RECONSTRUCTION: Privacy Policy

This policy is posted at this address and linked in the footer of every page of the Program. At checkout, it is presented alongside the Terms of Service and covered by the same required checkbox before payment can complete, and your acceptance is recorded with its date and version. A link is included in your purchase confirmation email, and material updates are flagged to active users by email per Section 8.

Account and payment data: email address, name if provided, timezone, and payment records. Card details are handled entirely by our payment processor (Stripe); we never see or store your card number.

Intake responses: your answers to the Program's ten onboarding questions. These include personal disclosures you choose to make and three self-reported wellbeing ratings (anxiety, stress, self-criticism). This is sensitive information, and we treat it that way: it is stored with access restricted at the database level so that it is readable only by Company-authorized service access, never rendered back into any client-facing screen.

Conversation data: everything you write in sessions, check-ins, and parking-lot notes, everything the Program says back, and system metadata (classifications, timestamps, quality-control logs).

Images you upload: you may submit images such as journal entries or screenshots of text conversations as material for the work. The Program reads the text from the image and treats that text like any other message; it screens it for safety and uses it as your coaching material. These images may contain other people's names and words (for example, a text exchange with your partner). You are responsible for what you choose to upload, and by uploading you confirm you're entitled to share it. The Program uses this content only as material for your own work; it never uses it to assess, characterize, contact, or build a profile of anyone else, and any third-party information in it is held under the same privacy and security terms as the rest of your data.

Email engagement: delivery, open, and click events on Program emails.

Technical data: standard logs (IP address, device/browser type) needed to run and secure the service.

We do not collect health records, and the Program is not a healthcare provider; nothing here is HIPAA-covered treatment data. What you disclose is self-reported personal information you choose to share with a coaching product. Never enter government identification numbers, bank or credit account numbers, passwords, or other security credentials into the Program. It will never ask for them, and it is not built to store them.

To run the Program: generating conversations, tracking your progress, sending program emails, and producing your artifacts.

Human review: Rock DuBois and authorized Company personnel can review your intake responses, transcripts, and program data for coaching oversight, safety, quality control, and improvement of the Program. No human reads your messages before the AI responds; review happens after the fact.

Safety: automated screening of your messages and notes for crisis signals, and, when triggered, an immediate alert to Rock DuBois containing your email, timestamp, and a conversation excerpt, with possible personal follow-up, as described in Section 3 of the Terms of Service.

Product improvement: analysis of program data, including de-identified transcript analysis during beta and early access, to improve the Program's coaching quality.

We do not sell your data, do not share it with advertisers, and do not use it for third-party marketing. Your identifiable words never appear in marketing or testimonials without your separate written consent.

We use a small set of service providers, each processing data only to provide their service to us:

Supabase: database and authentication hosting

Anthropic: AI model provider that processes conversation content to generate responses

Stripe: payment processing

Postmark: email delivery (or successor provider; this policy will be updated if the provider changes)

Vercel: application hosting

We may also disclose data if required by law, or to protect the safety of any person consistent with the crisis-alert feature you consented to in the Terms.

Program data is retained for the duration of your access and for up to 3 years afterward for records, safety, and product-improvement purposes, unless you request deletion sooner. Payment records are retained as required by tax and accounting law.

Access and deletion: email rock@rockdubois.com from your account email to request a copy of your data or its deletion. Deletion removes your intake responses, transcripts, and profile; we may retain payment records required by law and de-identified data that no longer identifies you.

Email: program emails are part of the service; marketing emails, if any, carry an unsubscribe link. Transactional and safety communications cannot be opted out of while your account is active.

Residents of jurisdictions with statutory privacy rights (for example, the EU/UK or California) may have additional rights; requests to the address above will be honored in line with applicable law.

Data is encrypted in transit, stored with row-level security so that clients can only ever access their own permitted data, and administrative access is restricted and logged. No system is perfectly secure; if a breach affects your data, we will notify you and the required regulators as soon as practicable, consistent with Massachusetts General Laws Chapter 93H and other applicable breach-notification law.

The Program is for adults 18 and over. We do not knowingly collect data from anyone under 18; if we learn we have, we will delete it.

Updates will be posted here with a new effective date. Material changes will be flagged to active users by email.

Contact: Rock DuBois Consulting, LLC, rock@rockdubois.com