Decentering
Privacy Policy
What Decentering collects, why, who processes it, and how to ask for a copy or deletion.
Last updated November 7, 2026
1. Who we are
H2H Media Group Inc. is the operator of Decentering. Our address is 460 Doyle Ave., Kelowna, BC V1Y 0C2, Canada. Contact us at support@decentering.app.
This policy explains what we collect, why, who processes it, and the choices you have. It applies to the Decentering app and to the public pages on this site. It does not describe any other product.
2. Information we collect
We collect only what the practice needs. Depending on how you use Decentering, that includes:
- Account: your email address. Sign-in is a magic link. We do not collect or store a password.
- Time zone, the reminder hour you pick, and whether daily reminder email is on. Until you choose a zone, the account starts as America/Vancouver.
- Practice history: breath sessions and awareness-rep sessions, including when they started and finished, and the order of upcoming reps.
- Chat history: the messages you write in the Decentering process and the replies the model returns.
- Payments: a Stripe customer id, subscription id, whether the membership is active, the plan interval (month or year), and the end of the current paid period. We never store your card number.
- Consent: the consent version you accepted (currently 2026-11-07b) and the time you accepted it.
- Safety alerts: for serious categories, a private Slack message with your account ID, the category, how serious it looks, and the words that triggered it. The alert never includes the message you wrote. We do not keep a separate safety-flag table in the Decentering database. The chat message itself remains in your transcript until you delete that chat or the 12-month deletion removes it.
- Basic server logs: the host may record the IP address, browser, page requested, and status code. Login rate limits also hold an IP address and email in memory on one server for a short window. Those rate-limit values are not written to your profile.
- A short record that a welcome, reminder, tier, or membership email was sent (the kind and the time, not the body).
3. What we do not collect
We do not ask for your name, government ID, precise location, or health records from a clinic. We do not use advertising cookies or an analytics product. Card numbers stay with Stripe.
4. How we use information
We use this information to:
- Create your account and send the magic-link sign-in email.
- Run the breath, choose the awareness rep for your local day, and keep your practice history.
- Send your chat to the AI provider and store the transcript so you can continue it.
- Send a safety alert when the chat hits a serious category, and show you support resources.
- Take payment, know whether a paid tier is open, and send membership email.
- Send the welcome note and, only if you opt in, the daily reminder. Every email has an unsubscribe link.
- Remember that you accepted the current disclaimer, terms, and this policy.
- Keep the Service secure, debug failures, and meet a legal duty if one applies.
5. Legal bases
If you are in Canada, we follow the Personal Information Protection and Electronic Documents Act (PIPEDA). We identify the purposes above, we collect only what those purposes need, and we rely on your knowledge and consent. The tick box is that consent for the practice, the chat, and the safety alert. The reminder switch is a separate opt-in. You may withdraw consent by closing the account or, for reminders, by unsubscribing. Withdrawing consent means we stop the related use, except where the law lets us keep a record.
If you are in the European Economic Area or the United Kingdom, the General Data Protection Regulation (or the UK GDPR) applies as well. Our bases are: contract, to provide the account and the practice you asked for and to bill a membership; consent, including explicit consent for health-adjacent chat text and for the safety alert, and consent for reminder email; legitimate interests, for security, abuse prevention, and basic server logs, balanced against your rights; and legal obligation, where a law requires us to keep or disclose information.
6. Processors
These companies process personal information for us. We do not sell the data to them.
- Supabase: database and sign-in. The project is hosted in the United States, region us-west-1. Magic-link email is sent by Supabase Auth.
- Vercel: hosting the app and keeping hosting and request logs.
- Stripe: checkout, renewals, cancellation, and the billing portal. Card numbers are entered on Stripe's pages and are never stored by us.
- Resend: the app's own email (welcome, reminders, tier unlock, and membership notes) from mail.decentering.app. The usual from address is hello@mail.decentering.app.
