Privacy policy

Who we are

Unstuck is run by Arity Craft Limited, Coastal Road, Suite 005, Grand Baie Business Park, 30515, Grand Baie, Republic of Mauritius. We are the controller of the personal data described here. Questions about your data go to support@aritycraft.com.

What we keep

• Your email address, so you can sign in, we can send you a code to set your password, and we know which reflections are yours.
• Your waiting list details, if you ask for a place: your email and, if you give it, your name, so we can invite you.
• Your reflections: titles, situations, answers, possibilities, blockers and action plans, saved as you write them.
• Your trackables: what you track, how often, its dates, each day you log it, and which action steps it follows.
• AI brainstorm conversations, if you use them: your messages and the AI's replies for each step, and the token counts the provider reports.
• AI provider keys, if you connect one. They're encrypted before they're saved, only our server can decrypt them, and they're never sent back to your browser. We keep the last four characters to show you which key is connected.
• A count of recent brainstorm requests, to enforce the per-minute and daily limits and the built-in AI allowance.
• Your plan: whether you're on Free, Pro or Enterprise, when your trial ends, and, if you pay, your billing period and the reference numbers our payment provider gives us. We don't store card numbers.
• Technical logs kept by our hosting and database providers, such as IP addresses and request times, to keep the service running and secure.

We don't use advertising or tracking, we don't build profiles, and we don't sell or rent your data.

Why we use it

We use your data to provide Unstuck to you: to sign you in, save your reflections and trackables, run brainstorms you ask for, apply your plan and its limits, take payment if you subscribe, and keep the service safe. That is necessary to provide the service you signed up for. We use your email to write to you only about your account or important changes to these policies.

We don't read your reflections. Access to the database is restricted, and we would only look at your data if you ask us to while helping you, or if the law requires it.

AI providers

Nothing is sent to an AI provider unless you open the brainstorm panel and send a message. When you do, your reflection so far (title, situation and answers) and the conversation are sent so the AI can reply:

• With the built-in AI (Pro), it goes to Anthropic using our account. Anthropic processes it on our behalf under its commercial terms, which don't allow it to train its models on that data.
• With your own key, it goes to Anthropic or OpenAI using your account, and the provider handles it under their terms and your agreement with them.

See Anthropic's privacy policy and OpenAI's privacy policy.

Who else handles your data

We use a small number of service providers to run Unstuck. They process data on our behalf and only as needed to provide their service:

• Supabase, for our database, and sign-in.
• Resend, for our transactional emails, including sign-in emails.
• Netlify, our hosting provider, which serves the app.
• Anthropic, for the built-in AI, when you use it.
• A payment provider, if you pay for Pro. It handles your payment details and may keep records the law requires, under its own privacy policy. We'll name it here once online payments are live.

Some of them store or process data outside Mauritius. Where that happens, we rely on their contractual safeguards to protect it. We may also disclose data if the law requires it.

Cookies and local storage

We use cookies only to keep you signed in. Your browser also remembers whether you chose the light or dusk theme. There are no analytics or advertising cookies, so there's nothing to opt out of.

How long we keep it

Reflections and brainstorm conversations stay until you delete them. Deleting a reflection removes its brainstorm conversations too, and you can clear a conversation from the panel on its own. A key is deleted as soon as you remove it in AI settings. If you ask us to close your account, we delete your account and everything in it. Backups and logs held by our providers age out on their own schedules after that. Records of payments are the exception: tax and accounting law may require us to keep them for several years.

Your rights

Under the Data Protection Act 2017 of Mauritius, and similar laws where you live, you can ask to see the personal data we hold about you, correct it, delete it, receive a copy of it, or object to how we use it. Email support@aritycraft.com from the address you sign in with and we'll respond within one month.

If you're unhappy with how we've handled your data, you can complain to the Data Protection Office of Mauritius or the data protection authority where you live.

Security

Data travels over encrypted connections. Each reflection can only be read by the account that owns it, enforced in the database itself. Provider keys are encrypted with AES-256-GCM. No system is perfectly secure, so if we learn of a breach that affects your data, we'll tell you and the regulator as the law requires.

Children

Unstuck is not meant for children under 16, and we don't knowingly collect their data. If you believe a child has signed up, let us know and we'll delete the account.

Changes to this policy

If we change this policy, we'll update the date at the top. If the change is significant, we'll also email you before it takes effect.