Not "won't." Cannot. Your privacy isn't a policy—
it's built into our architecture.
Your data is encrypted on your device before it ever reaches our servers
When you sign up, you create a unique access code. This code becomes your encryption key and never leaves your device unencrypted. We never see it, store it, or have any way to recover it.
Result: Only you have the key to your data. Not us, not anyone.
Every piece of data—your journal entries, messages, email, name, everything— is encrypted using AES-256 encryption in your browser before being sent to our servers. We use industry-standard cryptography libraries.
Result: By the time data reaches our servers, it's already locked. We only see encrypted gibberish.
Our servers store your encrypted data in secure databases with additional layers of protection. But even if someone gained access to our database, they would only see encrypted data that's useless without your access code.
Result: Even in a worst-case breach scenario, your personal data remains safe.
When you log in with your access code, your browser decrypts the data locally. The decryption happens entirely on your device—never on our servers. This is why your access code is so important.
Result: Only you can read your data. Period.
Because of zero-knowledge encryption, we have no way to see:
Because we use zero-knowledge encryption, if you lose your access code, we cannot recover your data. There is no "reset password" option. Store your access code in a secure password manager or write it down in a safe place.
HIPAA is just the baseline. We go further.
We meet all HIPAA requirements for protected health information (PHI), including administrative, physical, and technical safeguards. Our systems are regularly audited for compliance.
We go beyond HIPAA by implementing zero-knowledge encryption. Even if legally compelled to provide data, we physically cannot decrypt your personal information—because we don't have the keys.
Our infrastructure includes: encrypted data at rest and in transit, multi-factor authentication, regular security audits, intrusion detection systems, and DDoS protection.
We believe in transparency. Our security documentation is public, we conduct regular third-party audits, and we're open about our practices. Trust through transparency.
For the technically curious
AES-256-GCM (Advanced Encryption Standard with Galois/Counter Mode)
PBKDF2 (Password-Based Key Derivation Function 2) with 100,000 iterations
TLS 1.3 with perfect forward secrecy
Web Crypto API (native browser implementation)
Experience mental health care built on a foundation of privacy and trust.