Skip to content

Privacy policy

Draft — pending review by counsel. This is a template for informational purposes. Consult with a qualified attorney for legal advice specific to your situation.

Effective date: [EFFECTIVE DATE] · Last updated: 2026-08-22

Libertoo is operated by [OPERATOR LEGAL NAME], [OPERATOR ADDRESS] ("we", "us", "Libertoo"). This policy explains what data we collect, why, and what we do with it. It covers two things separately: the marketing website you may be reading right now, and the Libertoo product at /app. We have kept it short because we expect you to actually read it.

Libertoo is for adults only. You must be 18 or older to use it. We do not knowingly collect data from anyone under 18; if we learn we have, we delete it.

What we collect on the marketing website

Here is the complete list of what the marketing pages collect:

  • A single cookie that records which headline variant of our homepage you were shown, so we can test which one communicates best. It contains a variant label (a, b, or c) — nothing about you. This is the only cookie the marketing site sets.

That is the whole list. No email address, no account, no profile, no tracking pixels, no fingerprinting.

Analytics

We use Plausible, a privacy-focused analytics service, on marketing pages only. It is cookieless, does not track you across sites, and shows us aggregate page counts and events — not individual browsing histories. There are no ad pixels or ad-network tags anywhere on this site.

Who processes your data

We use a small number of providers to run Libertoo. Each one processes data only on our instructions, to provide their service:

  • Cloudflare — hosts the website and runs the database where your (encrypted) product data lives.
  • Anthropic — provides the AI coach and the safety check. When you use the coach, your messages are sent to Anthropic in transit to generate the reply; it does not train its models on them. See "The AI boundary, stated honestly" below for exactly what leaves your device.
  • Lemon Squeezy — processes coach-subscription payments as our merchant of record. See "Billing."
  • Apple, Google, and Mozilla — their push services deliver notifications to your device, if you turn them on. They receive a delivery token for your device and the fixed, generic notification text — never your content. See "Notifications."
  • Plausible — the privacy-focused analytics described above, on the marketing pages only.

We do not sell your data. We do not share it with advertisers or ad networks. We disclose it only to the providers above, or if the law genuinely compels us to.

The product

Accounts without your name

Product accounts are pseudonymous by design: a generated pseudonym plus a passphrase you choose. No email address, no real name, no phone number required to use the product.

Your content: encrypted so we cannot read it

Your journal entries, coaching conversations, and risk profile are encrypted on your device, with keys derived from your passphrase — keys we do not hold. Our servers store only encrypted blobs. We cannot read them, and that is a property of the architecture, not a policy promise.

To be precise about what this is and is not: this is client-side encryption of your stored content. It is not "end-to-end encrypted AI" — see the next section for the honest boundary.

The AI boundary, stated honestly

For the coach to answer you, it has to read your message — so this is the one place your words leave your device in a form that can be read, by us and by the company that runs the AI. We want to be exact about it:

  • Who runs the coach. The coach is built on the Anthropic API — the company behind the Claude AI models. When you send a message, your device decrypts just that message plus the minimal context the coach needs, and sends it to Anthropic over an encrypted connection; Anthropic generates the reply.
  • The safety check. Before the coach responds, your message is also sent to a second Anthropic model that screens for crisis and safety signals. So every message you send to the coach reaches Anthropic — including ones the coach never ends up answering.
  • What Anthropic does with it. Anthropic processes these messages to produce the response and the safety result. Under its API terms it does not use them to train its models, and retains them only briefly to detect misuse before deleting them.
  • What we do with it. We never store or log message content — no prompts, no responses, ever. Anything you choose to save is re-encrypted on your device before it reaches our servers.

In short: your stored data is unreadable to us; to answer you, the coach sends your message to Anthropic in transit — we don't store it, and Anthropic doesn't train on it. This is client-side encryption of your stored content. It is not "end-to-end encrypted AI" — that is impossible for any AI that has to read your words to help you.

Operational metadata we do store

To make the product work, we store a small amount of plaintext operational data, minimized to what the features require:

  • your pseudonym,
  • your check-in schedule times and timezone,
  • your push notification subscription,
  • your subscription status,
  • coarse event counters (event name and timestamp only — never content).

Notifications

Push notifications always use generic text ("Got a minute?") — never anything derived from your content, your goal, or your conversations. Nothing on your lock screen says what this app is about. Delivery runs through your platform's push service (Apple, Google, or Mozilla), which receives a delivery token for your device and that fixed text — nothing else.

Billing

Payments for the coach subscription are handled by Lemon Squeezy, acting as our merchant of record (the seller of record for the transaction, which also handles applicable sales tax/VAT). Lemon Squeezy, like any payment processor, sees your payment identity (card details, name, billing information) — we do not claim payments are anonymous. If you optionally provide an email for receipts or account recovery, it is stored in a separate billing table, never joined with your product data. Your bank statement will show a neutral line: Lemon Squeezy's generic prefix plus the brand name (e.g. "LEMSQZY* LIBERTOO") — nothing that indicates what the product is.

What will never be in the product

No third-party analytics, no ad networks, no ad pixels, no data sales, no reports to anyone about your usage. Ever.

Affiliate links

Some pages on this site (and the Toolbox inside the product) recommend products through affiliate links. If you buy through one, the merchant pays Libertoo a commission; your price is unchanged. These links are plain links: we load no tracking scripts, and we send them with a no-referrer policy, so the merchant learns only that the click carried our affiliate tag — not which page you were on or anything about your account. The coach itself never recommends or links products, and never will.

Your rights

Wherever you live, we extend you the same set of rights, in the spirit of the GDPR and CCPA:

  • Access — ask us what data we hold about you.
  • Deletion — delete your account yourself at any time in Settings → Delete account (it takes effect immediately), or ask us to delete it.
  • Portability — ask for a copy in a usable format.
  • Objection — object to a use of your data, and we will stop unless we have a compelling lawful reason not to.

To exercise any of these, email hello@libertoo.com. We will respond within 30 days. We will never discriminate against you for exercising your rights. If you are in the EU/EEA or UK, you also have the right to lodge a complaint with your local supervisory authority; under the CCPA, note additionally that we do not sell or share personal information as those terms are defined there.

In the product, deletion is self-serve: Settings → Delete account erases your encrypted content, schedule, notification subscriptions, subscription record, and the account itself — immediately and irreversibly. Your stored content was unreadable without your passphrase to begin with. If you can no longer sign in, the email path above still works.

Changes to this policy

If we change this policy, we will update the date at the top and, for meaningful changes, notify users in the app before the change takes effect.

Contact

[OPERATOR LEGAL NAME] [OPERATOR ADDRESS] Email: hello@libertoo.com