Data & privacy
Your data belongs to you.
This page explains, in plain language, what we store, where it lives, how it's protected, and who can access it. No legalese.
Your data
What we actually store
When you use AmberSeed, here is everything we hold on your behalf:
Account
Your email address. There is no password — you sign in via a one-time link sent to your inbox.
Conversations
The messages you exchange with the AI during each session, plus an AI-generated summary created when the session ends.
Beliefs
Every belief you've captured — both aspirational beliefs and the limiting ones you're working through.
Life areas
The areas you've explored (Health, Career, etc.) and what you've said you want from each one.
Glimmers
The things that light you up — moments, places, people, words — that you've added.
Reminders
Reminders of who you are and what matters to you.
Unbreakable rules
Your personal commitments, including ones you've since retired.
Manifesto versions
Every version of your manifesto, so you can see how your thinking has evolved over time.
We don't use tracking pixels, sell your data, or share your content with any third parties beyond what's needed to run the service.
Infrastructure
Where your data lives
AmberSeed uses Supabase, a managed cloud platform built on AWS, to store all your data.
Database
PostgreSQL, hosted and managed by Supabase.
Region
ap-south-1 — AWS Mumbai. Your data is stored in India.
Encryption in transit
All data travels over HTTPS/TLS. It's encrypted while moving between your device and our servers.
Encryption at rest
Supabase encrypts all data at rest on its managed infrastructure using AES-256.
Login & authentication
How your account is secured
AmberSeed uses magic links to sign you in — there is no password to remember, create, or leak. When you enter your email, we send you a one-time link. Clicking it proves you control that inbox, and that's enough. The link expires after use.
Authentication is handled by Supabase Auth — a dedicated service separate from the main database. Your login session is stored as a secure, signed token on your device. It expires automatically, and signing out removes it immediately.
Access
Who can read your data
Your beliefs, conversations, and everything else you've written are private to you. The database enforces this directly using Row Level Security — a Postgres feature that makes it impossible for one user's data to be returned in another user's query, even if there were a bug in the application code.
In plain terms: the database itself checks who you are before it will hand over any data. The app doesn't have to remember to filter — the filter is built into the foundation.
You
Full access to everything in your account.
AmberSeed team
Only the founder (Sarah Brown) has access to the Supabase database console — for debugging and keeping the service running. She cannot log in as you or read your content through the app. Direct database access is a separate, admin-only capability. And Sarah gives you her word that she's not going in and reading your entries, pinky promise. That's for your eyes only.
Server-side operations
Certain server-side operations — specifically account deletion — use a privileged service key that can bypass Row Level Security. This key is never sent to your browser. When you request account deletion, the server first verifies your identity, then uses this key solely to remove your account and its data.
Supabase
As the infrastructure provider, Supabase can access data on their servers in line with their own privacy policy. They are SOC 2 Type II certified.
Third parties
No other companies have access to your personal data or content.
Your conversations are processed by Claude, an AI made by Anthropic. Messages are sent to Anthropic's servers to generate responses during your session. You can read Anthropic's full data policy at the link above.
Control
Deleting your account
You can delete your account at any time from Settings. Deletion is immediate and permanent — there is no grace period or recovery option.
When your account is deleted, we remove everything: your email, password hash, all conversations, all beliefs, all manifesto versions, your life areas, glimmers, reminders, and rules. Nothing is retained.
Questions
If something here is unclear or you want to know more during the closed Beta, reach out to Sarah. This page will be updated as the product evolves.