← Back to app

Privacy Policy

Last updated: 30 August 2026

1. Who we are

Cowch ("the app", "we", "us") is operated by Mandy Kloppers trading as Thoughts On Life and Love, United Kingdom. For privacy questions, contact contact@thoughtsonlifeandlove.com.

For the purposes of the UK GDPR and the Data Protection Act 2018, the controller is Mandy Kloppers.

2. What this app is (and isn't)

Cowch is a self-help wellbeing tool. It is not a medical device, a therapy service, a clinical diagnostic tool, or a crisis-response service. Using the app does not create a therapist–patient relationship. If you are in crisis, please contact emergency services or a crisis line (UK: 999, NHS 111, Samaritans 116 123, SHOUT 85258; US: 911 / 988).

3. The data we process

• Chat messages you type to Mandy, and her replies.
• Journal and exercise entries you create (gratitude notes, mood check-ins, etc.).
• Preferences (e.g. tab last viewed, exercises completed, streaks).
• Limited technical data needed to deliver the service (device type, browser, IP address while requests are in flight) — we do not store this beyond the request.

We do not ask you for your full name, address, date of birth, payment details or health records. Please avoid sharing directly identifying personal data, and never share information about other people without their consent.

4. Where your data lives

• On your device. Your chat history, journal entries, preferences and progress are stored in your browser's local storage. They stay on the device you use unless you actively export or share them, with one exception, described next.
• In transit, briefly. When you send a message to Mandy, the text of that message and recent context is sent to our AI model provider so a reply can be generated. The provider processes it, returns an answer, and we return it to your device.
• Your questionnaire results. If you have finished “What are you like, anyway?”, the six scored results it gives you are included in that same request, so Mandy has some background about you. Your individual answers, and anything you typed into it, are never included. You can turn this off in the app under Settings → “What Mandy knows”, or on the questionnaire itself; with it off, nothing from the questionnaire leaves your device. Results from the other questionnaires are not sent at all.
• Your wheel, in your own words. If you build a wheel after “What are you like, anyway?”, the lines you write there are kept on our server as well as on your device, exactly as you typed them — never edited, tidied or rewritten — so they survive a cleared browser or a new phone and can be given back to you later in your own words. They are stored against a random code your browser makes up, not a name, an email or an account, and nothing else reads them: they are not sent to our AI model provider and are not part of what Mandy sees. You can delete them, from your device and from our server, with the button at the end of the wheel.
• Server logs. Our hosting provider may retain short-term request logs (e.g. timestamp, coarse location, user-agent) for operational security. These are not used to profile you and are discarded on a short rolling basis.

5. Lawful bases (UK GDPR)

• Contract / pre-contract — to provide the service you have asked us for (responding to your messages, saving your own entries on your device).
• Legitimate interests — keeping the service secure and running, and improving it. We only rely on this where your rights do not override it.
• Consent — for any optional feature that asks you for it (e.g. push notifications, where available).

6. Who we share data with

• AI model provider (Anthropic, US) — processes the text of your Mandy messages to generate replies. Data is sent over TLS. Anthropic is contractually committed not to train its models on API inputs by default. International transfers are covered by the UK's approved transfer mechanisms (Standard Contractual Clauses / UK IDTA Addendum).
• Hosting / CDN (Vercel, US / EU edge) — serves the app and passes requests through.
• We do not sell data, share it with advertisers, or use it for targeted advertising.

7. Retention

• Device-stored data stays until you clear it (use "Clear conversation history" in the Your Space tab, or clear site data in your browser).
• Request-level server logs: up to 30 days unless needed for security.
• We do not maintain a long-term account-level profile of you.

8. Your rights

Under UK GDPR you have the right to: access your data, correct it, erase it, restrict processing, object to processing, and data portability. Because most of your data lives on your device you can exercise most of these yourself by clearing the app's storage. For anything else, email contact@thoughtsonlifeandlove.com.

You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

9. Cookies, storage and analytics

We do not use advertising cookies, and our analytics are cookieless. The app uses your browser's localStorage to keep your chat history, entries and preferences working — this is "strictly necessary" to provide the functionality you requested, so no consent banner is shown. You can clear it from the app (You → Clear conversation history) or from your browser's site-settings at any time.

To understand aggregate usage — for example how many people visit or install the app, which exercises are opened, and whether people return — we use Vercel Web Analytics. It is privacy-friendly and cookieless: it sets no cookies, does not track you across other websites, and records only anonymous, aggregate signals. It never collects personal data, and your messages and journal entries are never sent to it.

10. Children

Cowch is intended for adults (18+). Under-18s should only use the app with a parent or guardian involved in their care. If you believe a child has submitted personal data to us, contact us and we will delete it.

11. International transfers

Some of our processors (AI provider, hosting) are based outside the UK / EEA. Transfers are protected by the UK's approved safeguards (UK International Data Transfer Agreement / Addendum to EU SCCs).

12. Security

We use TLS for requests, keep our dependencies patched, and limit who can access operational systems. No online service can be guaranteed 100% secure — please treat the app as a journal / companion rather than a place to record highly sensitive personal data about yourself or others.

13. Changes to this notice

We may update this policy. When we make material changes we will update the date at the top and, where appropriate, notify you in the app.

14. Contact

Questions or requests: contact@thoughtsonlifeandlove.com.

See also: Terms of Use · Accessibility.