trust & compliance

your inner life is not a product.

sanctuary is emotional infrastructure for loneliness and heartbreak. we protect that work with privacy-first engineering, clear limits, and no dark patterns.

updated july 11, 2026 · contact hello@joinsanctuary.io

hipaa · honest limit

we do not claim hipaa compliance for the consumer harbor.

sanctuary is a direct-to-consumer wellness and emotional reflection product. it is not therapy, not a medical device, and not a crisis service. under typical use, sanctuary is not operating as a hipaa covered entity.

we still build toward healthcare-grade privacy: tls in transit, infrastructure encryption at rest, access-controlled accounts, export and delete, documented subprocessors, crisis routing to 988, and no sale of personal data.

if you are a clinic, eap, or covered entity seeking a business associate agreement for an enterprise deployment, email hello@joinsanctuary.io. consumer accounts do not create a hipaa relationship by default.

local-first by defaultstones, journal, and most harbor memory stay on your device until you opt into sync.
no data saleswe do not sell your reflections, grove posts, or dove conversations. ever.
crisis routing988 and human helplines are surfaced in product. sanctuary is not a substitute for emergency care.
healing stays freesovereign is memory and continuity. it never unlocks the right to heal.

encryption · what is true today

all traffic to sanctuary apis uses https / tls. cloud infrastructure encrypts stored data at rest with provider-managed aes-256.

optional account sync stores an authenticated copy of your harbor state so you can restore across devices. that copy is protected in transit and at rest. it is not end-to-end encrypted client-side yet. if you enable sync, sanctuary systems can access the synced state for operations, support, and safety review as described in the privacy policy.

device-local content that never syncs remains on your device.

ai processing

when you talk with dove or walk an expedition that asks for attunement, your words are processed by our ai provider (anthropic) to generate a response. we do not sell those messages. we do not use them for advertising.

safety review may retain limited conversation context for abuse and crisis response as described in legal. dove chat and free voice stay free forever.

subprocessors

retention & deletion

local harbor state lives on your device until you clear it. account deletion removes profile and subscription records and schedules purge of synced backups. anonymous grove and clearing posts are not identity-linked and may remain as community texture.

export your data anytime when signed in. email hello@joinsanctuary.io for deletion help.

age & safety

accounts are for adults 18+. the free harbor is not for children. if you are in danger, call or text 988. sanctuary is loneliness and heartbreak infrastructure between sessions of care. not emergency care.

what we will never do

sanctuaryapp, inc. · nashville · hello@joinsanctuary.io · this page is the source of truth for compliance marketing claims.