / UK GDPR our legal bases are: performance of a contract (running the service you signed up for), your consent (marketing emails and analytics cookies, which you can withdraw), and our legitimate interest in keeping the service secure and working.

We use a small number of well-known providers. Each one only gets what it needs to do its job.

• Supabase (database and login) — hosted in the United States (us-east-1). This is where your email, quiz answers, and journal entries are stored, with row-level security so only your account can read your rows.
• Vercel (hosting) — serves the website and runs our code.
• Stripe (billing) — handles your card and subscription. Stripe sees your email and payment details; we see only the subscription status. Stripe’s own privacy policy applies to the payment itself.
• Resend (email) — delivers the emails we send you. Resend sees your email address and the content of those emails.
• PostHog (analytics) — records how people move through the site. We don’t send journal content to PostHog.
• AI models (via Vercel AI Gateway) — to write the personalised parts of your report and to power the coach, the relevant entries are sent to an AI model provider under terms that prohibit using them to train models. Nothing is sent that you didn’t write or answer yourself.

If you’re outside the US, your data is transferred to and stored in the US. Where GDPR / UK GDPR applies, those transfers rely on the providers’ standard contractual clauses or an equivalent adequacy mechanism.

• While you have an account: for as long as the account exists.
• When you delete your account: your journal entries, quiz answers, and email are deleted from our live database straight away and purged from backups within 30 days.
• If you only took the quiz and never started a trial: we delete your quiz answers and email within 12 months.
• Billing records: Stripe keeps invoices for as long as tax law requires. That record contains your email and what you paid, not your journal.
• Analytics: event data is pseudonymous and kept for up to 12 months.

One tap. Go to Settings → Delete my account inside the app. Everything goes: entries, report, login, the lot. No “are you sure” dark patterns, no waiting period.

If you’d rather email, write to hello@clearheaded.app from the address on the account and we’ll do it within 7 days and confirm.

We never sell, rent, or trade your personal information. We don’t share your journal with advertisers, employers, insurers, or anyone else. The only people who see your data are the providers listed above, acting on our instructions, and — if the law compels us — a court or regulator.

We use two kinds of tracking on the marketing site and inside the app:

• PostHog sets a cookie and local-storage entry so we can tell that two page views came from the same browser. It records events like “quiz started” and “report viewed”.
• Meta Pixel is used on the marketing pages so that if you arrived from an ad, Meta can tell the ad worked. It fires standard events (page view, lead, start trial). It never sees your quiz answers or journal content.

Opting out: block third-party cookies or use a content blocker and both stop working; the app still works fine without them. For Meta specifically, you can also turn off “Ads shown off Meta” in your Meta ad preferences. We honour cookie consent choices where the law requires them.

We also use strictly-necessary cookies to keep you logged in. Those can’t be turned off without breaking login.

Clear Headed is for adults only: 21 or older in the United States, 18 or older everywhere else. We ask you to confirm this before you take the quiz. If we learn we’ve collected data from someone under the age limit, we delete it.

Wherever you live, you can ask us to access, correct, export, or delete your data, and you can object to or restrict how we process it. Email us and we’ll respond within 30 days.

If you’re in the EU / EEA or the UK (GDPR / UK GDPR): you also have the right to withdraw consent at any time, to data portability, and to complain to your local supervisory authority (in the UK, the ICO).

If you’re in California (CCPA / CPRA): you have the right to know what we collect and why, to delete it, to correct it, and to opt out of “sale” or “sharing”. We don’t sell personal information. Pixel-based ad measurement may count as “sharing” under California law; you can opt out by blocking the pixel as described above or by emailing us. We won’t treat you differently for exercising any of these rights.

Data is encrypted in transit and at rest. Database access is locked down per user. We keep the number of people and systems that can touch your data as small as possible. No system is perfect; if we ever have a breach that affects you, we’ll tell you promptly and honestly.

If we change anything material, we’ll update the date at the top and, for anything that affects your rights, email you before it takes effect.