Privacy

Draft updated 14 November 2026; operational wording requires review before release. Nerd Valley AS (org. nr. 927 065 223), at Kongens Gate 6, 0153 Oslo, is the data controller. Write to [email protected] about anything on this page. This is written to be accurate rather than broad. Where another privacy policy would say "we may collect information including but not limited to", this says what is in the database, column by column.

What we hold about you

Your phone number, twice: once hashed, which is what we look you up by, and once encrypted, because at some point we have to dial it. The hash is deterministic, which is the point and also its limit — anybody already holding your number could confirm it is in here, which is true of any system that can recognise you. Your email address, encrypted. Your name, if supplied, is not encrypted. Signup asks for your first name. It is optional and is passed to our voice provider for the greeting and close. Older signups or an operator may have supplied a fuller name; only the first name is passed to the voice provider. What you said you would do — the one commitment from each call, in your own words, encrypted, and only the most recent one. The day you named is kept in the clear, because a weekday on its own says nothing. Your own eight and eighty, and your goals for this year — on the first call you are asked what you loved doing at eight, what you want to have done by eighty, and what you would like to move this year. Your answers, in your own words, encrypted, so later calls can ask about them. And, only if you named one and chose to test it, an assumption about your work ("nobody will pay for this"), in your own words, encrypted, and only the most recent one. These are your answers to questions, never a conclusion drawn about you. Your weekly slot: a weekday, a time, and your timezone, plus your next appointment. We also keep onboarding progress separately from the call counter, so an interrupted introduction can continue. A counter of which call number you are on, how many weeks in a row a commitment went undone, and how many weeks in all it was done, partly done, or not — counts, not a record of which week was which. A row per call attempt: when it was scheduled, whether it connected, how long it ran, and a short note if it failed. Never the words you said — with one exception that is a flag, not a record: if something said on a call suggests you might be at risk or unsafe, that call is marked (1 or 2) so a person reads it, your next call waits until they have, and no automatic email or text goes out about that call. The person (or, when they are away, one named stand-in) is told only that a call needs review; nothing from the call is sent to them. After reading it, they may send you one short text with free helpline numbers, and keep your calls paused until you want them back; we store when that text was sent. If you reply, a person reads your reply in our text provider's message log and answers it — it is not read by the automatic replies. Billing state: whether you are on a trial and when it ends, the payment provider, subscription and customer ids, whether renewal is cancelled and the paid-period boundary returned by the provider. No card details ever reach us — they never touch our servers at all. Your answers to the feedback form, if you fill it in: after your first call we send one text, once, asking two questions. What you write is encrypted like everything else you tell us, kept until you delete everything, and included in your copy. If you choose to speak an answer instead, your phone's own dictation does the listening — on an iPhone that is Apple, on Android it is Google, under their terms rather than ours — and only the resulting words reach us. We never receive or keep a recording. Access cookies and codes. A random browser credential lasts seven days and opens ordinary call controls. Export, deletion and billing management require a phone-verified text link. Viewing or correcting saved notes requires a separate fresh phone code and a 15-minute private session; finishing closes it. These credentials are revoked on deletion. Recovery codes expire after ten minutes. We record request times and attempt counts to limit abuse; secret codes are hashed. We do not use analytics cookies. Your feedback preference. You can stop optional feedback requests separately from calls, recaps, verification codes and billing notices. Optional product feedback. If you open the Feedback button, a functional cookie lets this browser submit, review and remove its reports for 30 days. We encrypt your comment and any screenshot you deliberately attach, and keep them for up to 30 days. We retain a broad page category, screen dimensions, release version and processing status; we do not capture page contents, form fields or URL credentials. A daily rotating hash limits submissions without retaining the IP address. Reports linked to a verified weekly browser are included in account export and removed with the account. Other reports can be removed from the same browser, or expire automatically. GitHub stores only an opaque ticket reference in a private tracker. A restricted automated development workflow using GitHub and OpenAI may read the report to prepare a fix and tests; private processing artifacts and logs expire after one day. A processing copy can remain until then after you remove the report. Proposed code changes require manual approval before release. The original report and screenshot must not enter public code, tests, issues or PRs. Optional encouragement by SMS. Messages are off until you opt in on My page. We store frequency, tone, selected message types, quiet hours and timezone, strong-language choice, pause state and when you opted in. Your optional chosen focus and composed message text are encrypted. Recognition uses only an action you have reported completing; we do not infer your mood or invent progress. Messages and your optional “more like this” / “less like this” feedback are retained for 30 days. Feedback adjusts eligible wording within your choices; pilot and adaptive results are separated in aggregate reports. Preferences remain until you change them or delete the account. You can pause or stop encouragement on My page. Replying STOP stops calls and all SMS. Account export and deletion cover these records. Feature tips and requested reminders. We keep your preference for tips, a fixed sequence identifier and the topics already shown or declined until you delete your account, so we do not repeat them. Account-linked A/B assignments and tip offers, agent reports, transcript-confirmed exposure and explicit responses last 60 days. Aggregate experiment counters and frozen results contain no account identifiers. For one reminder you explicitly request, we encrypt the chosen SMS text and store its agreed local timezone, instant, revision and delivery state. It can be changed or cancelled in a phone conversation before provider acceptance. Preparing a draft does not schedule anything: it expires after ten minutes. Encrypted tool receipts last one day for safe retries; reminder status lasts up to 30 days after its final update. Text is cleared on acceptance, cancellation or suppression, or after its 15-minute delivery window. Scheduled reminders use the same SMS supplier as other texts and do not subscribe you to recurring messages. Call recordings are not stored by us; transcripts are retained for fourteen days. Our voice supplier sends us a transcript when a call ends, we take the one commitment (and the answers above, when they were read back to you) out of it, and the raw delivery is kept encrypted for fourteen days so a broken call can be debugged, then deleted automatically. Fourteen days is long enough to fix last week's call and short enough not to be a record of you. Advisory call-quality results. When enabled, we retain model scores and review states for up to fourteen days. A short recap excerpt waits encrypted for the background review and is cleared immediately after its single attempt, or at expiry. Review results and queued excerpts are included in your export and removed with your account.

