Privacy by Design & Data Governance

Privacy Policy & Data Sovereignty

Identity transformation involves your most personal beliefs, cognitive models, and reflections. We maintain rigorous standards for user privacy and cryptographic isolation.

1. Local-First Client Architecture

While using the platform in Guest Mode, no sensitive self-concept data (audit answers, blueprint items, 24h challenge logs, exercise runs, or journal reflections) is transmitted to any server. All records remain exclusively on your device's local storage.

2. Strict Row Level Security (RLS)

When you authenticate, records are safeguarded by PostgreSQL Row-Level Security policies. Every query requires a verified auth session token where policies strictly enforce `auth.uid() = user_id`. System administrators cannot browse or inspect private introspective journals.

3. Zero Commercial Tracking & No Ad Sales

We do not embed third-party surveillance trackers, social media marketing pixels, or invasive behavioral scripts. Your data is never sold, licensed, or shared with commercial advertising brokers or generalized AI training corpora.

4. Right to Deletion & 30-Day Grace Period (AUTH-005)

You possess absolute sovereignty over your records. Requesting account deletion initiates a 30-day grace period during which you can reactivate your account. After 30 days, all records and audit histories are permanently and irreversibly purged from databases.