Privacy Policy

This Privacy Policy explains what data 100 Ways to Say ("we", "us") collects, how we use it, and your rights.

1. Data we collect

Account data

• Email address (required)
• Display name (optional)
• Password (stored as a salted PBKDF2 hash; we never see the plaintext)
• Account creation date

Payment data

• Processed by Stripe. We receive: Stripe customer ID, charge confirmation, plan purchased, amount.
• We do not receive or store full card numbers, CVV, or bank credentials.

Usage data

• Generations: moment chosen, tone, length, timestamp, the system prompt version used. We do not store the full text of your generations or your typed context (the "what happened" field) unless you explicitly purchase the Audit Trail add-on.
• Voice Profile: if you upload samples, they are stored to power calibration.
• Gift codes you purchase or receive.

Technical data

• Session cookies (essential — required for sign-in)
• IP address (used for abuse prevention only, not retained beyond 90 days)
• Browser type, OS (for compatibility debugging)

2. How we use data

• To deliver the Service (generate messages, manage your account, charge for purchases)
• To send transactional emails (welcome, receipts, password reset, refund confirmation)
• To prevent abuse and fraud
• To improve the Service (aggregate usage patterns; never with your specific message content)

3. Who we share data with

• Cloudflare (hosting, database) — required to deliver the Service
• Stripe (payments) — only payment data, only for billing
• Anthropic (AI provider) — sends your inputs to generate messages; Anthropic does not retain inputs for training under our agreement
• Resend (email delivery) — only your email address + the message we're sending you

We do not sell your data. We do not share your data with advertisers.

4. Your rights

• Access: Email [email protected] with subject "Data Export" — we'll send everything we have on file within 14 days.
• Deletion: Use the Delete Account button in your Account tab, or email us. We'll purge your account, generations, voice profile, and personal data within 14 days. Stripe payment records are retained per tax law (7 years).
• Correction: Update your name or email from the Account tab.
• Portability: Same as Access — we'll send your data in JSON format.
• Object/restrict: Email us — we'll work with you.

EU residents have rights under GDPR. California residents have rights under CCPA/CPRA. Email us to exercise them.

5. Data retention

• Account data: retained while your account is active. Deleted within 14 days of deletion request.
• Generation metadata: retained for 12 months for service operation.
• Payment records: retained 7 years (tax law requirement).
• Voice Profile samples: retained while your Voice Profile is active. Deleted on request.
• IP addresses: 90 days max.

6. Security

All data is transmitted over HTTPS. Passwords are hashed with PBKDF2 (100,000 iterations, SHA-256). The database is encrypted at rest by Cloudflare. Access to production systems is limited to the founder.

7. Children

The Service is not intended for users under 18. We do not knowingly collect data from minors. If you believe a minor has signed up, email us and we will delete the account.

8. International transfers

Our servers are in the United States. If you are in the EU/UK, your data is transferred to the US under Standard Contractual Clauses.

9. Changes

We may update this policy. Material changes will be announced via email with at least 14 days' notice.

10. Contact

Email [email protected].