What we do not hold

No password. No postal address or card details. No call recordings. No transcript older than fourteen days. Nothing from your phone beyond the number you gave us.

Why

To ring you when you asked, to remember what you said last week so the call is worth having, to email you the recap the call promises, to text you when a call is missed, to take payment, and, when enabled, to identify unnecessary repeated questions and unsupported recap claims. We do not profile you for advertising, we do not advertise, and we do not sell your data or share it for advertising.

Who else sees it

Our service suppliers:

number, which call number this is, your last commitment and the day you named for it, your eight and eighty answers, your goals for this year, your onboarding progress, your next appointment, your weekly slot, any assumption you are testing, and how many weeks in a row a commitment has gone undone — because the mentor has to be able to ask about them — and your first name, so it can greet you; never your full name. When enabled, a call-scoped service credential, current time and account timezone allow tools to return the selected feature tip, reminder text and schedule, and the result of your requested changes. The credential expires when the call settles or after at most 45 minutes, and cannot address another account. That is the whole list, and a test fails the build if a new field starts going to them without appearing here.

payments. It receives the information you submit there. We receive subscription and customer ids, status, renewal cancellation and paid-period dates. When you choose checkout we pass an opaque caller reference and your recap address to match the purchase; we do not send your call notes. Plus the company hosting the server. Some of these are outside the EEA and transfer data under the European Commission's standard contractual clauses.

How long

Your weekly-service record stays until you delete it or ask us to. Beliefs programme content has the separate retention rules below. Transcripts, fourteen days. A verification code works for ten minutes. An unverified booking draft can be recovered for one hour after the latest code request and is removed by the next scheduled cleanup. A reschedule link lasts a week. The cookie on the browser you signed up with, a week. If you stop the calls, we keep your record so that starting again is one tap rather than a re-registration. If you would rather it were gone, say so — see below — and it is gone.

