What we collect, why, and what you can do.

When you sign in, we receive your email address and (if you used Google) your name and profile photo from Google's sign-in service. We use your email to identify your account and to send you the magic link when you ask for one. We do not use it for anything else, and we do not share it with third parties.

When you use startwith, we store the work you do: the goals you create, the sessions you run (start time, duration, what you said the session was about, whether you finished or paused), the reflections you write when you finish a goal, and the preferences you set in the wizard. If you ask the coach a question in the rescue flow or the planning flow, your message and the coach's reply are stored so the next session can use them.

We also store a small set of operational signals: when you signed in, when you signed out, the rough size of each session in tokens (used only to keep the cost of running the coach under control), and whether a request errored. These are not used to build a profile of you.

• No advertising identifiers. No third-party trackers.
• No clipboard, contacts, microphone, or location. The app does not ask for any of these permissions.
• No keystroke logging, no screen recording, no background tracking. The app only runs when you open it in a browser.
• No data sales. We have never sold user data and do not plan to.

Your goals, sessions, and reflections are used to give you a coach. That is the whole list. The coach reads what you have done so it can ask better questions next time. The operational signals (token counts, error rates) are used to keep the service running and under budget.

We use one subprocess to run the coach itself: OpenRouter, which routes your message to a large language model. OpenRouter receives the text of your message, the relevant prior context, and nothing else. They are contractually obligated not to train on your data and not to retain it beyond the request. We have configured the integration to send the minimum context needed for the reply.

Account data, goals, sessions, and reflections live in a Postgres database hosted by Supabase (us-east-1 region). Auth is handled by Supabase Auth with Google and email-magic-link as the two sign-in methods. The coach runs on Vercel's serverless platform in the same region.

Email for magic links is sent through Resend, our transactional email provider. The only thing Resend sees is your email address and the one-time sign-in link.

We use a small set of first-party cookies and local-storage entries: one to keep you signed in, one to remember your theme (light or dark), one to remember whether you have visited before, and one per project that holds the OAuth code-verifier used during the Google sign-in handshake. None of these are used for tracking. You can clear them in your browser at any time; clearing them will sign you out.

You can export everything we have about you as a JSON file from your profile page. You can delete your account and all associated data from the same page. Deletion is permanent; we keep nothing identifiable about you after that point. (Aggregated, anonymized counters may remain, but they cannot be tied back to you.)

You can also ask us to do either of these by emailing hello@startwith.app. We will reply within a few days.

Startwith is not directed at children under 13, and we do not knowingly collect data from them. If you believe a child has created an account, email us and we will delete it.

We will update this page when anything material changes. The “last updated” date at the top will move. If a change would weaken the commitments above (for example, introducing analytics or a new data processor), we will email active users before the change takes effect.

Questions, complaints, or requests: hello@startwith.app. The fastest way to reach a human at startwith.