Privacy

Version 2026-10-08b · covers the private pilot of Terms of Us

Terms of Us asks you questions about how you are in close relationships. That is psychological information — among the most personal data there is. This page says exactly what we hold, why, what your partner can and cannot see, and what happens when you leave. If anything here is unclear, that is our failure: write to us and we will answer plainly.

Who is responsible

Thyself Empowered Ltd is the data controller for the personal data described here. Terms of Us is our product. You can reach us through the contact page.

We have not yet completed our registration with the Information Commissioner’s Office. That happens before any commercial launch, and this page will carry the registration number when it exists. We will not print a number we do not have.

What we process, and why

The service is currently a private pilot: two invited people, behind a passphrase. Here is everything it processes, in plain English, with the legal basis for each.

• Your account. The email address you sign in with, sign-in links sent to it, and your session. If you choose to sign in with Google, we receive your Google email and name — nothing else, and nothing goes back. There are no passwords anywhere. Basis: providing the service you have asked for — Article 6(1)(b) UK GDPR.
• Your display name. One optional field, shown to your partner and used on your documents. There is no other profile — no photo, no bio, no preferences. Basis: as above, Article 6(1)(b).
• Your age declaration. That you told us you are 18 or over, and when. We never ask for a date of birth, because we do not need one. Basis: our legitimate interest in keeping an adults-only service adults-only — Article 6(1)(f).
• Your Sounding answers. The Sounding’s 48 statements about how you are in close relationships. This is special category data. We process it to provide the service you have asked for — Article 6(1)(b) — and we only touch it with your explicit consent — Article 9(2)(a) — asked for before you start, in plain words, stored verbatim so you can always re-read exactly what you agreed to.
• What we derive from your answers. Your scores, your archetype, and Your Survey. Same basis: your explicit consent. Your archetype is worked out from your answers by fixed rules, not by a model, and nothing is decided about you from it. What you typed is never shown to your partner. Once you have both finished, they see your archetype and where you sit on each dimension, in the combined report; an invitation you send shows your archetype until it expires.
• Your answers on health, in Horizon. Two of Horizon’s eight questions ask about illness and about the end of life. What you write there is information about health, which is special category data, and we hold it only on a separate, explicit consent — Article 9(2)(a) — asked for just above those two questions, in plain words, and stored verbatim with its version. It is shown to your partner once you have both answered that question, as every answer in Horizon is, and to nobody else; it is never used for research. You can take that consent back in one step, beside the two questions: your answers to them are then deleted, from your view and from your partner’s. The record that you agreed, and when, is kept, so that we can show the consent was valid while it stood.
• What the two of you make together. The combined structural report, the agreement you draft and sign, and the practice records you both write. This rests on a second, separate consent — see the two layers below.
• Invitations. If you invite your partner or a witness, we process their email address and your name to deliver one invitation. Basis: our legitimate interest in carrying the message you asked us to carry — Article 6(1)(f).
• Consent records. The exact words you consented to, the version, and the date — kept so we can show your consent was validly given, as Article 7(1) requires of us.
• A small audit trail. Account-level events: an invitation sent, a module unlocked. Not what you read, and not where you went. Basis: Article 6(1)(f).
• Billing — not yet. Nothing is billed in the pilot and no payment provider is connected. When billing goes live, Stripe will be added here first.
• Messages you send us. If you write to us through the contact page — whether or not you have an account — we process the name you give, your email address and what you wrote, for one purpose: to read it and reply. The message is forwarded to the mailbox we read and a copy is emailed back to you; it is not stored in the product. Nothing else about you is recorded. Basis: our legitimate interest in answering someone who has written to us — Article 6(1)(f). The retention period for an answered enquiry is an open question, marked on the retention page.

We never render a compatibility percentage, a match score, or odds — not because the page has not been designed yet, but because the product refuses to. Nothing here decides anything about you automatically.

The two consent layers

Before anything is processed, you are asked for two separate consents, each in plain English, each recorded verbatim with its date.

• Layer A — your answers, your survey. Consent to process what you answer in order to produce your own survey. Withdrawable at any time, absolutely: withdraw and your answers and everything derived from them are deleted, completely.
• Layer B — what you create together. Consent to contribute to a record you cannot unilaterally destroy once your partner has relied on it. We tell you this before either of you has shared anything, because afterwards would be too late to be honest about it.

