Privacy

Privacy

Sophe is a wellness and awareness tool, not a medical product. If you need support for your mental health, talk with a qualified professional, call or text 988 in the US (Suicide and Crisis Lifeline), or visit https://www.iasp.info/suicidalthoughts/.

The bot computes the score on your side. It works if you never register. Registration is opt-in, and the consent note is shown before the first send.

What never leaves the bot

Message text, names, topics, bot names, calendar titles, and any other free text. A short check-in is stored only as a flag and a length bucket. The words are discarded. The server rejects any field that is not on the list below.

What an opt-in day contains

POST /v1/daily accepts this object and nothing else. exercise_id has to be one of the library ids. self_rating is 1 to 5 or null. weights_version is v0.

Fields an opt-in day can contain

Field	Meaning
date	Local date, YYYY-MM-DD
tz_offset_min	Minutes added to UTC to get local time
score	Monkey mind score, 0 to 100
active_min	Active minutes
sessions	Session count
switches	Bot or conversation switches
longest_focus_min	Longest focus stretch, minutes
sprint_overrun_min	Minutes past 90 in an unbroken session
short_checkin_ratio	Short check-ins divided by user messages
offhours_min	Active minutes outside working hours or during protected time
open_loops	Open tasks at day end, or 0 if that signal was unreadable
breaks_15m	Breaks of 15 minutes or more
nudges_sent	Unsolicited nudges sent
nudges_suppressed	Nudges held back by the caps
self_rating	Optional 1 to 5, or null
exercises	Per exercise: exercise_id, offered, completed, break_followed
weights_version	Score config version, currently v0

Exercise ids: box_breath_60, ground_54321, arrive_30, one_breath_gate, park_loops_90, look_far_20, calm_breath_60.

Identity

The server stores a random person id and a random install id. The bearer token is returned once. Only its SHA-256 hash is stored. No email, name, or account id. IP addresses and user agents are not written to the database. Rate limits use Cloudflare's rate limiting binding and are not a stored log.

Workers Logs and traces are off. Cloudflare is not asked to store request headers, IP addresses, or bodies. The handler can record the route, the method, the status, and an error code. That line has nothing else in it, and it is not collected while Workers Logs are disabled.

Your data

Export returns the rows for your anonymous id. Delete removes the person, every linked install, every day, every exercise row, and every link code, and returns a receipt. Linking another install shares that anonymous id, and delete removes the linked installs too.

Retention

Synced numbers are kept for up to 400 days. A job runs every night and deletes any dated row older than that: daily numbers and exercise rows from opt-in sync, and check-in, call-time, and nudge rows from MCP. Raw MCP call times are rolled up into daily counts and removed once their day closes. The job does not remove your random person and install ids. Those stay until you delete your data.