Privacy Policy

Our Commitment to Your Privacy

At h0pe.ai, we believe that privacy is a fundamental right. We've built our platform with privacy-first principles, collecting only what's necessary to provide you with evidence-based hope interventions.

What Data We Collect

Information You Provide

• Email Address: When you sign up for early access or our newsletter, we collect your email address to send you updates about h0pe.ai and your personalized Hope Protocol.
• Assessment Responses: When you complete our Hope Assessment, your responses are processed locally in your browser by default to generate your Hope Score. If you opt in to the anonymous hope-norms contribution, your 8 scored answers and raw scores may be sent to our EU processor as described below. If you opt in to progress memory, an opaque code is stored on your device after you press Save my choices and repeated Hope Scores are linked pseudonymously on our server for your own re-test deltas. Product analytics does not read your local score history or continuity token.
• Practitioner-Linked Results: If you open the assessment through a personal link provided by your therapist or coach, your resulting Hope Score (total, Agency, and Pathways scores — not your individual answers) is sent to our server and shared with that practitioner. This happens only via a practitioner link, and the results page tells you when your result has been shared.

Anonymous Hope-Norms Contribution (opt-in)

When you finish the Hope Assessment you can choose to contribute your answers to our anonymous hope-norms dataset. This is entirely optional — your Hope Score is always shown to you whether or not you contribute.

What is stored if you opt in: a fresh, random pseudonymous identifier created for that single submission; your 8 scored answers (each 1–8); your raw Agency, Pathways, and Total scores; and — only if you choose to provide them — a coarse age band and a broad world macro-region (e.g. "Europe"). We do not store your name, email, account, IP address, device, user-agent, precise location, or any free text on this path. The contribution is not linked to any email or account.

Purposes and lawful bases:

• Building anonymous hope norms — processed only with your explicit opt-in consent (GDPR Art. 6(1)(a)). Because a wellbeing score could be seen as relating to mental wellbeing, we treat it as sensitive and rely on your explicit consent under Art. 9(2)(a) as a precaution, even though we position the Hope Score as a positive-psychology self-reflection score, not a health or clinical measure.
• Aggregate research — optional, separately toggled, and dependent on your anonymous hope-norms contribution; processed only if you explicitly opt in.

Processor: the contribution is stored with Supabase, hosted in the European Union (eu-west-1, Ireland), acting as our data processor under a data-processing agreement. We remain the data controller.

Retention: anonymous contributions are retained indefinitely as part of the aggregate norms dataset, because they contain no identifier that can be traced back to you.

Optional demographics: If you choose, you can add a coarse age band and a broad world region. These are optional, stored only with your opted-in score contribution, and used only for aggregate analysis with small groups suppressed. We do not collect exact age, country, city, or location, and the form does not ask anyone under 18 to identify themselves.

Structured feedback: You can also tell us whether your result felt accurate — a fixed-choice answer, never free text. This reaction is anonymous: we store no cookies and nothing on your device for it, we keep no raw score, band, answers, name, email, IP, or identifier with it, it is not linked to your score or to you, and a fresh random identifier is used for each batch. Because it is anonymous and we access nothing on your device, it is not personal data and does not require your consent; we disclose it here for transparency. It is processed by our EU processor (Supabase, eu-west-1, Ireland) and used only to improve h0pe.ai — never to judge or score you, and never sold or shared.

Small-step taps: If you press “I'll try this” on the results page, we record one anonymous, closed-bucket micro_action_tap event so we can measure whether h0pe.ai helps people move from insight to action. The event stores only which broad subscale the step targeted (agency or pathways) and whether it was the first or second offered step. It stores no raw score, band, answers, text, name, email, IP, device identifier, continuity token, or join key, and it is not linked to your Hope Score or progress-memory history. It uses no cookies and reads or writes nothing on your device; a fresh random server identifier is used for each accepted analytics batch. Because this bucket is anonymous and involves no terminal storage/read, it does not require consent; we disclose it here for transparency.

Progress memory / re-test linkage (opt-in)

You can choose to let this device remember your Hope Score progress over time. This is optional and never a condition for seeing your own score. The checkbox is draft-only until you press Save my choices.

Device code: after you opt in and save, h0pe.ai stores a server-signed opaque code in this browser's localStorage. The token body is an anonymous code — it contains no name, email, account, IP address, user-agent, or UUID. It is device-only and does not follow you across devices. Forget this device clears the local code.

