This House invites honest language. That makes privacy a spiritual obligation, not a legal afterthought. The simplest version is this: your private walk stays yours unless you deliberately choose a feature that requires something more.

Four Different Kinds of Memory

Session-local context is the default and ends with the visit. Device-local journal material is authored and controlled by you. Thin preferences exist only when you deliberately set them. Covenanted Remembrance is the only memory allowed to shape a future Keeper conversation, and it requires a separate consent ceremony and a complete visible ledger.

Optional Account Sync

If you sign in, your walk can be backed up privately to your account and carried across devices. This is optional. Account sync is end-to-end encrypted — locked on your device with a key only you hold, so only you can read the backup — and it exists to preserve your place, not to make your walk visible to others.

Keeper Companion Mode

When Companion Mode is off, the House remains a local, authored experience. In this elevated-beta candidate the live Keeper is held until the participant cap, beta period, jurisdiction, verified resources, steward, and commissioned clinical review are configured. Ordinary consent never silently becomes cross-session remembrance consent.

Covenanted Remembrance

If this is later enabled, every entry must be visible, editable, exportable, and deletable. Revoking consent destroys the remembrance ledger. The House may not infer traits, diagnoses, engagement profiles, absence signals, third-party facts, or business assets from it. Safety review never reads remembrance or companion state.

Distress Language

If the app recognizes language involving suicide or self-harm, harm to others, abuse, psychosis or mania, or acute substance risk, ordinary frameworks stop before model contact. Safety review reads only the present words. It does not read memory or companion state.

What We Never Do

We do not sell your data.

We do not use advertising trackers.

We do not display your private journal, private returns, or Inner Weather content to other people. In the consent-bound Together rooms, only the presence signals and words that room explicitly names may cross.

We do not treat your sentences as a score, a profile, or a spiritual performance record.

You can erase what is held.

Erase Controls

The House separates removal into deliberate acts: clear this device, delete cloud backup, and delete account. Each one is explicit because each one removes something different.

The Plain Mechanics

Reverence should not require vagueness. Concretely:

The site is hosted on Vercel.
Your private authored material may be stored end-to-end encrypted in Supabase when you separately choose account sync, and only on your own device when you do not.
No words are sent to a live model while the elevated-beta readiness gate is incomplete.
The newsletter stores only the email address you give.
A giving-opening notice keeps only the email address you submit, uses it only for one notice when secure giving opens, and does not enroll you in the Monthly Transmission.
Erasing your account deletes everything it held. The in-app Erase tools remove data from your device at any time.
Questions and requests: Paul@SecondHumanity.com.

What you bring to this House should be held with reverence.
We build accordingly.

Privacy