Privacy Policy

1. Information We Collect

Account Information

When you create an account, we collect your email address and display name through Google, Apple, or email sign-in. We do not store passwords — authentication is handled by Supabase and third-party OAuth providers.

Usage Data

We track the number of deliberations you use each month for billing purposes. We do not store the content of your deliberations on our servers — deliberation history is stored locally in your browser.

LinkedIn Data

If you choose to share your LinkedIn profile during onboarding, we use it only to personalize your board selection. We do not store your LinkedIn data after the onboarding session.

Payment Information

Payment processing is handled entirely by Stripe. We do not store credit card numbers, bank account details, or other payment credentials. We receive only your subscription status and billing period from Stripe.

2. How We Use Your Information

• To provide and maintain SASHA's services
• To manage your account and subscription
• To track usage for billing and rate limiting
• To improve our safety systems (anonymized reporting data only)
• To communicate service updates or billing changes

3. AI Processing

Your questions are sent to Anthropic's Claude API for processing. Anthropic's data usage policy applies to this processing. As of March 2026, Anthropic does not use API inputs or outputs for model training.

Web search queries (when enabled) are sent to the Brave Search API. Brave's privacy policy applies to these requests.

4. Data Sharing

We do not sell your personal information. We share data only with:

• Supabase — Authentication and user profile storage
• Anthropic (Claude API) — AI processing of your questions
• Brave Search — Web search grounding (when enabled)
• Stripe — Payment processing
• Vercel — Application hosting

5. Data Retention

Account data is retained for as long as your account is active. Usage tracking data is retained for billing purposes. Deliberation content is stored locally in your browser and is not retained on our servers.

When you delete your account, we delete your profile data and usage records. Stripe retains billing records per their data retention policy.

6. Your Rights

All Users

• Access your personal data
• Delete your account and associated data
• Export your data
• Opt out of non-essential communications

California Residents (CCPA)

• Right to know what personal information is collected
• Right to delete personal information
• Right to opt out of sale of personal information (we do not sell your data)
• Right to non-discrimination for exercising your rights

EU/EEA Residents (GDPR)

• Right to access, rectify, and erase personal data
• Right to data portability
• Right to restrict or object to processing
• Right to withdraw consent at any time

7. Children's Privacy

SASHA is not intended for children under 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected data from a child under 13, we will delete it promptly. If you believe a child under 13 has provided us with personal information, contact privacy@sasha.ai.

8. Cookies & Analytics

SASHA uses essential cookies for authentication and session management. We do not use third-party tracking cookies or advertising cookies. We may use privacy-respecting analytics to understand usage patterns.

9. Security

We use industry-standard security measures to protect your data, including encrypted connections (HTTPS), secure authentication (OAuth 2.0), and row-level security policies on our database. No method of electronic storage is 100% secure, and we cannot guarantee absolute security.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or in-app notification. Continued use of SASHA after changes constitutes acceptance.