Your privacy.

What the door collects.

• Your name — optional. Only so the room can greet you. Leave it empty if you like.
• Your email — optional. Only to send your seat code once, and one short note when your book is ready. No other mail, ever, and never a word of your story. Your recovery code is never mailed: it is shown once, on your screen.
• Your country — optional. Only so the room has your country’s crisis line ready.
• What you tell the room. Your story, kept sealed (below).
• Your subscription. Stripe, our payment processor, takes your payment and holds your card details — they never reach us. We keep Stripe’s customer and subscription ids, so your seat knows its subscription, and the email address you paid with only until your seat opens: then it becomes your seat’s contact. If you bought the seat for someone else, your address is erased as soon as the code to give is sent to you.

The door itself takes no card and no payment details, and asks for no address and no date of birth. The door sets no tracking cookies and runs no analytics. Our records keep your two codes only as a one-way fingerprint, made through a slow lookup so the codes cannot simply be guessed from it — never as words. One exception, said plainly: if you give an email, your seat code travels once in that mail. It waits on our server, in words, only until our mail service accepts it, and the mail service carries it to your inbox.

Your story, sealed.

Your story is kept on Loving My Words’ own server, sealed under a key that your seat code or your recovery code opens — and an opening helper’s code, only if you chose to give one. Your story is sealed, designed so that no staff member, facility or family member can open it without one of your codes. An outside security review of that design has not yet been done, so we say how it is built, not that it cannot fail. We keep no copy of your codes, and we never try to open a story. If both codes are lost, the story stays sealed for good. That is the price of keeping it yours, and we say it before you start.

The manuscript is yours. We never claim ownership of it, never sell it, and never use it to train any AI model. Download your book (.docx) and take your record home from your book page at any visit.

Who else touches it, and for what.

Built, testing · The microphone (talk to Rye)

• The AI model provider our server calls. To answer you, the room sends what you say in the room, and nothing that names your seat, to the AI model provider our server uses — for that one answer. Our server asks the AI model provider not to keep the conversation, on every call. We have no written agreement with the provider about what it keeps, so we do not promise one; what it keeps is governed by its own terms. We send it no email, no code and no name from your sign-up — but if you tell the room what to call you, that name goes with your words, so the room can greet you by it.
• Stripe — for payment only. Stripe takes the subscription’s payment and holds the card details, under its own terms. It sends our server word that a subscription was paid, renewed or stopped. It never receives a word of your story or your codes.
• Our mail service, Resend — for sending only. It carries the two kinds of mail above to your inbox and nothing else — your seat code, and the note that your book is ready. A message waits on our server only until the mail service accepts it, then it is deleted.
• The website’s host. It serves these pages and keeps ordinary server logs (address, page, time) to run and secure the site. It never holds your story.
• Your own browser. Read-aloud uses your browser’s own voice, on your device. The microphone is off unless you press it, and it turns itself off — after each turn, and after a minute without a word. If you use the microphone, your browser’s own speech recognition turns your voice into words before anything reaches us — and some browsers do that on their maker’s servers, under that maker’s terms. If you would rather it did not, type, or use your device’s own dictation. What the browser heard is shown and read back to you, and nothing is sent to the room until you say so.

A family member, a friend or a facility who gave you a seat never receives your story, your words or your manuscript.

Helpers, notices, the survey, and taking it home.

Built, testing · The microphone (talk to Rye)

• Two kinds of helper, both your choice. A recovery helper can help you back in if you lose your codes: a new seat code is sent to your own email, and the helper never opens your story. An opening helper can open your story in a helper session, to hear it and take your book home — and a helper session can never keep a passage; only you can, with “that’s me”. You name a helper by saying your own code and the consent words, and you can take either one back at any visit.
• You are told. Each time a helper’s code is used, a notice is kept, and the room reads it back to you the next time you sign in.
• The survey is yours to skip. After “That’s my story”, four short questions are offered, for you or one family member. Answers are numbers, plus words only if you choose to write some; they are kept apart from your story, never with your name or seat.
• Counts, never words. To know the room is working, the server counts things like visits, passages kept, the microphone pressed or the text made larger — numbers only, never a word of your story.
• Take it home in three forms: your book as a Word file, a print-ready PDF, and the full record of your story, from your book page at any visit.

How long it is kept.

• Your story — for as long as you keep your seat.
• Stripe’s ids for your subscription — for as long as your seat lasts. When you delete your story, your address and its fingerprint go at once, and only Stripe’s own ids are kept, so the subscription can be stopped.
• When you delete it (your code and the words DELETE MY STORY), your story and your contact details are deleted from our server at once. Our sealed backups of the story store — unreadable without your codes — are kept thirty days and no longer, so the last copy is gone within thirty days.
• The closed seat’s own row (a fingerprint and a date) is removed by the house’s thirty-day sweep, which runs by itself.
• Nothing of your story is ever written to a log, an alarm or a mail.

Your rights, and deletion on request.

Wherever you live, you can ask us what we hold about you, correct it, take a copy, or have it deleted. Delete your story yourself on your book page, or write to info@lovingmywords.com and a person will do it for you. A request is completed within thirty days.

Loving My Words · PMB 103-11, 1501 India St, San Diego, CA 92101 · info@lovingmywords.com