- Anthropic: the Decentering process chat. The model named in the app is claude-sonnet-5. The messages needed to write a reply are sent to Anthropic. We do not send them to a different model provider.
- Slack: internal safety alerts containing the account ID, category, severity, and triggering words, and never the message text.
- Sentry, only if an error-reporting address is configured. It stays off until then, and it is set not to collect cookies, headers, request bodies, or chat text.
7. Sensitive and health-adjacent information
A chat can include information about your feelings, health, or circumstances because you chose to write it. That information can be sensitive. It is not a medical record, and Decentering is not a HIPAA-covered service. We are not a covered entity or a business associate, and we do not operate under the U.S. Health Insurance Portability and Accountability Act.
The tick box is your explicit consent for us to process that health-adjacent information in order to run the practice, including sending the chat to Anthropic, and for us to process the limited safety alert described above. You can delete a chat, and you can ask us to delete the account.
8. International transfers
Your account, practice history, chats, consent record, and membership status are stored in the United States (Supabase region us-west-1). Vercel, Stripe, Resend, Anthropic, and Slack may process information in the United States and in other countries where they operate.
If you are outside the United States, using Decentering means your information is transferred to the United States. For people in the EEA or the UK, that is an international transfer. A signed transfer agreement is not stored in this app's repository. You can email support@decentering.app to ask what safeguard is in place with a processor.
9. Retention
You can delete a Decentering process chat in the app. Deleting the chat removes that transcript. A scheduled job also deletes a transcript 12 months after that chat session was created, and the messages in it are removed with the session.
Practice history, your profile, your consent record, reminder settings, and the email-send log stay for the life of the account. They are removed when the account is deleted, because those records are tied to the account. There is no separate in-app button that deletes the whole account. Email support@decentering.app and we will delete it.
We keep the Stripe customer id, subscription id, status, interval, and period end while the account exists. Stripe keeps payment records under Stripe's own policy. Safety alerts are not copied into our database. Slack keeps the alert under Slack's retention. Hosting logs are kept by Vercel for Vercel's log retention. This repository does not set a custom log retention period.
If we learn an account belongs to someone under 18, we delete it.
10. Security
Sign-in uses a one-time email link rather than a password. Database access is limited so a signed-in person reads their own rows. The consent fields and the membership record are not writable from the browser. Traffic uses HTTPS. Error reports, if enabled, are set to drop cookies, headers, request bodies, and chat text.
No method of storage or transmission is perfectly secure. Please use an email account you control.
11. Your rights
You can ask for access, correction, deletion, or a copy of the personal information we hold about you. Email support@decentering.app from the address on the account. We will respond within the time PIPEDA or, if it applies, the GDPR requires. There is no automated export button in the app. We send the export by email.
You may also withdraw consent, object to a use based on legitimate interests, and, where the GDPR applies, ask us to restrict processing or to send your information to another service where that is technically reasonable. You may complain to the Office of the Privacy Commissioner of Canada, or to your local European or UK authority. We ask that you contact us first so we can help.
You can turn reminders off from the unsubscribe link in any email, or from the reminder page in the app. You can delete a chat yourself.
13. Children
Decentering is for people 18 or older. We do not knowingly collect personal information from anyone younger. The tick box is how we ask you to confirm your age. We do not run a separate age-check. If we learn an account belongs to a minor, we delete the account and the information tied to it. Email support@decentering.app if you believe a minor has an account.
14. We do not sell information or use it for ads
We do not sell your personal information. We do not share it for cross-context behavioural advertising. We do not use your email, practice history, or chats to advertise to you or to build an advertising profile. The processors above receive information only to run Decentering.
15. Changes to this policy
We may update this policy. The date at the top will change. If a change is material, we change the consent version and ask you to agree again in the app before you continue. This version is dated November 7, 2026 and matches consent version 2026-11-07b.
16. Contact
H2H Media Group Inc., 460 Doyle Ave., Kelowna, BC V1Y 0C2, Canada. Privacy requests go to support@decentering.app. The Terms of Service are at /terms.