What we hold, and who can see it

What we store

Your email (that's the whole sign-in), the intake answers you chose to give (who you're carrying, loss type, how recent), your journal entries, the people you remember and their dates, keepsake notes, letters, memories tagged to them, anything added through a memorial link you open, Circle posts, your buddy thread (its messages and pictures) if you take a buddy, RSVPs, email preferences - and, if you set them, a username, a profile picture, and a birthdate. Without an account, your journal and settings live only in your browser and never reach us.

Profiles, being found, and walking with people

• Your profile shows who you are carrying - the one word you chose when you arrived, like “father” or “child loss” - to anyone who can already see that profile. Since 19 September 2026. How recent the loss is is not shown to anyone; neither is the name of the person you named. If you would rather it were not there, open the questions you answered when you arrived and tap that word again to unpick it; the profile then simply shows nothing.
• Your profile shows your name, picture, and username. The Circle posts on it are visible only to people who share that Circle with you - a profile never widens what a Circle could see. The picture is served only to people who can see your profile, with one exception you choose: while you have an answer standing in the Common Room, your name and your picture are there with it, for every member. Take your answers back and the picture closes again too.
• "Let people find me" is off by default. Until you turn it on, the people who can find or view your profile are the people in your Circle, the people you're connected to, a buddy you've been paired with, and anyone on a goal with you. Nobody else.
• Following is a quiet connection: both sides can see it, there are no follower counts, and it never creates a feed.
• Your birthdate is a matching signal only. It never appears anywhere, to anyone.
• The tools (the emotion wheel, a plan, a body map, a decision sheet, a support map, a myth of your own) keep only what you choose to keep, and since 19 September 2026 it is kept with your account rather than on one device, so it is there when you sign in somewhere else. That means it is stored on our servers, like your journal: only you can read it, and deleting your account deletes it. Signed out, it stays on the device you wrote it on and goes nowhere. Either way, what this app is keeping is where you read it back or delete it.
• Goal pages: joining one shares your name, whether you've counted today, and what you put on that goal's wall with the people on the same goal - and nobody else. Your running count stays yours.
• A buddy: asking to be paired uses the intake answers you gave (loss type, how recent) and how long you have waited, nothing else. Your buddy sees your name, picture and username, the same as your profile shows. You can hold more than one pairing at a time; each has its own thread. Stepping out of the pool or ending a pairing needs no reason, and the same two people are never paired again.

Who can see what

You always know who can see a thing before you write it, and you can always take it back:

• Journal entries: you, and nobody else - unless you share a specific entry with your Circle, which you can undo any time.
• Today's prompt answer: your Circle, unless you choose "Keep private" before saving - and you can make any answer private again from your journal. Answers written on a prompt's own page start private.
• Circle posts: the 8–12 people in your Circle and its facilitator.
• Dates you keep for a loved one: you - plus a quiet heads-up to your Circle only for dates where you ticked that box (who it is for, the date, and the year count if you gave the year).
• Keepsake notes, letters and memories tagged to a person: you, and nobody else.
• A shared memorial link, if you make one: the person's name and whatever memories, photos and ways to help anyone with that link adds - visible to anyone who has the link, no account needed. Close it any time.
• Your name in the room: whatever display name you chose.
• A buddy thread: the two of you, and nobody else. Each of you can take back your own messages and pictures at any time. When a pairing ends, what was already said stays readable to you both, so neither of you loses your half of it, but nothing new can be written.
• The safety team can review a post, or a buddy thread, only when it's been flagged - that's the one deliberate exception, and every access leaves a record. Flagging a buddy message shows the team that message and the two before it, whoever wrote them, and opens that one thread to the team for as long as the flag stays open. When the flag is closed, the thread is theirs alone again.

These rules are enforced in the database itself (row-level security), not just in the interface.

What we don't do

No ads. No tracking pixels. No selling or renting your data, ever. No AI training on your writing. No engagement metrics designed to pull you back - the app doesn't even have streaks.

Who helps us run it

The company holding it is Happy Grieving Limited (Hong Kong), the company behind Happy Grieving and Grief Trips. Your data touches exactly four processors: Supabase (the database, where everything above lives), Stripe (payments - we never see your card number), Resend (the emails you've opted into), and Cloudflare (serving the app). If you sign in with Google, Google confirms your email to us and nothing more.

Emails

Sign-in codes, and - only if left on - a gentle note near your remembrance dates and a notice when your facilitator opens the week. Both have one-click-honest toggles in your account. No newsletters from the app, no re-engagement campaigns.

Leaving, completely

Delete your account from the account page and your journal, dates, posts, memberships, and profile are removed and billing is cancelled - self-serve, immediate, no email exchange required. Your journal can also be downloaded as a file first, from the journal page.