Self-Care Compass

1. Who We Are

Self-Care Compass (“the Service”, “we”, “us”, or “our”) is an educational web application in a Phase 1 – Safe Pilot. This Policy explains what information we collect when you use the Service, how we use it, and the limited rights you have over it.

By using the Service, you consent to the collection and use of your information as described in this Policy. If you do not consent, please do not use the Service.

2. Important Compliance Disclosure

The Phase 1 Safe Pilot is not a HIPAA-covered service, not a certified GDPR framework, and not a clinical or regulated health platform. Please do not submit any Protected Health Information (PHI), therapy notes, clinical data, or data about identifiable third parties. If broader regulatory compliance is required for your use case, please discontinue use and contact the administrator.

3. Information We Collect

We collect only the following categories of data:

3.1 Account Information

Email address — required for sign-in and communication.
Hashed password — only if you register with email/password (bcrypt-hashed; we never store the plain password).
Optional display name — shown back to you in the interface.
Invite code — to validate eligibility.
Consent timestamp — when you accepted the Terms and this Policy.

3.2 Google Sign-In (Optional)

If you choose “Sign in with Google”, Google shares your email address, name, and profile picture URL with the Service through OAuth 2.0. We store only those fields plus the identifiers required to keep you signed in. We never receive your Google password. Google’s own Privacy Policy governs the data Google collects.

3.3 Educational Activity

Tier visits — which educational topics you opened and the timestamp. This lets us show “recently viewed” and basic progress indicators.

3.4 Safety Auditing (Crisis Events)

Crisis event records — if you type or view content containing safety keywords (for example, “suicide”), we log a timestamp, the triggering keyword category, the resources displayed, and whether you acknowledged the resources banner. This log exists solely so we can confirm the safety banner was shown. No message content, conversation, or free-text entry is stored beyond the matched keyword category.

3.5 Analytics (Google Analytics 4)

We use Google Analytics 4 to understand aggregate usage of the Service (pages visited, session duration, approximate region, device type). GA4 uses cookies and device identifiers. The data Google receives is governed by Google’s Privacy Policy. You can opt out of GA4 tracking using Google’s opt-out add-on or by blocking cookies in your browser.

4. Information We Do NOT Collect

Assessment or questionnaire responses.
Conversation content, chat logs, journal entries, or free-text writing.
Protected Health Information (PHI), diagnoses, medications, or clinical records.
Precise geolocation, device fingerprints, or biometric data.
Payment information (the Pilot is not paid).
Data about people other than you.

5. How We Use Your Information

Authentication — to verify it’s you and keep you signed in.
Service delivery — to show you educational content and remember what you’ve viewed.
Safety — to confirm crisis resources are being displayed when triggered.
Product improvement — to understand aggregate usage patterns (via GA4).
Administrative communication — to contact you about your account or the Pilot.

We do not sell, rent, or trade your information. We do not use your data for advertising.

6. How Information Is Shared

We share your information only in these limited circumstances:

Service providers we rely on to operate the Service: our hosting provider (Abacus.AI infrastructure), database provider, Google (for Google Sign-In and GA4), and email-delivery providers. These providers process data on our behalf under their own terms.
Legal compliance: if required by subpoena, court order, or applicable law.
Safety: if we believe disclosure is necessary to prevent imminent harm.

7. Data Security

We use reasonable technical and organizational measures, including:

bcrypt password hashing.
TLS/HTTPS encryption in transit.
Encrypted database connections.
Role-based access controls for administrator functions.
Minimal data collection by design.

No service can guarantee absolute security. Because this is a Pilot, please do not submit information you would be unwilling to send by email.

8. Data Retention

Account data and activity records are retained while your account is active. Crisis-event records are retained for safety auditing for up to 24 months. Aggregate GA4 analytics may be retained per Google’s default settings. When you request deletion, we remove your personal data within 30 days, except where retention is required by law or for narrow safety/audit purposes.

9. Your Rights

Regardless of your jurisdiction, you may:

Request a copy of the personal data we hold about you.
Request correction of inaccurate data.
Request deletion of your account and personal data.
Withdraw consent and stop using the Service at any time.

To exercise any of these rights, email [email protected] from the email address associated with your account.

10. Cookies

We use a small number of cookies and similar technologies:

Session cookies (essential) — issued by NextAuth to keep you signed in.
Analytics cookies — set by Google Analytics 4. These can be blocked in your browser settings.

11. Children

The Service is intended for adults (18+). We do not knowingly collect information from children. If you believe a child has registered, contact us and we will delete the account.

12. International Users

The Service is operated from the United States. If you access it from another country, your information may be processed in the U.S. where privacy laws may differ from those in your jurisdiction. By using the Service, you consent to that transfer and processing.

13. Changes to This Policy

We may update this Policy from time to time. If we make material changes, we will update the Effective Date at the top and, where appropriate, notify you by email or through the Service. Continued use after an update constitutes acceptance of the revised Policy.

14. Contact

For privacy questions or data requests, email [email protected].

This Phase 1 Safe Pilot has not undergone formal legal, clinical, or regulatory review. This Policy reflects a good-faith summary of data practices. It is not legal advice and may be updated before any broader launch.