What you write stays yours

The short version

• Everything you write is encrypted on your device with your passphrase.
• If you connect a circle online, it is encrypted end-to-end. Our server stores only scrambled data, and we do not have the keys.
• Encryption covers what you write. Our server can still see which accounts share a circle and when records change. We treat that as health data.
• No ads, no trackers, no analytics kits, no selling or sharing data. This website does not use cookies.
• No location, no "last seen", no read receipts and no scores of any kind.
• Notification text is always generic. Both Ends never texts anyone. Invitations and offer links are sent from your own phone.
• You can download or delete everything at any time.
• Both Ends is not an emergency service, not therapy, and not a medical device. Nobody is watching.

On your device

Both Ends stores what you write in your browser's storage on your device. Each record is encrypted separately using AES-256-GCM. The key is protected by your passphrase and, separately, by a recovery code shown once when you set up. We never see or store either. When Both Ends is locked, nothing can be read without one of them.

A few comfort settings (theme, text size, reminder times) are kept unencrypted on the device so the lock screen can display correctly. They contain nothing you wrote.

Both Ends locks itself after a few minutes away. Quick hide (the eye at the top) locks it instantly and shows an ordinary-looking screen.

You can use Both Ends on one device with no account at all. Nothing leaves the device unless you connect a circle online.

When you connect your circle online

A real circle needs the online service, so that a moment can reach your helpers' phones. If you turn it on:

• You sign in with your email address and a one-time code. A quick check from Cloudflare Turnstile makes sure a person, not a bot, is asking for the code. It sees that someone is using the sign-in page, never anything you wrote.
• Your account has its own encryption keys. The private key is stored only after being encrypted with your passphrase, so you can use Both Ends on a new device. We cannot decrypt it.
• Each circle has its own key, shared only with its members. Invitation links carry a one-time secret in the part of the link that browsers never send to servers.
• Records are encrypted again before upload: your card, each moment, each check-in note, your safety plan and the rest. Even what kind of record something is stays hidden from us.
• Your comfort kit, your answers to the private "How are you doing?" check-ins, and a safety plan marked "only me" use a key that only your own devices hold. Other people in your circle cannot read them.

What our server can see

Encryption hides content. It does not hide everything. When a circle is online, our server holds:

• your email address, and which accounts share a circle;
• when records change, and the size of each encrypted record. A burst of changes can suggest that something happened, even though we cannot see what;
• each person's access in a circle (owner, can view and add, or view only), and whether each invitation has been used or has expired;
• which devices have asked for notifications, so one can be sent. The text is always generic, such as "Someone in your circle is thinking of you. Open Both Ends.";
• the times of reminders you turn on;
• for a read-only view you share with a therapist or someone else: an encrypted copy we cannot read, when it was last updated, how many times it has been opened and when, and when it ends, if you set an end date.

We treat all of this as health data. We keep as little of it as the service needs, and we do not use it for anything else.

What Both Ends never collects

• Your location. A moment never carries one.
• "Last seen", activity status or read receipts. Your helpers are not shown whether you have read a check-in.
• Scores, levels or ratings of how you are doing.
• Phone numbers for sending texts. Both Ends never texts anyone. You send invitations and offer links yourself, from your own phone, through whatever app you choose.
• Contacts, advertising identifiers, or anything from other apps.

Offer links

A helper can hand someone an offer link or QR card that says "put me in your circle". It carries only a first name, in the part of the link that browsers never send to servers. Opening one never adds anyone to anything.

Things the Both Ends team can read

• Feature requests and problem reports are read by the Both Ends team, so they are not end-to-end encrypted. Please do not include personal or health details.
• Help shape Both Ends is an optional form for volunteering to give feedback. It sends us only what you type in it: which roles fit you, how you would like to take part, a name or pseudonym, and an email to reply to. We use it only to contact you about giving feedback, and we delete it whenever you ask.
• Email you send us.

Links to other services

Find support and calendar export can open other organizations' websites (for example 988lifeline.org, Psychology Today or Google Calendar). Those sites only receive what is in the link you tap, such as a ZIP code or a neutral appointment title, and their own privacy policies apply. Calling or texting a crisis line uses your phone's own phone and message apps.

Your choices

• Choose your circle and what each helper sees. Hide any section of your card from any helper. They are not told.
• Share a read-only view with a therapist or care team: you pick exactly what they can see, agree to a plain summary first, and can remove their access at any time. The view is encrypted on your device with a key that lives only in the link you give them.
• Remove someone silently. They stop being asked and stop receiving anything new.
• Download a backup from Settings. The backup file is not encrypted, so keep it somewhere private.
• Delete everything on a device from Settings → Delete all data, and delete your online account from the online circle screen.
• Leave the online circle or sign out at any time.

Anonymous counts (off unless you turn them on)

In Settings → Privacy, you can choose to share anonymous counts to help us learn which tools are useful. This is our own small counter, not an outside analytics product. Here is exactly what it means:

• While it is on, your device counts how many times you open each screen of Both Ends, using only the app's own fixed screen names. It never includes anything you write, names, kinds of moment or times.
• Once a week, last week's counts are sent without your account, device or circle. Our server only adds them to totals for everyone together and keeps nothing else: no user ID, no device ID and no time of sending. Like any web request, the connection briefly passes through Cloudflare and Supabase, whose standard logs see an IP address, but Both Ends does not store it with the counts.
• Only the Both Ends team can see the totals.
• Turning it off stops it straight away and deletes any counts not yet sent from your device.