Delivery records and service measurement

Transactional messages are queued with encrypted recipients and content. Accepted or suppressed message content is cleared immediately; other content is cleared by the cleanup job after its short retry window (ten minutes for phone codes, up to six hours for texts and 23 hours for email). Delivery and attempt metadata is kept for up to 30 days, then removed by the scheduled cleanup job. We keep daily booking/control request counts without visitor identifiers, IPs or tracking cookies. Account-linked service milestones contain only a lookup key, a fixed event name and time, and an opaque conversation-cycle reference when needed to distinguish weekly calls from callbacks, not what you said. These measurements are removed after 60 days by the cleanup job, or with the account. They help us see where the service fails; they do not tell us whether a conversation was useful.

Your rights

You can ask for a copy of everything we hold, ask us to correct it, or ask us to delete it. Deletion stops calls and removes the application profile, personal notes, feedback, call-attempt history, linked retained call deliveries, pending signup, message records, service milestones and access credentials. It cannot be undone and it is not a deactivation. If a subscription exists, we first require the payment provider to confirm that it will not renew. Calls stop immediately on the confirmed deletion request. If billing confirmation fails, the application record is retained so cancellation can be resolved; the page tells you this. The provider retains its own transaction records under its retention obligations. Deleting the application record does not erase those records or automatically refund a payment. Your export includes stored personal context, account settings, call history and linked call data still in the fourteen-day buffer. It excludes secret access codes and credentials, and omits duplicate copies of earlier export payloads. Retained message and service milestone records are included. Payment-provider records can be requested from that provider. The fastest way is the page linked in every text we send. Failing that, email [email protected] and we will do it within thirty days, usually the same day. You can also complain to Datatilsynet, the Norwegian Data Protection Authority.

Security

Numbers, addresses, commitments and transcripts are encrypted by the application before they reach the database, with AES-256-GCM, rather than relying on an encrypted disk underneath it. That is deliberate: the realistic failure is a compromised application or a query that returns too much, and an encrypted volume stops neither.

Children

The service is not for anybody under 18.

Changes

If this page changes in a way that matters, we will email you. You can review and correct your saved commitment and goals from “Correct what I remember” on your call page. This requires a fresh phone code and opens a 15-minute session. Finishing that session closes access to the notes. Ordinary call-control links do not display them.

Separate Beliefs programmes

Each programme has its own identifier, chosen outcome, caller-authored beliefs, prepared decisions, supporting experiences, remaining difficulty, opportunities, weekly scores and prior decision versions. Personal practice content is encrypted. We keep consent, schedule, payment references, refund requests, completion and included-check-in status separately. Programme activity does not overwrite weekly 8&80 memories or its subscription. Fresh Beliefs phone verification is required for private history and the complete account export. An unfinished purchase and its progress do not expire merely through inactivity. Completed practice history is scheduled for deletion 12 months after completion. We send a content-free reminder 30 days before the planned date. Your private account offers export, immediate programme-history deletion and an explicit later date you choose (shown as a UTC date). An extension is never automatic. Automatic cleanup also allows at least 30 days after a delivered reminder or your explicit acknowledgment. Failed or opted-out reminders require support follow-up; cleanup waits for that opportunity to export or choose. Your account shows the planned date even when a text cannot be delivered. Programme-history deletion removes its personal practice and retained application transcript content. It preserves another programme's history, unfinished progress, weekly-service data and the minimum record of any unused included return check-in. Necessary financial records are handled separately under applicable recordkeeping requirements. A payment record is not a reason to retain personal belief content. Whole-account deletion remains a distinct action covering both services. Speechify receives the selected programme's practice context and preferred name for its calls; support email is excluded from voice context. A signed, timestamped caller turn supported by reconciled caller-owned capture can establish connection for the refund clock. We do not treat outbound acceptance, a schedule or voicemail as proof that you received a call. Unknown historical connection timing requires support review and does not shorten the voluntary guarantee. Our application cleanup does not establish erasure at independent providers or in backups. The controller must verify provider retention/deletion, backup expiry, financial-record periods and the operational handling of failed notices before publishing the paid programme. These operational details remain under review.