Private isn’t a setting here. It’s the structure.

The privacy boundary in Measrd apps is enforced inside the database, not by the interface. Row-level security rules decide what any request can return, and an automated test suite proves those rules hold before any change ships. Sealed means refused by the database, not hidden by a screen. Each app has its own seal (Balanced’s two-person reveal, Lightbulb’s sealed-once-written pages, Echo’s contribute-before-you-read rooms), and each app states its own rules where you write.

Your account: the email you sign in with and a display name if you set one. Your content: what you write in each app, held under that app’s seal rules. Operational records:timestamped events like “opened a ritual” or “sealed a session,” kept for safety and rate-limiting; they never contain what you wrote. App-specific records can include relationship or collaboration membership, shared media, generated results, progress and lifecycle state, email delivery and preferences, gifts and referrals, and bounded safety/rate-limit records; each app describes its exact inventory. Billing: your subscription state and a Stripe customer reference; card numbers live at Stripe and never touch our systems.

There is no advertising identity and we do not sell a behavioral profile. Aggregate service analytics and app-specific operational records are described here and in each app.

We measure whether the apps are used (page views, visit counts, whether rituals complete) using Cloudflare Web Analytics, which sets no cookies and builds no cross-site profile. What you wrote is never analytics data in any form. Counts and cadence, never content.

We never sell your data, to anyone, for anything. We never show ads or share anything with advertisers or data brokers. We never train AI models on your content, and our AI provider doesn’t either. Content sent to power a feature you invoked is used to produce your result, full stop. And nobody browses your words: production access is restricted, credentialed, and used for operating the service, not curiosity.

A short, deliberate list of processors, each doing one job: Supabase hosts the database (on AWS, US-East); Cloudflare serves the apps and the cookie-free analytics; Stripe handles payment; Resend and Google Workspace deliver email; Anthropic processes the words you send into an AI feature, only when you invoke it; and Cloudflare R2 plus ephemeral GitHub Actions jobs hold and verify encrypted database backups. Primary service data stays in the United States, encrypted in transit and at rest.

Durability is part of privacy: the database can rewind to any two-minute point in the last seven days, and an encrypted backup leaves for separate storage every night, where it is automatically test-restored to prove it works. A deletion request for one product revokes only that product’s access and removes or de-identifies its separable authored data; it does not delete the shared Measrd identity, another product, or the shared Stripe customer unless that product says so explicitly. Genuinely shared spaces follow each app’s stated survivor rules. Provider recovery and encrypted logical backups cannot be edited one account at a time, so deleted data may remain until a backup is retired and must be deleted again after any restoration. The repository does not currently encode an automatic expiry window for nightly and monthly R2 backup objects, so we do not claim that they roll off within a shorter period.

Ask and you’ll get: a copy of your data in a plain, portable format (portability is a promise here: your data lives in ordinary, well-named database tables), corrections to anything wrong, product-scoped deletion, or deletion of your whole Measrd identity subject to the shared-space, payment-record, and encrypted-backup behavior above. Whole-account deletion is a separate operator-assisted request: it removes sign-in and access to every Measrd product, while required Stripe transaction records and genuinely shared spaces can survive for their stated retention or survivor periods. Start from your accountor email mtthw@measrd.com from your account address and a person handles it. Measrd is for adults (18+); we don’t knowingly hold children’s data, and we’ll delete any we learn of.

If this policy changes, the date at the top changes, and material changes are announced by email before they apply. The promises above (enforced in the database, counts never content, never sold) are the architecture, and they don’t change. Measrd LLC, Indiana, USA · mtthw@measrd.com · see also the terms of service.