Privacy Policy

What Bridge collects

Four kinds of thing.

• Your account: an email address, the name you choose to be called, and a password, which is stored only as an Argon2id hash and is never recoverable in plain form.
• What you write: your private account of a conflict, your answer to the question Bridge asks you, the message Bridge drafts on your behalf and any edits you make to it, the one thing you commit to doing, and your answers to exercises.
• What Bridge derives: a small set of fixed labels describing the feeling on the surface and the need underneath, a safety outcome for each thing you write, and timestamps.
• How Bridge is used: which steps you reach and which screens you open, counted as described under "Counting how Bridge is used". Never anything you or anyone else wrote.

What the other person can and cannot see

The person you are paired with never receives what you wrote. They receive only the message you approved and sent in your own name, and the one request you chose to attach to it. You can be paired with more than one person, and each pairing is sealed off from every other one: nothing you write with one of them is ever visible to another.

They do not see your private account of what happened, the reflection Bridge showed you, the question it asked you, or your answer to it. This is enforced on the server, in a single place, and it is covered by a test that runs against every state a conversation can be in.

If something you write triggers a safety stop, the other person is told only that the conversation did not complete. They are not told why, what you wrote, or when.

Where your words go

Bridge uses an AI model made by Anthropic to do the reflecting and translating. It does not run on your phone.

That means what you write is transmitted to Anthropic over an encrypted connection so the model can read it and produce the reflection, the question, and the draft message. Anthropic processes it under their own terms, which Bridge does not control and does not make promises about on their behalf.

Your voice is different. If you speak instead of typing, the audio is converted to text on your phone and the audio is never transmitted anywhere. If your phone cannot do that, Bridge turns voice input off rather than sending the audio to a server.

What is encrypted, and what is not

The most sensitive text is encrypted by the application before it reaches the database, with AES-256-GCM and a key held outside the database. That covers: your private account of the conflict, the reflection shown to you, the question Bridge asked and your answer, the drafted message and its request, what you wrote about yourself at setup, and any note you add to a report.

Some shared material is stored without that additional layer: the one thing each of you commits to, the shared summary you both confirm, your exercise answers, the title you give a conversation, and the one-sentence statement of need that accompanies a message. These are protected by the database and transport encryption but not by the application layer.

This distinction is real and we would rather state it than let you assume otherwise.

Who else receives anything

Only these, and only for what they do.

• Anthropic, to generate the reflection, question and draft, as described above.
• Apple and RevenueCat, to process and validate a subscription. They receive a subscription identifier, never anything you wrote.
• A therapist, only if you personally grant it and only what you grant. They receive counts and fixed category labels — how often conversations happen, which feelings and needs come up, how many resolve, which exercises you finished. They never receive anything you or anyone you are paired with wrote. Consent is per person: each person you are paired with decides separately, and you can withdraw at any time.
• An email service, to deliver a therapist invitation, if one is sent to you.

Counting how Bridge is used

Bridge counts steps, never words. It records that something happened — an account was created, an invite was made or accepted, a conversation was started, a message was delivered, a conversation was resolved, an exercise was finished, a screen was opened, a subscription started — along with a few fixed details: the kind of relationship (partner, family, friend or other), whether you typed or spoke, whether you edited the draft, and whether you were on the phone or the web. It also notes each day you open the app.

None of these counts can hold anything you or anyone else wrote. There is no field for it, and the service rejects anything it does not recognise.

The counts are kept in Bridge’s own database. No outside analytics service receives them, no advertising identifier is used, and they are never sold or shared.

They are linked to your account so that Bridge can tell, for example, how many people come back a week after they start. If a conversation stops for safety, or you report a message, that is counted with no account attached, ever.

Counts are deleted after thirteen months. When you delete your account, the counts you made are separated from you and survive only as anonymous totals, and the record of the days you opened the app is deleted.

What Bridge does not do

• It does not sell anything you write, or share it for advertising.
• It does not use what you write to train an AI model.
• It does not track you across other apps or websites.
• It does not collect your location.
• It does not tell anyone you are paired with when you opened the app, how long you spent, or what you did.

How long it is kept

By default, what you write is deleted 730 days after you write it. You can shorten that to as little as 30 days in Settings, and each person you are paired with chooses separately for their own writing.

Deletion runs daily and removes your account of a conflict along with the message that was generated from it.

The usage counts described under "Counting how Bridge is used" are deleted after thirteen months.

Deleting your account

You can delete your account from Settings. Everything you wrote is deleted immediately, along with the messages generated from it and any messages addressed to you.

The people you were paired with keep their own history. A conversation you both took part in survives with you shown as someone who has left, because one person leaving should not erase the other person’s record of their own life. Nothing of yours remains readable in it.

Reporting and ending a pairing

You can report a message you received, and end that pairing in the same action. The other person is not notified that you reported anything.

Ending a pairing stops messages in both directions. It does not delete anything either of you wrote.

Safety

Everything you write is checked for indications of violence, threats, coercion, or intent to harm yourself or someone else, before it can go anywhere. If something is found, the conversation stops and you are shown crisis resources.

Bridge is not equipped for domestic violence or for a crisis, and it is designed to say so rather than to try. Crisis resources are available without an account, without a subscription, and without a network connection.

The result of that check is recorded as a single outcome value. What you wrote is never copied into the safety record, and no explanation of the decision is stored.

Children

Bridge is not intended for anyone under 18 and is not directed at children. If you believe a child has created an account, contact us and it will be removed.

Your rights

You can export everything you wrote, and everything addressed to you, from Settings, at any time, in a machine-readable form.

You can correct your name and email, shorten retention, withdraw sharing with a therapist, and delete your account, all from within the app and without contacting anyone.

Depending on where you live you may have further rights over your personal data, including access, correction, deletion and portability. Write to us and we will honour them.

Changes

If this policy changes in a way that affects what happens to what you have already written, you will be told inside the app before the change takes effect, not by a silent update to this page.

Contact

Write to bowman0509@gmail.com. A person reads it.