Consent only counts if you can freely refuse. Each of you consents separately and in private; refusing costs you the feature and nothing else; and where the product’s own safety check indicates an abusive dynamic, couples-work is suppressed rather than sold.

What survives if one of you withdraws

Your own answers, scores and survey are yours: withdrawal deletes them completely and immediately, and nobody is asked or notified. The things you deliberately made together behave the way agreements have to:

• The live combined report becomes unavailable to both of you — it needs both surveys to exist.
• Unsigned drafts you wrote are removed; your contributions to shared records are taken out.
• Anything you both signed is different: each of you keeps your own frozen copy of what was signed, and neither of you can delete the other’s. We say this before anyone consents, on the consent screen itself.

Safeguarding

The product carries a design for a safety flag: where an abusive dynamic is indicated by a person’s own direct answer — never inferred from scores — couples-work is suppressed and replaced with a route to specialist services. Today, nothing writes that flag: the question is not yet asked, because the legal conditions for holding the answer are not yet settled. We would rather build it late than hold it wrongly.

Who else touches the data

Nobody buys, rents or receives your data for their own purposes. Our suppliers are:

• Neon — hosts the pilot database, in London (AWS eu-west-2).
• Replit — runs the application and its deployment.
• Resend — sends every email we send: sign-in links, invitations and their reminders, witness invitations, the alert when a new device signs in, links to confirm a change of address, the two messages the contact page sends, and, once the guide is published, its confirmation and the guide itself. Every email is written to reveal nothing about the product’s subject matter on its outside.
• Google — not in use. Google sign-in is built but switched off; if we switch it on, this line will say so first, and it will only ever be the identity assertion.
• Fasthosts — hosts the mailbox our contact address is read in. It holds a message you send through the contact page (your name if you gave one, your address and what you wrote) and any reply to an email from us. An answered enquiry is deleted from it 12 months after it is closed.
• Stripe — not yet. Added here before billing goes live, and billing identity only.

Replit’s published data processing agreement incorporates the EU standard contractual clauses together with the UK Addendum and the IDTA. Two things about it are unresolved, and we treat them as unresolved rather than assumed: whether that agreement applies to our subscription tier at all, and the absence of an encryption commitment in its security appendix.

Where the data lives

Backups: Neon keeps seven days of history for the pilot database; anything deleted is gone from it within 30 days at the latest. The retention page says how.

Pilot data is hosted in the United Kingdom: the database is at Neon, London. The development environment is in North America and never holds real data — it runs on placeholder accounts, and by construction the development server cannot even select the production database.

One honest caveat: the production database credential passes through the development workspace’s secret store for deployment. Whether workspace tooling could reach production data with it is a question we have not yet closed, and until we have, we treat the answer as yes and behave accordingly.

International transfers

The pilot’s personal data is stored in the UK, so no restricted international transfer arises for it. Some of our suppliers are US companies; where any processing outside the UK ever applies, the safeguard relied on is named in the section above — with its open questions marked, not glossed.

How long we keep things

For the pilot: the duration of the pilot, then deletion — unless you explicitly ask to carry your data into the live service under the launch privacy notice. The per-category schedule, including exactly what withdrawal deletes and what it cannot delete, is published at /legal/retention.

Your rights

You can, at any time:

• See your data. Your answers and your survey are shown to you in the product and exportable as a PDF; ask us for anything else.
• Correct it. Your display name is editable in the product; anything else, ask.
• Delete it. The deletion flow is in your account, it works immediately, and it asks nobody’s permission but yours. What it removes and what your partner keeps is stated on the page before you confirm.
• Withdraw consent. Today that means deleting your Sounding data through account deletion — the pilot has one questionnaire, so the two are the same act. As questionnaires multiply, withdrawal is expected to become per-questionnaire.
• Take it with you. Your survey exports as a PDF; a full portable copy is yours for the asking.
• Complain. To us first, if you are willing — through the contact page — and to the Information Commissioner’s Office at ico.org.uk either way. You do not need our permission, and complaining costs you nothing here.

Get help now stores nothing

The crisis pages store nothing at all, and we mean it literally: no database write, no cookie, no browser storage, no analytics, no log of any answer, no record that you were ever there. The address bar never changes while you use it, so it leaves nothing in your history beyond the fact of the page itself. This is a structural commitment, held by automated tests that fail the build if any of it stops being true.

When this page changes

This notice is versioned, and the consent you gave is stored in the exact words you saw at the time — if wording changes later, your record still shows what you agreed to. Material changes will be put in front of you, not slipped past you.