Draft for legal review. Items marked [TO CONFIRM: like this] are details we have not yet confirmed. This page describes what the service does today; it is not a statement that Salim meets any law.
Last updated: 28 October 2026
The short version
- You use Salim through an account, so we hold your email address and sign-in details, and, if you subscribe, billing identifiers held with Stripe.
- What you type into Salim’s tools (thoughts, ladders, scratchpad, trial answers, chats with the Limu companion) stays in your browser’s memory on your device. It is not sent to our servers, to Supabase, to Stripe or anywhere else, and it is not saved. It disappears when you close or refresh the page.
- We do not use advertising or analytics tracking, and we do not sell personal data.
Who is responsible for your data
The controller is [TO CONFIRM: legal name of the person or company running Salim], [TO CONFIRM: postal address]. Privacy contact: [TO CONFIRM: privacy email address]. [TO CONFIRM: Whether Salim is registered with the ICO and the registration number, if required]
What we collect, and why
| Information | Why | Where it is held |
|---|---|---|
| Email address, a hashed password, account identifier, sign-in and email-confirmation timestamps | Create and secure your account, verify your email, let you sign in and reset your password | Supabase (authentication and database) |
| Session tokens, kept in cookies in your browser | Keep you signed in | Your browser; checked by Supabase |
| Subscription state: Stripe customer and subscription identifiers, plan, status, trial and billing dates, whether it will cancel | Give you the access you have paid for or are trialling, show your plan, run the free month once per person | Supabase, copied from Stripe |
| Payment details (card or other method), billing name and address if requested, invoices and payment history | Take payment and keep billing records | Stripe only. Salim never sees or stores card numbers |
| A one-way hash of a normalised version of your email address | Stop the free month being claimed again after sign-out, a new device, a changed address or account deletion | Supabase |
| Technical data: IP address, browser type, request time and URL | Deliver the site, keep it secure, find faults, prevent abuse | Vercel server logs; Supabase and Stripe logs for requests made to them |
| Rate-limit counters, keyed by a hash of your IP address and account identifier | Protect billing and sign-in from abuse | Supabase. Deleted automatically after about two days |
| Messages you send us (support or privacy requests) | Reply to you | [TO CONFIRM: mailbox or helpdesk provider] |
Health-related information
Salim is about OCD. Even though the tools do not send what you write anywhere, the fact that an account with your email address uses an OCD self-help app could itself suggest something about your health. We treat account and subscription data with that in mind. We collect the minimum we need, we do not send exercise content or any health-related answers to Stripe, Supabase, analytics or marketing services, and we do not use your data to profile you or for advertising.
[TO CONFIRM: Lawful basis for processing, including the condition for any health-related data (for example explicit consent), to be decided with legal advice. A data protection impact assessment is recommended before launch.]
Who else handles your data
- Supabase provides sign-in and our database. It acts on our instructions as a processor. Region: [TO CONFIRM: Supabase project region].
- Stripe processes payments and runs the checkout and billing portal. Stripe handles payment details under its own privacy policy, as both a processor for us and an independent controller for fraud prevention, regulation and its own purposes.
- Vercel hosts the site and the small server functions that talk to Stripe and Supabase, and keeps server logs.
- Email delivery for confirmation and reset emails is sent through Supabase’s email service [TO CONFIRM: or a custom SMTP provider, if one is configured].
Fonts are bundled with the site, so your browser does not contact Google or any font service. There is no analytics, advertising or social media tracking.
Cookies and similar technologies
- Essential sign-in cookies set by Salim (names start with
sb-) keep you signed in and let you finish email confirmation and password reset. They are needed for the service you asked for, so they do not need consent. - Stripe sets its own cookies on stripe.com pages (Checkout and the billing portal) for security and fraud prevention. See Stripe’s cookie policy.
- Salim’s tools do not store anything in localStorage, sessionStorage or IndexedDB, and there are no analytics or advertising cookies. Appearance and other settings are not saved between visits. The sign-in library briefly writes and immediately deletes a throwaway test value to check that browser storage works; it keeps nothing.
International transfers
Our providers may process data outside the UK, including in the United States. Where they do, we rely on the safeguards in their data processing terms, such as the UK International Data Transfer Addendum or UK adequacy arrangements. [TO CONFIRM: Check and record the transfer mechanism and Supabase region for each provider]
How long we keep information
- Account and profile: until you delete your account.
- Rate-limit counters: about two days.
- Subscription and invoice records: kept without your name or email after account deletion where we must keep accounting records. [TO CONFIRM: Retention period; UK company records are commonly kept for 6 years, confirm with your accountant]
- Free-trial hash: kept after deletion so the free month cannot be repeated. [TO CONFIRM: Retention period and lawful basis (legitimate interests assessment)]
- Server logs: [TO CONFIRM: Vercel log retention for your plan]
- Support messages: [TO CONFIRM: retention period]
Deleting your account
You can delete your account yourself under Your account. This cancels any subscription immediately (no further payments), removes your sign-in and profile, and blanks the name and email on your Stripe customer record. Billing records that must be kept stay in Stripe and in our database without being linked to you. Deleting an account does not give a new free month.
Your rights
Under UK data protection law you can ask us for a copy of your personal data (access), to correct it, to delete it, to restrict or object to some uses, and to receive it in a portable form where that applies. Where we rely on consent, you can withdraw it. Email [TO CONFIRM: privacy email address]. We aim to reply within one month. We may need to confirm it is you.
If you are unhappy with how we handle your data, please tell us first. You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.
Children
[TO CONFIRM: Minimum age for an account and how it is enforced. Children’s data and the ICO Children’s code need specific legal review for a mental-health service.]
Changes
If we change this policy in a way that matters to you, we will tell you in the app before it takes effect.
Terms · Pricing · Urgent help