Privacy Policy

1. Information We Collect

We collect the following types of information:

• Account information — your email address, optional display name, and a hashed (never plaintext) version of your password when you create an account. Lawful basis: performance of our contract with you (providing the account you requested).
• Message content — text you submit to the translator is sent to our AI provider to generate a suggestion. Message text is not stored on our servers after the response is delivered. In reply-coach mode, the message you paste in may have been authored by someone other than you (the account holder) — for example, a message someone else sent you. That text is sent to our AI provider, xAI, in the same way as any other message text (see Section 3), and is handled under this same policy. Lawful basis: performance of our contract with you (providing the translation or reply-coaching service you requested); for text authored by a third party, our legitimate interest in providing the feature you initiated.
• Usage data — a timestamp is recorded each time you use the translator. This is used only to enforce the free-tier daily limit and is not tied to message content. Lawful basis: legitimate interest in enforcing the free-tier limit and maintaining service integrity.
• Feedback ratings — if you submit a thumbs up or thumbs down rating, we store your rating, the translator mode (rewrite or reply), your audience setting, any active tone modifier, and optional category tags you select. Message content is never included in feedback records. Lawful basis: your consent, given when you choose to submit a rating.
• Contact form submissions — if you write to us through the contact page, we store your name, email, subject, and message so we can respond. Lawful basis: legitimate interest in responding to an inquiry you initiated.
• Subscription data — if you subscribe, we store your Stripe subscription ID, plan status, and billing period end date. Full payment card details are handled by Stripe and never stored on H2T2H servers. Lawful basis: performance of our contract with you (providing the paid subscription you purchased).
• Browser storage — we use your browser's localStorage to remember your audience preference (e.g., “her” or “humans”) between visits and to keep your most recent translation result so a page refresh does not lose it (overwritten by each new result, no history kept), and sessionStorage to carry a pending message through the sign-in flow. All of this is stored only in your browser and is not sent to our servers independently. Lawful basis: legitimate interest in providing the site's core functionality (this data never leaves your browser).
• Authentication tokens — a JWT session token is stored in your browser to keep you signed in. It expires automatically and can be cleared by signing out. Lawful basis: performance of our contract with you (keeping you signed in to your account).

2. How We Use Information

• Authenticate your account and manage sessions
• Process translator requests and return suggestions
• Enforce the free-tier daily usage limit
• Manage subscriptions and billing through Stripe
• Respond to contact form submissions
• Analyze feedback patterns linked to your account to improve output quality
• Maintain service reliability and investigate security issues

We do not sell your data, use it for advertising, or share it with third parties outside of the service providers listed in section 3.

3. Third-Party Service Providers

We use the following providers to operate H2T2H:

International data transfer — xAI, Stripe, and Cloudflare are U.S. companies, so using them means the personal data described in section 1 may be transferred to and processed in the United States. Where a GDPR-recognized transfer mechanism is required, we intend to rely on the European Commission's Standard Contractual Clauses (SCCs) as that mechanism. As of the date at the top of this page, we have not yet independently confirmed SCC (or equivalent) status directly with xAI, Stripe, or Cloudflare; we are working to confirm this with each provider and will update this section once confirmed.

• xAI (Grok) — message text you submit to the translator is sent to xAI's API to generate suggestions. xAI processes this data subject to their own privacy policy. Message text is not retained by H2T2H after the response is delivered.
• Stripe — payment processing for subscriptions. Stripe handles all card data under their own PCI-compliant privacy policy. We store only the subscription status and identifiers Stripe returns to us.
• Cloudflare — H2T2H runs on Cloudflare Workers and Pages, and account data is stored in Cloudflare D1. All traffic, including message content in transit, passes through Cloudflare infrastructure.
• Cloudflare Turnstile — bot and abuse protection used on the sign-up and contact forms. Turnstile processes a browser challenge that does not require solving a puzzle or storing personal identifiers.

