How we protect your data.

Authentication

Accounts are secured through Supabase Auth with hashed passwords and PKCE-based Google sign-in. Session cookies are httpOnly and scoped to our domain.

Payments

Billing is handled entirely by Stripe. We never see or store your card number — only your Stripe customer ID and subscription status.

Data storage

Your account and session data live in a Supabase (PostgreSQL) database protected by row-level security, so a request can only ever read or write its own user's rows. Data is encrypted at rest and in transit (TLS).

AI processing

Conversation transcripts are sent to Anthropic's API to generate role-play responses and debriefs. Anthropic's enterprise API does not use API inputs to train models.

Abuse prevention

Server-side rate limiting protects sign-up, password reset, and support endpoints from automated abuse. Free-session eligibility is checked against a canonicalized email to prevent alias-based farming, and privileged database functions are locked to the service role.

No advertising

We don't run ad trackers or sell your data. Google Analytics and PostHog collect anonymized usage events only, and only after you accept them in the cookie banner.

Your data controls

You can export or delete your data at any time. Account deletion is a 30-day soft delete, so you can recover if you change your mind, before it's permanently removed.