Consumer health data

Some US states, including Washington (My Health My Data Act), Nevada and Connecticut, give you extra rights over "consumer health data". Because Both Ends is about hard moments and mental health, we treat everything connected with your use of it as health data, even the fact that you have an account or are in a circle with someone.

• What we collect: what you write in Both Ends (your card, moments, check-in notes, safety plan, appointments and the rest), which stays encrypted so we cannot read it; your email address if you use the online circle; and the service details listed under "What our server can see" above.
• Where it comes from: only from you and the people you invite into your circle.
• Why: only to run Both Ends for you: to store, sync and deliver what you choose, send sign-in codes and the notifications and reminders you turn on, and keep the service safe from misuse. Never for advertising, profiling or research.
• Who we share it with: only the people you choose (your circle, or someone you send a read-only view to), and the service providers below, who process it for us under contract and cannot use it for anything else. We never sell it, and we never share it for advertising.
• Consent: we ask for it when you set up Both Ends and when you turn on the online circle. You can withdraw it at any time by leaving the circle or deleting your data.

Your privacy rights

Wherever you live in the United States, you can ask us to:

• Confirm whether we hold data about you, and get a copy of it. (What you wrote, you can download yourself as a backup.)
• Delete your account and everything our server holds for it. Deleting your data in the app removes it from that device.
• Correct your email address or other account details.
• Withdraw consent, and get a list of the service providers that have handled your data.

Email privacy@bothends.care from the address you sign in with. We will answer within 45 days, usually much sooner, and will not charge you or act differently toward you for asking.

Appeals. If we say no, you can appeal by replying to our answer, and we will explain our decision. If you are still unhappy, you can contact your state attorney general.

California residents: we do not sell or "share" personal information, and we do not use sensitive personal information to infer anything about you. So there is nothing to opt out of, though we honor Global Privacy Control signals anyway. You have the rights to know, delete, correct and limit described above.

Service providers we use

These companies help run Both Ends. They only ever handle encrypted data, or the limited details listed here.

• Supabase (encrypted storage and sign-in, hosted in the United States): stores your email address and the encrypted copies of what you sync.
• Cloudflare (website and app hosting, security, the Turnstile sign-in bot check, and forwarding mail sent to bothends.care addresses): sees ordinary web traffic, such as IP addresses.
• Resend (sign-in emails): sends sign-in codes, so it sees your email address and the code.
• Your browser's push service (Google, Apple or Mozilla, depending on your device): delivers notifications. The text is always generic.

If we add or change a provider, we will update this list first.

Age and place

Both Ends is for adults aged 18 and older, in the United States only at launch. We do not knowingly collect information from anyone under 18. If you think someone under 18 has set up the online circle, email us and we will delete the account.

If something goes wrong

Because what you write is encrypted with keys we never hold, a break-in at our server would not reveal it. It could reveal the details listed under "What our server can see". If there is ever unauthorized access to your information, we will tell you without unreasonable delay, and within 60 days at the latest, and notify regulators such as the Federal Trade Commission as the law requires.

Changes to this policy

If we change how we handle your information, we will update this page and its date, and tell you in the app's What's new before the change applies. We will never start selling data or using it for advertising.

The honest limits

Of privacy

• Encryption covers what people write. It does not hide who is in a circle with whom, or when records change. Our server can see that, and we treat it as health data.
• People in your circle can read what you share with the circle. Anything they already saw, saved or printed stays with them after you remove them. When the circle's owner removes someone, Both Ends also changes the circle's encryption key, so their old copy cannot open anything written later.
• Anyone holding a read-only view link can open it, so send it privately.
• A backup file you download is not encrypted.
• If you forget your passphrase and lose your recovery code, nobody can recover what you wrote, including us.
• Anything shown on screen can be seen by someone looking at your device, or by malware on it.

Of the app itself

• Both Ends is version 0.1.0, an early release. It has not yet been tested with real circles.
• An app that calls on a known person in the moment has never been tested in a trial. The closest earlier app, notOK, appears to have closed. That is why the card and the follow-up check-ins matter as much as the button.
• The follow-up check-ins are the best-evidenced part. Short "caring contacts" sent over time have been studied in trials.
• Guidance for helpers has been shown to raise helpers' confidence. It has not been shown to change outcomes for the person helped.
• A moment depends on phones, connections and people. Nobody is guaranteed to see it or to answer.

Security researchers and the technically curious can ask us for the full technical design at privacy@bothends.care.

Not an emergency service, not therapy, not a medical device

Both Ends is not an emergency service. It is not therapy, and it is not a medical device. It does not diagnose, treat, cure, or prevent any medical condition, and it is no substitute for professional care. Nobody at Both Ends is watching, and nobody can send help. In immediate danger, call 911. In crisis, call or text 988, or text HOME to 741741.

Both Ends is not a health care provider or a health plan, so the federal health privacy law HIPAA does not cover it, and we do not claim to be "HIPAA compliant". Instead, Both Ends is built so that we cannot read what you write, and the state health-data laws above apply. See also our terms of use.

Contact

Questions about privacy: privacy@bothends.care.