Privacy Policy

The one thing to know

Private filings are not public. They are visible only to you. Public filings are intentionally public. When you choose “Public filing,” you are asking us to display that wish text (without your name or email) on the public wall, in share previews, and via a shareable link.

Who we are

Karma Willow is the controller of the personal information described in this policy. [Insert the legal entity name and postal address.] How to reach us is at the end of this policy.

Information we collect

You give us

• Account information: how you sign in (a link sent to your email, or Google) and the identifier that method provides. If you sign in with Google, Google shares your email address and, if available, your name with us.
• Email address: to identify your account, send sign-in links and, unless you turn them off, an evening email when something happened to your wish (someone believed in it or commented, or the Department left a note). At most one a day; every one has a link to stop them. Never shown publicly.
• Display name: optional, for your own account page. If you sign in with Google we may fill it in with the name Google gives us. You can change or clear it at any time. There is no public profile, and your display name is never shown on public wishes.
• Wishes: the text you write, whether each is public or private, and the dates each was created, made public, changed, archived, marked as “came true,” or deleted, together with its moderation status.
• Belief you give: which wishes you have given belief to, on which day, and a running total per wish. Only you can see this record. Other people see only the total number of beliefs on a public wish.
• Reports: if you report a public wish, the reason, any note, when you sent it, and your account if you were signed in. We do not tell the owner of a wish who reported it.
• Guest wishes: if you use Karma Willow without an account, your private wishes stay in your browser on your device and are not sent to us. A public wish you make as a guest is sent to us and shown on the wall with no name, linked only to an anonymous code for your browser (kept in a cookie, and stored by us only in scrambled form) so it can move to your account if you sign in later.
• Karma: how much karma you hold, have earned and have given, and a record of each change: what earned it, or which wish it went to, and the day. It is kept with your account, as only accounts earn, give and receive karma. Karma a browser held as a guest before that moves to your account when you sign in. The owner of a wish hears how much karma it received, never who gave it.
• Guest email: if you leave your email for news of a wish instead of signing in, we keep it with that wish, together with your device’s timezone (so the email arrives in your evening) and the scrambled browser code and network address we use to prevent misuse. We first send one email asking you to confirm, and nothing else until you do. After that, at most one email an evening, only when something happened to your wish, each with a link to stop them. We delete the address when you stop the emails, when the wish moves into an account or is removed, or after 7 days if it was never confirmed. Never shown publicly.

Collected automatically

• Sign-in history: when you sign in and by which method, your most recent sign-in time, and how many times you have signed in. Our authentication provider also records technical session details, such as your IP address and browser type.
• Timezone: your device’s timezone setting (for example, “America/Denver”), saved to your account after you sign in. It is a general region, not your precise location. We store it so that daily features, such as the once-a-day limit on giving belief, can follow your local day.
• Activity records: an internal record of actions on the service: signing up and signing in, changing your display name or timezone, making a wish, changing it (public or private, archived, marked “came true”) or deleting it, giving belief, filing a report, and deleting your account. Each entry holds an identifier, the type of event, a timestamp, and small non-identifying details (for example, that a wish changed from private to public). Entries never contain the text of your wishes, your email address, or your name. We use them only for security, preventing abuse, moderation, fixing problems, and statistics that do not identify you. They are not shown to other users and are available only to authorised staff.
• Hosting logs: our hosting provider records technical request data (IP address, timestamps, pages requested, browser type) to deliver the site and protect it from abuse.
• Visit counts: we use Vercel Web Analytics to count page views and see, in aggregate, which pages people visit, which site sent them (for example, a link on X), and their general country and device type. It sets no cookies, does not follow you across other sites, and does not tell us who you are. Before a view is counted, we strip everything from the address except a simple source tag such as “utm_source=x.”
• How visits go: to see where the site is hard to use, we keep our own record of each visit: the pages opened and in what order, how long each was read and how far down, which links and buttons were tapped (by their label), steps such as opening the wish form or signing in, how quickly pages loaded, and any errors. It notes the site that sent you, your general country and region, device type, browser, language and screen size, and whether you were signed in. It is tied to a random code kept in your browser’s local storage, never to your name, email or IP address, and it never holds what you type: no wish text, comments or email addresses. Only authorised staff can see it, and it is deleted after 13 months.

