Privacy Policy

• Account data. Your email address and authentication details, used to create and secure your account.
• Journal entries and reflections. What you write in your morning and evening rituals and your conversations with Senecai. This is the most sensitive data we hold, and we treat it accordingly.
• Practice activity. Session timestamps, streaks, and which rooms of the Stoa you visit — used to render your world and your progress.
• Payment data. Payments are handled entirely by Paddle, our merchant of record. We never see or store your card number. Paddle shares with us only what we need to manage your subscription (such as your plan and subscription status). See Paddle’s privacy policy at paddle.com/legal/privacy.
• Basic technical data. Standard server logs (such as IP address and browser type) used for security and to keep the Service running.

We use your data only to provide and improve the Service: to run your account, save your practice, render your Stoa, power Senecai, process your subscription, respond to support requests, and keep the Service secure. We do not sell your personal information, and we do not use your journal entries for advertising — ever.

Your account data, journal entries, and practice activity are stored with Supabase, our database and authentication provider, hosted in the eu-west-1 region (European Union, Ireland). Data is encrypted in transit and at rest, and access is restricted by row-level security so your data is only readable by you.

When you use Senecai or AI-assisted reflection features, the relevant journal content and messages are sent to Anthropic’s Claude API to generate a response. Under Anthropic’s commercial terms, your content is not used to train Anthropic’s models. We send only what is needed to power the feature, and the responses come back to you alone. Senecai’s grounding texts are public-domain Stoic works — your private writing never becomes part of them.

We use cookies only to keep you signed in (authentication session cookies). We do not use advertising cookies, cross-site trackers, or third-party analytics trackers. Because we only set cookies that are strictly necessary, there is no cookie banner to dismiss.

We share data only with the service providers needed to run Stoic Habits, each bound by their own data-protection obligations:

• Supabase — database, authentication, and storage (EU);
• Anthropic — AI processing for Senecai (described above);
• Paddle — payments, billing, and taxes, as merchant of record;
• Vercel — website hosting.

Beyond that, we disclose data only if the law requires it or to protect the rights and safety of our users. There are no data brokers, no ad networks, and no buyers.

We keep your data for as long as your account is active. If you delete your account or ask us to, we delete your personal data — including your journal entries — within 30 days, except for minimal records we must keep for legal, tax, or fraud-prevention reasons (held by Paddle for payment records).

Under POPIA, the GDPR, and similar laws, you have the right to:

• access the personal data we hold about you;
• correct inaccurate data;
• delete your data (“right to erasure”) — on request, we delete your account and everything in it;
• receive a copy of your data in a portable format;
• object to or restrict certain processing; and
• complain to a supervisory authority — in South Africa, the Information Regulator; in the EU/UK, your local data-protection authority.

To exercise any of these rights, email recoverykingsco@gmail.com from your account email. We respond within 30 days.

We are based in South Africa, your data is hosted in the EU, and some providers (such as Anthropic and Paddle) process data in the United States. Where data crosses borders, we rely on our providers’ safeguards — such as standard contractual clauses and equivalent protections — as required by POPIA and the GDPR.

We protect your data with encryption in transit and at rest, row-level security on every database table, secure session handling, and the principle of least access. No system is perfectly secure, but if a breach ever affects your personal data, we will notify you and the relevant authorities as the law requires.

Stoic Habits is not intended for children. You must be at least 16 years old to create an account. We do not knowingly collect data from anyone under 16; if we learn that we have, we will delete it.

If we change this policy in a material way, we will notify you by email or in the app before the change takes effect. The “Last updated” date at the top shows the current version.

For anything privacy-related, email recoverykingsco@gmail.com. Responsible party / controller: Recovery Kings Company (Pty) Ltd, registered in South Africa, trading as Stoic Habits.