4. Data Retention

• Message text — not retained after the AI response is delivered.
• Account data — retained while your account is active. Deleted immediately when you delete your account in Settings.
• Usage timestamps — retained while your account is active for rate-limiting purposes. Deleted with your account.
• Feedback ratings — retained to inform ongoing quality improvements. Deleted with your account.
• Contact submissions — retained to track and respond to your inquiry.
• Billing records — retained as required for financial record-keeping and dispute resolution.
• Password reset tokens — expire automatically within one hour and are deleted when used.

5. Security

We use reasonable technical safeguards including encrypted connections (HTTPS), hashed passwords, and short-lived authentication tokens. No system can guarantee absolute security. If you believe your account has been compromised, please contact us immediately.

If we become aware of a security breach affecting your personal information, we will notify affected users by email to the address on file within 30 days of discovery, or sooner where required by applicable law.

6. Your Choices

• Update your name or email in Settings.
• Delete your account and associated personal data at any time from Settings. Any active subscription is canceled automatically. Billing records may be retained by our payment processor as required by law.
• Request a summary of the personal data we hold about you by contacting us through the contact page.
• Clear your browser's localStorage and sessionStorage at any time through your browser settings to remove locally stored preferences.

EU/UK Data Subject Rights (GDPR / UK GDPR)

If you are located in the European Economic Area or the United Kingdom, you have the following rights over your personal data, in addition to the choices above:

• Access — request a copy of the personal data we hold about you.
• Rectification — request that we correct inaccurate or incomplete data.
• Erasure — request that we delete your personal data, subject to legal retention requirements (see section 4).
• Restriction of processing — request that we limit how we use your data in certain circumstances.
• Data portability — request your data in a structured, commonly used, machine-readable format.
• Objection — object to processing we base on legitimate interest, as identified in section 1.
• Lodge a complaint — you may lodge a complaint with your local data protection supervisory authority (for UK residents, the Information Commissioner's Office; for EEA residents, the authority in your member state), in addition to or instead of contacting us directly.

To exercise any of these rights, contact us through the contact page. We will respond within the timeframe required by applicable law.

7. California Privacy Rights (CCPA/CPRA)

The California Consumer Privacy Act (as amended by the CPRA) applies only to a “business” that meets one of several scale thresholds — for example, annual gross revenue over $26.625 million, buying or selling the personal information of 100,000 or more California consumers or households in a year, deriving 50% or more of annual revenue from selling or sharing California consumers' personal information, or processing the sensitive personal information of 50,000 or more California consumers in a year.

Based on our current scale, H2T2H does not meet any of these thresholds. This is documented internal analysis, pending confirmation by an attorney, not a final legal conclusion. As a result, we have not built a California-specific “Do Not Sell or Share My Personal Information” link or a verifiable-consumer-request process at this time. We do not sell or share personal information regardless (see sections 2 and 3 above), and we will revisit this analysis, and build the required mechanisms, if our scale approaches any of the thresholds above.

8. Email Communications

Today, H2T2H sends only transactional service email — account verification, password reset, and related account-confirmation messages. These messages support your use of an active account and are sent regardless of any marketing preference, for as long as your account remains active; they are not a marketing opt-out you can turn off separately.

H2T2H does not currently operate a marketing email program (newsletters, promotional campaigns, or re-engagement email unrelated to a specific account action). If that changes in the future, any marketing email will include an opt-out mechanism and a physical postal address as required by the CAN-SPAM Act, and will be clearly distinguishable from the transactional service email described above.

9. A Note on Sensitive Topics

H2T2H is a communication coaching tool. It is not a substitute for therapy, legal counsel, medical advice, or crisis support. If you are in crisis or danger, please contact emergency services or a qualified professional.

10. Policy Updates

We may update this Privacy Policy when our data practices change. We will post the revised date at the top of this page. Continued use of H2T2H after an update constitutes acceptance of the revised policy.

11. Contact

Privacy questions and data requests can be submitted through the contact page.