What you write in your check-ins is health information about you, and it is treated as the most sensitive thing in the system. It is never sold, never used for advertising, and never shared with anyone for their own purposes.

Three things are worth knowing up front, because they are the parts people usually assume differently: your data is stored on servers in Japan, your check-in content is sent to Anthropic in the United States to generate your briefing, and while Saktimat is in beta the operator can technically access the database — including your entries — because one person maintains it.

You can ask for a copy of everything, ask for corrections, or ask for all of it to be destroyed. Deletion is permanent and is done within 48 hours.

Account information. Your email address and a password, which is stored only as a hash by our authentication provider and is never visible to us.

Your age, but not your date of birth. You enter a date of birth at signup so the app can confirm you are 18 or over. It is checked in your browser and then discarded — only the fact and time of that confirmation is stored. Your date of birth is never transmitted to us and is not in the database.

Check-in and reflection content. Your morning and evening ratings (mood, energy, presence, sleep hours, identity alignment, stress), your written entries (who you intend to be, your targets, what you did, what you learned, notes, day notes), your habit and behaviour logs, and optional context tags about the kind of day it was. This is the substance of the app and most of it is health information.

Content generated about you. The daily briefings and weekly reports written for you, an internal numeric alignment score, detected behavioural patterns, and mathematical representations of your entries (embeddings) used to find relevant past entries. The alignment score is deliberately never sent to the app and cannot be retrieved by your account — only the plain state label and one-sentence interpretation are shown to you.

Setup answers. Your onboarding responses about goals, struggles, behaviours you want to protect, and what helps you reset.

Settings and technical records. Your timezone and chosen city (used for date handling and a general weather note), your notification preference and the browser push address if you enable reminders, records of notifications sent, and a log of AI requests with timestamps and token counts used to enforce usage limits and control cost. That log records that a request happened, not what it said.

Feedback you send. If you use the feedback button, your message, the page you were on, and your email address so we can reply.

We do not collect your location from your device, do not use analytics or advertising trackers, and do not have a way to read your data on other sites.

Under the Privacy Act, information about your mental health is sensitive information and can generally only be collected with your consent. By completing a check-in you are consenting to Saktimat collecting and handling that content for the purposes described in this policy, including sending it to the AI provider named below so a briefing can be written.

You can withdraw that consent at any time by stopping check-ins or by asking for your account to be deleted. You do not have to fill in any free-text field to use the app.

To run the app: to save your check-ins, to generate your briefings, reports and pattern observations, to show you your own history, and to send reminders if you have asked for them.

To keep it working and affordable: to fix faults, and to enforce daily limits on AI requests so that a bug or misuse cannot run up costs.

To improve it: we look at aggregate signals such as how many check-ins are completed and how the states are distributed. Individual entries are not read for product research. During beta, we may read a specific entry only where it is necessary to diagnose a fault you have reported or a system error affecting your data.

Your content is never used to train AI models — not by us, and not, per their terms, by the AI provider we send it to.

No decision that affects your legal rights or access to services is made automatically. The app produces observations and suggestions only; nothing it generates is a diagnosis or a clinical judgement.

Saktimat uses a small number of service providers. Each one only handles what it needs to. None of them are permitted to use your information for their own purposes.

Supabase — database, authentication and server functions, Tokyo, Japan. Holds everything described above. This is where your account and all your entries live.

Anthropic — AI processing, United States. Receives the content of the check-in being processed, plus relevant recent entries and pattern context, in order to write your briefing or weekly report. Not used to train models.

Vercel — website and app hosting, United States and global edge network. Serves the app itself. Handles requests, not your stored entries.

Cloudflare — bot protection at signup, global. Verifies that a real person is creating the account. Does not receive check-in content.

Resend — email delivery, United States. Used only to deliver feedback you submit to the operator. Receives your email address and your message.

Open-Meteo — weather forecast, European Union. Receives the coordinates of your selected city's centre and nothing else. No identifier, no account reference, no personal information.

Your browser's push service — Google, Apple or Mozilla, depending on your device. Only if you enable reminders. Receives the reminder itself, which contains no check-in content.

Because these providers are outside Australia, your information — including sensitive health information — is disclosed overseas. Australian Privacy Principle 8 requires us to say so plainly: by using Saktimat you consent to that disclosure. We take reasonable steps to use providers with recognised security practices and contractual protections, but once information is held overseas, Australian law may not apply to it in the same way, and you may have less practical recourse than you would locally.

Every table in the database enforces row-level security, so a signed-in account can only reach rows belonging to it. That is enforced by the database itself rather than by the app being careful.

The most sensitive derived value — your internal alignment score — is held in a table that grants no access to any signed-in account at all. There is no request the app can make that returns it. The same isolation applies to internal logs.

All AI processing happens on the server. No API keys exist in the app you run. Traffic is encrypted in transit, and the database is encrypted at rest by the provider.

Your browser stores a session token so you stay signed in. No check-in content is stored on your device.

Being honest about the limits: Saktimat is maintained by one person, who necessarily holds administrative access to the database. There is no large security team, no formal certification, and no independent audit. If that is not an acceptable risk for the things you would write, please do not write them here.

You can ask for a copy of the personal information held about you by emailing admin@saktimat.com. We will respond within 30 days, and normally much sooner. There is no charge. A self-service export is planned but is not built yet, so this is currently done by hand.

If something is wrong, you can correct most of it in the app directly, and you can email us to correct anything you cannot reach. If we have disclosed incorrect information to someone else, you can ask us to tell them.

If we cannot give you access or make a correction, we will tell you why in writing and how to challenge that.

While you have an account, your entries are kept so the app can show you your own history and detect patterns over time. Nothing is deleted automatically, because a behavioural record that silently loses its past is worse than useless.

You can request deletion at any time from Settings or by email. Your account and every record attached to it — check-ins, journal entries, behaviour logs, notes, AI briefings, reports, scores and logs — are permanently destroyed within 48 hours. The deletion runs as a single operation that verifies afterwards that nothing survived, and reverses itself if anything did. It cannot be undone and we cannot restore it for you later.

We may keep a minimal record that an account was deleted, and any correspondence needed to show we handled a request properly.

Saktimat is for people aged 18 and over, and signup is blocked below that age. If you believe someone under 18 has created an account, email admin@saktimat.com and we will delete it.

Saktimat is a self-reflection tool. It is not a health service, not a medical device, and not therapy. Nothing it produces is a diagnosis or clinical advice. No one monitors what you write in real time, and the app cannot contact anyone on your behalf or respond to an emergency.

The app checks entries for language suggesting self-harm and shows you crisis support numbers when it finds any. That check is a convenience, not a safeguard — it will miss things, and it is not a substitute for help from a person. Support lines are always available in the app under Support. If you are in danger now, call 000.

In Australia, Lifeline is 13 11 14, 24 hours a day.

If a data breach occurs that is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.

If you think your privacy has been mishandled, email admin@saktimat.com with the details. We will acknowledge within 5 business days and give you a written response within 30 days.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner — oaic.gov.au or 1300 363 992. You do not need our permission to do that.

If we change how your information is collected, used or disclosed, we will update this policy and tell you inside the app before the change takes effect. Material changes that expand how your data is used will ask for your agreement rather than assume it.