Privacy policy

Who this policy covers

This policy explains how Blue Bonsai (“we” or “us”) handles information when you visit the public site, create an optional account, or save a practice. For questions or privacy requests, email privacy@bluebonsai.life.

Using Blue Bonsai without an account

You can read every field note and use the public practices without signing in. Your practice selection, progress through a practice, and end-of-practice choice remain in your browser's temporary page state and are not saved to a Blue Bonsai account. We do not ask anonymous visitors for journal text, symptoms, diagnoses, or answers about their mental state.

When someone starts a public practice or lets its timer finish, the site sends a same-site measurement request containing only the event name and public practice identifier. Vercel provides aggregate request counts from those paths. Blue Bonsai does not set an analytics cookie or create an account, visitor, or session identifier for this measurement. It does not include a rating, response, free text, or person-level practice history.

Like most websites, our hosting infrastructure receives basic technical information needed to deliver and protect the site, such as IP address, browser and device information, requested page, timestamps, and error or security logs. Vercel may also provide aggregate page-performance and traffic measurements. We do not use advertising pixels or cross-site advertising profiles.

Optional account information

If you create an account, we process your email address, authentication and session information, basic app preferences, and the practice history you choose to save. A saved attempt can include the practice identifier, date and time, and one simple choice: “would use again,” “not sure,” or “not for me.” The active product does not save free-form notes, journal entries, inferred mental states, or AI interpretations.

For signed-in accounts, we also keep a small content-free event log to operate and improve the product. It can record a broad surface viewed and whether a named public practice was started or completed. It does not include journal text, symptoms, diagnoses, free-form notes, or the content of private communications.

Legacy private-beta data

Earlier private-beta versions allowed accounts to save journals, check-ins, reflections, preferences, and generated results. Those features are not available in the current product and new use of the public product does not create that data. If an existing account still has legacy records, they remain restricted to that account until the account holder exports or deletes them. They are included in the account export and removed by account deletion.

How we use information

• to deliver the public site and optional account features;
• to authenticate users and show saved practice history;
• to count aggregate public-practice starts and timer completions;
• to maintain, secure, debug, and understand the basic use of the service;
• to respond to support, privacy, and legal requests; and
• to comply with law and protect the rights and safety of the service and others.

We do not sell personal information, run behavioral advertising, or share personal information for third parties' independent marketing. We do not use saved content to train an AI model.

Service providers

We disclose information to providers that help operate the service: Vercel for hosting and aggregate performance or traffic measurement, and Supabase for authentication and database storage when optional account saving is available. They process information under their own agreements and privacy terms. We may also disclose information when legally required or reasonably necessary to protect rights, security, or safety.

Retention and your choices

Account information and saved history remain until you delete them or the account, unless a longer period is required for security, fraud prevention, legal compliance, or resolving a dispute. Operational logs and backups are kept on limited provider schedules and expire through normal rotation.

Aggregate public-practice measurements are not tied to an account and follow Vercel's operational analytics retention schedule. We use them only to understand whether the public project is being used.

From Settings, you can export account data, delete individual saved attempts, or delete the account and associated records. You may also contact us to request access, correction, or deletion, or to exercise another privacy right available where you live. We may need to verify your identity before completing a request.

Security and incident response

We use reasonable safeguards appropriate to a small web service, including encrypted transport and database access controls intended to separate account records. No online system is perfectly secure. If we discover an incident involving personal information, we will investigate and provide notices required by applicable law.

Adults only

Blue Bonsai accounts are intended only for people 18 and older. We do not knowingly create accounts for children. If you believe a child has provided personal information, contact us so we can investigate and delete it where appropriate.

International processing

Blue Bonsai and its providers may process information in the United States and other countries. Privacy protections can differ from those where you live. Where required, providers use lawful mechanisms for international transfers.

Changes and contact

We may update this policy as the product changes. We will post the new date here and provide reasonable notice of material changes. Contact privacy@bluebonsai.life with questions or requests. You can also review the Terms and Disclaimer.