Privacy policy

Draft — pending review by counsel. This is a template for informational purposes. Consult with a qualified attorney for legal advice specific to your situation.

Effective date: [EFFECTIVE DATE] · Last updated: 2026-08-22

Libertoo is operated by [OPERATOR LEGAL NAME], [OPERATOR ADDRESS] ("we", "us", "Libertoo"). This policy explains what data we collect, why, and what we do with it. It covers two things separately: the marketing website you may be reading right now, and the Libertoo product at /app. We have kept it short because we expect you to actually read it.

Libertoo is for adults only. You must be 18 or older to use it. We do not knowingly collect data from anyone under 18; if we learn we have, we delete it.

What we collect on the marketing website

Here is the complete list of what the marketing pages collect:

• A single cookie that records which headline variant of our homepage you were shown, so we can test which one communicates best. It contains a variant label (a, b, or c) — nothing about you. This is the only cookie the marketing site sets.

That is the whole list. No email address, no account, no profile, no tracking pixels, no fingerprinting.

Analytics

We use Plausible, a privacy-focused analytics service, on marketing pages only. It is cookieless, does not track you across sites, and shows us aggregate page counts and events — not individual browsing histories. There are no ad pixels or ad-network tags anywhere on this site.

Who processes this data for us

We use a small number of infrastructure providers to run the site. Each one processes data only on our instructions, to provide their service:

• Cloudflare — hosting and delivery of the website, and the database where the product's (encrypted) data lives.
• Plausible — the analytics described above.

We do not sell your data. We do not share it with advertisers or ad networks. We disclose it only to the processors above, or if the law genuinely compels us to.

The product

Accounts without your name

Product accounts are pseudonymous by design: a generated pseudonym plus a passphrase you choose. No email address, no real name, no phone number required to use the product.

Your content: encrypted so we cannot read it

Your journal entries, coaching conversations, and risk profile are encrypted on your device, with keys derived from your passphrase — keys we do not hold. Our servers store only encrypted blobs. We cannot read them, and that is a property of the architecture, not a policy promise.

To be precise about what this is and is not: this is client-side encryption of your stored content. It is not "end-to-end encrypted AI" — see the next section for the honest boundary.

The AI boundary, stated honestly

For the coach to answer you, it has to read your message. When you chat with the coach, your device sends the current message and the minimal context needed over an encrypted connection; it is processed transiently to generate a response, and we do not store or log message content — no prompts, no responses, ever. Anything that needs to be saved is re-encrypted on your device before storage. In short: your stored data is unreadable to us; to answer you, the coach processes messages in transit — we don't store or log them.

Operational metadata we do store

To make the product work, we store a small amount of plaintext operational data, minimized to what the features require:

• your pseudonym,
• your check-in schedule times and timezone,
• your push notification subscription,
• your subscription status,
• coarse event counters (event name and timestamp only — never content).

Notifications

Push notifications always use generic text ("Got a minute?") — never anything derived from your content, your goal, or your conversations. Nothing on your lock screen says what this app is about.

Billing

Payments for the coach subscription are handled by Lemon Squeezy, acting as our merchant of record (the seller of record for the transaction, which also handles applicable sales tax/VAT). Lemon Squeezy, like any payment processor, sees your payment identity (card details, name, billing information) — we do not claim payments are anonymous. If you optionally provide an email for receipts or account recovery, it is stored in a separate billing table, never joined with your product data. Your bank statement will show a neutral line: Lemon Squeezy's generic prefix plus the brand name (e.g. "LEMSQZY* LIBERTOO") — nothing that indicates what the product is.

What will never be in the product

No third-party analytics, no ad networks, no ad pixels, no data sales, no reports to anyone about your usage. Ever.

Affiliate links

Some pages on this site (and the Toolbox inside the product) recommend products through affiliate links. If you buy through one, the merchant pays Libertoo a commission; your price is unchanged. These links are plain links: we load no tracking scripts, and we send them with a no-referrer policy, so the merchant learns only that the click carried our affiliate tag — not which page you were on or anything about your account. The coach itself never recommends or links products, and never will.

Your rights

Wherever you live, we extend you the same set of rights, in the spirit of the GDPR and CCPA:

• Access — ask us what data we hold about you.
• Deletion — delete your account yourself at any time in Settings → Delete account (it takes effect immediately), or ask us to delete it.
• Portability — ask for a copy in a usable format.
• Objection — object to a use of your data, and we will stop unless we have a compelling lawful reason not to.

To exercise any of these, email [SUPPORT EMAIL]. We will respond within 30 days. We will never discriminate against you for exercising your rights. If you are in the EU/EEA or UK, you also have the right to lodge a complaint with your local supervisory authority; under the CCPA, note additionally that we do not sell or share personal information as those terms are defined there.

In the product, deletion is self-serve: Settings → Delete account erases your encrypted content, schedule, notification subscriptions, subscription record, and the account itself — immediately and irreversibly. Your stored content was unreadable without your passphrase to begin with. If you can no longer sign in, the email path above still works.

Changes to this policy

If we change this policy, we will update the date at the top and, for meaningful changes, notify users in the app before the change takes effect.

Contact

[OPERATOR LEGAL NAME] [OPERATOR ADDRESS] Email: [SUPPORT EMAIL]