We do not use advertising trackers or third-party advertising cookies. If that changes, we will update this policy first.

If we add paid features

Payments would be handled by a third-party processor. We would receive limited transaction data (such as a token, last four digits, billing country) and never your full card number.

Cookies and browser storage

• Sign-in cookie (essential): set by our authentication system to keep you signed in. It is removed when you sign out.
• Browser code (essential): when you use Karma Willow without signing in, an anonymous code for your browser, kept in a cookie for up to 400 days. It holds your guest wishes and keeps beliefs to once a day. We store it only in scrambled form.
• Local storage on your device: an unfinished wish draft (kept for up to 7 days, and cleared when you release the wish) and, if you use Karma Willow as a guest, your private wishes, an optional display name, and the last day you gave belief to each wish. These stay in your browser only. We also keep a small marker showing that your timezone has been saved to your account, and the random codes for your browser and your current visit that the visit record above uses.
• Session storage (cleared when you close the tab): a few counters that let us show a sign-in reminder at most once per visit.
• Advertising cookies: none. If you choose “Continue with Google,” Google may set its own cookies under its own policy.

You can clear cookies and browser storage in your browser settings. Doing so signs you out and removes guest wishes that exist only on your device.

How we use information

• run the ritual and show you your wishes;
• publish content you choose to make public, and operate the Believe system, including its once-a-day limit;
• run moderation (automated checks and human review) to keep the public wall safe;
• sign you in, secure accounts, and prevent abuse, including through activity records;
• fix problems and understand overall usage in ways that do not identify you;
• communicate with you about the service (for example, sign-in links and security notices);
• comply with law and enforce our Terms.

We do not sell your personal information or private wish content. We do not use private wishes for behavioural advertising or to train advertising models.

Automated checks. When you file a wish publicly, automated checks look for personal details about other people and for prohibited content. This includes a review of the wish’s words by an AI model run by Groq, which may hold the wish for a person on our team to look at before it appears. Private wishes are never sent to it. A check may hold a wish and ask you to edit it. It does not have legal or similarly significant effects on you, and you can ask for a person to review the result by contacting us.

Notes from the Department. A while after a public wish reaches the wall, the Department of Karma leaves a short note under it. These notes are written with the help of an AI model run by Groq, which reads the words of the public wish only. The note is shown with the wish, and the wish’s owner gets a notice. Private wishes never receive one.

Translation. When a public wish is written in a language other than English, the same AI model run by Groq translates it, and the English is shown under your own words for readers who don’t read your language. The Department’s note under it is written in your language, with its English kept the same way. Only the words of the public wish are sent. Private wishes are never translated.

Legal bases (EEA/UK)

Where the GDPR or UK GDPR applies, we rely on the following.

• Providing the service you asked for (contract): your account, signing in, your wishes, giving belief, and your timezone for daily features.
• Our legitimate interests: security and abuse prevention (sign-in history, activity records, hosting logs), moderation, fixing problems, and overall statistics, including the visit records that show us where the site is hard to use. We keep these records to what is needed, keep wish text and email addresses out of activity records, and limit access to authorised staff.
• Your consent: when you choose to publish a wish, and when you choose to include sensitive information in a wish (see below). You can withdraw consent at any time by making the wish private or deleting it. Withdrawal does not affect processing that happened before.
• Legal obligation: where the law requires us to keep or share information.

Sensitive information in wishes. Wishes can be deeply personal and may touch on health, relationships, beliefs, or other sensitive topics. We never ask you to include any of this. What you write is up to you. A private wish is visible only to you. A public wish is shown to everyone, so please leave out anything you would not want published. By submitting or publishing a wish you choose to give us that text for the purposes described here. Where the law requires your explicit consent for sensitive information, that choice is your consent.