Linked server history: when that code is used, our server derives the stable pseudonymous linkage and stores repeated Hope Scores over time for your own re-test deltas. This linked longitudinal history is pseudonymous personal data, not anonymous. We do not use this token for anonymous analytics or structured feedback, and those systems must not receive it as a join key.

Lawful basis and retention: the lawful basis is your explicit consent for the retest_linkage purpose (GDPR Art. 6(1)(a) and, as a precaution for wellbeing-adjacent longitudinal scores, Art. 9(2)(a)). The beta continuity token expires after 180 days. You can withdraw as easily as you gave consent by using Change or withdraw my choices or Forget this device.

Your rights over linked history: because the continuity-linked record is pseudonymous personal data, access, erasure, and portability rights (GDPR Arts. 15, 17, and 20) apply to the linked longitudinal record while we can resolve it from your device token. Forget this device asks the server to revoke the token mapping and erase the token-linked history we can find. The honest limit that anonymous norm rows cannot be singled out applies only to genuinely anonymous norm contributions — not to the continuity-linked history.

Your choices & how to withdraw them

On the results page, consent options are draft-only until you deliberately press Save my choices. After a successful save, use Change or withdraw my choices in the same results context to append a superseding withdrawal record for the anonymous contribution and, if progress memory is active, to forget the token-linked history. You can also use Forget this device from the progress-memory panel.

Withdrawing stops future use of genuinely anonymous norm rows, but those past anonymous contributions carry no identity, so they can't be singled out or removed — that's the privacy trade-off that keeps them anonymous. This caveat does not apply to continuity-linked history: if your device token can resolve the linked record, erasure is available for that pseudonymous longitudinal record.

If we hold identifiable or pseudonymous data about you, such as an email subscription, a future account, or a continuity-linked Hope Score history resolvable from your device token, full access, erasure, and portability rights apply to that data. Contact us using the details below.

• Right to erasure / access / portability: these rights apply to identifiable data such as your email subscription and to pseudonymous continuity-linked records while your device token can resolve them. They cannot be applied to an individual genuinely anonymous assessment contribution because it contains no identifier linking it to you, so we cannot single it out (GDPR Recital 26 / Arts. 11, 15, 17, 20).

Information Collected Automatically

• Anonymous Analytics: We use privacy-first product analytics to understand which pages and actions help people, so we can improve h0pe.ai. These analytics are anonymous: we set no cookies and store nothing on your device for analytics, and we send only a small set of bucketed, non-identifying events (for example which page was viewed, a coarse time-on-task band, share/download actions, accuracy-feedback choices, and small-step tap buckets). They contain no URL, referrer, IP, device, browser, session ID, name, email, free text, or score, and a fresh random identifier is used for each batch so events cannot be linked across time, sessions, or devices, or to your Hope Score. Because this data is anonymous and we access nothing on your device, it is not personal data and does not require your consent; we disclose it here for transparency. Events are processed by our EU processor (Supabase, eu-west-1, Ireland).

How We Use Your Data

• Email Communications: To send you your Hope Protocol, educational content, and platform updates. You can unsubscribe at any time.
• Service Improvement: Anonymous analytics help us understand which content resonates and how to improve the user experience.
• Research: Opted-in anonymous assessment contributions may be used in aggregate, non-identifying hope research only if you separately opt in.
• Progress Reflection: Opted-in continuity linkage is used only to show your own re-test delta on this device and to help you reflect on momentum over time.

What We DON'T Do

Our Privacy-First Analytics

We've built our own analytics system (analytics.js) with privacy as the foundation:

• No Cookies: We don't use cookies for analytics
• No Fingerprinting: We don't collect device fingerprints
• No Terminal Storage: We do not read or write cookies, localStorage, sessionStorage, IndexedDB, cache, or fingerprints for analytics
• No PII: No personally identifiable information is collected
• Anonymous Server Analytics: Server events are bucketed and non-identifying, with a fresh random identifier for each batch and no consent record written by analytics
• Aggregate Data: We only analyze patterns across users, never identity-linked individual behavior

