Privacy, terms, & security.

Privacy

How we handle your data.

What we collect

Information you provide directly: your name and mobile number when you sign up (older accounts may have an email instead), and any context you choose to share with Penny. We also store the messages you exchange with Penny so you can return to your conversations.

We also collect basic product analytics — pages viewed, features used, and similar interaction events — to understand how pennytalk is used and to improve it. This begins on your first visit, before you have an account, and includes your device and browser type, an approximate location derived from your IP address, and how you found us (the referring site or ad campaign). If you go on to sign up, that earlier activity is linked to your account by your user id. We do not record your screen, and analytics events never include the content of your conversations.

How we use it

We use this information to provide the service, personalize the conversation to you, keep you safe (including detecting crisis signals), and improve the quality and safety of the product over time. We do not sell your data. We do not use your conversations to train AI models. Outside of the service providers listed below, we do not share your messages with anyone.

Service providers we use

• Supabase — Database, authentication, and storage. SOC 2 Type II compliant infrastructure.
• Anthropic — Provides the underlying AI model. Conversation content is sent to Anthropic to generate replies. Under our agreement, Anthropic does not retain customer data for training.
• Vercel — Application hosting and edge infrastructure.
• PostHog — Product analytics. Receives usage and interaction events (and, once you sign in, your user id) so we can understand and improve how the product is used. Session recording is disabled, and event data never includes your conversation content.
• Twilio — Delivers and receives the text messages between you and Penny — the primary way most people talk with her. Receives your mobile number and message content solely to route those texts.
• Stripe — Processes subscription payments and provides the customer billing portal. Stripe receives the billing and contact details you enter at checkout; pennytalk does not store your full card number.
• Google Ads — Advertising measurement. If you reach pennytalk from a Google ad, we tell Google that the click led to a sign-up or subscription, matched only by the click identifier Google itself added to the link. We send no name, email, or phone number, and we do not build advertising audiences from your use of pennytalk.

Text messaging (SMS)

Texting is how most people talk with Penny. When you sign up with your mobile number (or add one later from Settings), you can text with her and receive a daily check-in at the hour you choose. We use Twilio to send and receive these texts, and their content is handled just like your in-app conversations. We never sell your mobile number, and we do not share your mobile number or SMS consent with third parties or affiliates for their own marketing. Message frequency varies, and message and data rates may apply. Reply STOP at any time to stop the texts, or HELP for help.

Retention & deletion

Your data is retained while your account is active. You can request deletion of your account and conversation history at any time. Deletion is honored within thirty days, subject to limited backups that age out on their own schedule.

Your rights

Depending on where you live, you may have the right to access, correct, delete, or export your personal information, and to object to or restrict certain uses of it. To exercise any of these rights, email privacy@pennytalk.ai.

Terms

The agreement between us.

What pennytalk is

pennytalk is a wellness companion powered by a large language model. It provides supportive, evidence-informed conversation. It is not medical advice, diagnosis, or treatment, and it is not a substitute for professional mental health care.

Your responsibilities

By using the service you agree to provide accurate information when signing up, keep your phone (and any sign-in codes we text you) to yourself, use the service in line with applicable laws, and contact a clinician or emergency services if you experience a mental health crisis.

Limits of the AI

The AI companion may occasionally produce inaccurate or inappropriate responses. We work hard to reduce this — through safety layers, evaluation, and careful prompting — but no AI is infallible. Treat what Penny says as perspective, not prescription.

Text messaging

Texting is the primary way Penny talks with you. By signing up with your mobile number (or adding one later), you consent to receive the conversational texts that make up the service, plus a daily check-in at the hour you choose. The check-in and any promotional texts are never a condition of using pennytalk — you can stop all texts at any time by replying STOP (reply HELP for help), and your account, history, and this website remain fully yours afterward. Message frequency varies, and message and data rates may apply. Carriers are not liable for delayed or undelivered messages.

Acceptable use

You agree not to use the service to harm yourself or others, to attempt to extract or misuse other users' data, to reverse-engineer the service, or to use the service for any unlawful purpose.

Disclaimer & liability

The service is provided “as is” without warranties of any kind, express or implied. To the maximum extent permitted by law, pennytalk and its contributors will not be liable for indirect, incidental, special, consequential, or punitive damages arising from or related to your use of the service.

Changes

We may update these terms as the product evolves. When we make material changes, we'll let you know and post the changes here.

Security

Safeguards we keep in place.

Encryption

All traffic is encrypted in transit using TLS 1.2 or higher. Conversation data and account information are encrypted at rest in our database, with keys managed by our hosting provider.

Access controls

Database access is restricted by row-level security policies, so each user can only read and write their own data. Production credentials are limited to a small set of authorized engineers and rotated regularly.

Authentication

Sign-in uses one-time codes texted to your verified number, so there is no password to steal or reuse (older accounts may still sign in with email + password, stored as hashed credentials). Sessions use secure, HTTP-only cookies and expire on a regular cadence.

Vendor security

We're selective about who touches your data. Our database, hosting, and AI providers — Supabase, Vercel, and Anthropic — operate in SOC 2-compliant infrastructure and are bound by data protection agreements that match or exceed our own commitments.

Reporting a vulnerability

If you believe you've found a security issue, please email security@pennytalk.ai. We'll acknowledge your report within two business days and keep you updated as we investigate. Please don't publicly disclose issues until we've had a chance to fix them.

Contact

Get in touch.

For privacy questions, email privacy@pennytalk.ai. For security reports, email security@pennytalk.ai. For everything else, email hello@pennytalk.ai.