Service providers and recipients

We share data only with vendors who help us operate. They act on our instructions under contract and may not use your data for their own purposes.

• Supabase: database and authentication. Our database is hosted in Canada.
• Vercel: website hosting and delivery, and cookieless visit counts, primarily from the United States.
• Google: only if you choose to sign in with Google.
• Resend: email delivery. Sends sign-in links and the evening emails about your wishes to your email address.
• Groq: the automated review of public wishes, their translation and the Department’s notes described above. It receives the words of a public wish only, never your name, email or private wishes.
• If we add them: a payment processor.

Disclosures

We may disclose information to comply with law or valid legal process, to enforce our Terms, to prevent fraud or imminent harm, or in a merger or acquisition (with notice where required).

Retention

• Private filings: until you delete them or your account.
• Public filings: until you make them private, archive, or delete them, or we remove them under our Terms.
• Account, sign-in history, and timezone: until you delete your account.
• Belief records: until you delete your account or the wish is deleted.
• Reports: as long as needed to review the report and keep a record of the decision.
• Activity records: only as long as needed for the purposes described above. [Confirm a fixed period, for example 24 months, and enforce it before launch.] When you delete your account, we remove your identifier from these records so that what remains cannot be linked to you.
• Visit records: 13 months, then deleted automatically.
• Hosting logs: a limited period (target: up to 12 months) unless needed for an investigation.
• Backups: deleted content may persist in encrypted backups for a short rotation window, then is overwritten.

Your choices and rights

On your account page you can review your wishes, switch them to private, archive them, mark them as come true, or delete them, change your display name, sign out, and delete your account. Deleting your account deletes your profile, your wishes, and your belief records, and removes your identifier from activity records.

Depending on where you live, you may also have the right to access and receive a copy of your personal information, to have it corrected or deleted, to restrict or object to certain processing (including processing based on our legitimate interests), to move your data to another service, and to withdraw consent. To exercise a right, use the controls on your account page or contact us. We may need to confirm it is really you. We will respond within one month (or 45 days for California residents), and where the law allows we may extend that period for complex requests and tell you why. We will not discriminate against you for exercising a right. If you are in the EEA or UK, you may also complain to your local supervisory authority.

U.S. state privacy rights

If you are a resident of California or another U.S. state with a comprehensive privacy law, you may have rights to know, access, delete, and correct, and to opt out of “sale” or “sharing” of personal information and of targeted advertising. We do not sell or share personal information as those terms are defined, and we do not conduct targeted advertising. California’s “Shine the Light” law: we do not share personal information with third parties for their own direct marketing. [Confirm the final list of covered states and the response process before launch.]

In the past 12 months we collected these categories of personal information:

• Identifiers: email address, account ID, IP address.
• Profile information: display name, sign-in method, timezone.
• Internet or network activity: sign-in history, activity records, hosting logs.
• Approximate location: your timezone, and a coarse region that can be inferred from your IP address.
• Content you provide: wishes and reports, which may include sensitive personal information if you choose to write it.

We collect these from you, from your device, and from Google if you use it to sign in. We use them for the purposes described above and disclose them only to the service providers listed above. We use sensitive personal information only to provide the service you request, and not to infer characteristics about you.

International users

Our database is hosted in Canada and our website is delivered primarily from the United States, so your information will be processed in those countries. Where the law requires, we rely on safeguards such as Standard Contractual Clauses or an adequacy decision for transfers out of the EEA or UK.

Children’s privacy

Karma Willow is not for children under 16 (or the local age of digital consent, if higher). We do not knowingly collect their data. If you believe a child has provided us information, contact us and we will delete it.

Security

We use encryption in transit, access controls, and row-level database security, so that each signed-in person can reach only their own private records. No system is perfectly secure; if a breach affects you, we will notify you as required by law.

Changes to this policy

We will post updates here with a new date and, for material changes, give additional notice.

Contact

Privacy questions or requests: [privacy@karmawillow.example]. EEA/UK users may also contact their local supervisory authority. [Add EU/UK representative details if applicable.]