Data Storage & Security

• Email addresses you submit through our signup forms are stored with Supabase, hosted in the European Union (eu-west-1, Ireland), in an access-locked identity store that is kept separate from — and never merged into — our anonymous analytics data
• Email signups use double opt-in: we record your affirmative consent (consent version email-consent-v1) and send a confirmation link you must click before we add you. We send those confirmation and unsubscribe emails through Resend (see Third-Party Services)
• Optional email↔progress linkage (identity-linkage-v1): If — and only if — you separately tick the optional linkage box at your results, we link your email to your pseudonymous hope-score history (the continuity code described above) inside our access-locked EU identity store, so we can show you your progress over time. This is a distinct, unticked opt-in from the email signup itself; it is committed only after you confirm your email, is never merged into our anonymous analytics, and you can withdraw it anytime via Forget this device or by unsubscribing, which severs the link
• We use industry-standard encryption for data in transit (HTTPS/TLS)
• Assessment results are calculated client-side; scores are transmitted to our servers only when you use a practitioner link (see above), sent to Supabase in the EU (eu-west-1, Ireland) if you opt in to the anonymous hope-norms contribution, or stored as pseudonymous continuity-linked scores if you opt in to progress memory
• Opted-in anonymous contributions, pseudonymous continuity-linked records, and anonymous bucketed product analytics events are stored with Supabase in the EU (eu-west-1, Ireland)
• We retain email addresses only as long as you remain subscribed

Your Rights

You have full control over your data:

• Unsubscribe: Every email includes an unsubscribe link. One click and you're removed.
• Forget this device: On the assessment results page, use Forget this device to clear the local progress-memory code and request erasure of the token-linked pseudonymous Hope Score history we can resolve from that code.
• Data Deletion: Request complete deletion of your data by emailing us at [email protected]
• Data Access: Request a copy of any data we hold about you
• Corrections: Request corrections to any inaccurate data

We respond to all privacy requests within 30 days.

Third-Party Services

• Email storage (Supabase): Email addresses from our signup forms are stored with Supabase in the European Union (eu-west-1, Ireland), in an access-locked identity store that is firewalled from — and never merged into — our anonymous analytics data.
• Email delivery (Resend): Our double opt-in confirmation and unsubscribe emails are sent through Resend, acting as our email-delivery processor. Resend receives only your email address and the message content — never your Hope Score, answers, or analytics data.
• Cloudflare: Our site is delivered through the Cloudflare content delivery network, which processes standard connection data (such as IP addresses) to serve and secure the site. View their privacy policy.
• Spam / bot protection: To keep anonymous contributions genuine, your browser completes an automated proof-of-work check before a contribution is saved. This runs on our own domain, sets no cookies, and collects no personal data. Where your browser allows it, an optional Cloudflare check may also run; if your privacy settings block it, your contribution still works.
• Supabase: Opted-in anonymous assessment contributions and anonymous bucketed product analytics events, including small-step tap buckets, are stored with Supabase, hosted in the European Union (eu-west-1, Ireland), acting as our data processor for this path.
• Google Fonts: We use Google Fonts for typography. No user data is shared with Google beyond standard font requests.

Children's Privacy

h0pe.ai is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe we have collected such information, please contact us immediately.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. We encourage you to review this policy periodically.

Contact Us

Questions about our privacy practices? We're here to help:

• Who is responsible for your data (controller): Marcin Skorupka, operating as h0pe.ai
• How to contact us / exercise your rights: [email protected]
• Why we hold your email: to operate the early-access waitlist you asked to join (lawful basis: your consent, GDPR Art. 6(1)(a)).
• Processors: Supabase (EU, eu-west-1) for storage; Resend (EU) for the confirmation email.
• Retention: until you withdraw or the early-access program ends; withdraw any time via [email protected].
• Check-in reminder: if you ask for a one-time check-in reminder, we store your email address solely to send that single email on the date shown when you asked (lawful basis: your consent, GDPR Art. 6(1)(a)). Processors: Supabase (EU, eu-west-1) for storage; Resend (EU) for sending. Retention: deleted immediately after the reminder is sent, or within 30 days if delivery fails; cancel earlier any time via [email protected]. Your reminder address is never joined to your Hope Score or assessment answers, and is never added to any newsletter or list.
• Your rights: access, rectification, erasure, restriction, portability, and to object; and to lodge a complaint with a supervisory authority.
• Website: h0pe.ai