Your Privacy

What We DO

• Encrypt your data: All data is encrypted in transit (TLS) and at rest (AES-256)
• Review posts for safety: Our AI scans posts to help keep the community safe and suggest compassionate rephrasing
• Let you control your identity: Choose to post anonymously or with your name, per post
• Give you your data: Export all your posts, replies, and profile data anytime
• Delete when you ask: Delete your account and all associated data permanently

Data We Collect

Anonymity & Identity Protection

Your privacy is fundamental to mental health support. Here's how we protect your identity:

• Per-post identity choice: Choose to post anonymously or with your display name on every single post
• Cryptographic pseudonyms: Anonymous posts use a unique pseudonym per community, generated using one-way cryptographic hashing — your real identity cannot be reverse-engineered
• Identity separation: Your account profile is kept separate from anonymous posts. Even platform staff cannot easily link them without database forensics
• No cross-community tracking: Your pseudonym in one community is different from another — you can't be tracked across communities

Phone Verification (Optional)

Phone verification is optional and only required for therapist accounts to verify professional credentials.

• Regular users never need to provide a phone number
• Phone numbers are stored securely and never shared with third parties
• We use Twilio for verification — they do not retain phone numbers after verification

Third-Party Service Providers

We use the following services to operate ShareCare. Each is bound by data processing agreements and processes only the minimum data necessary.

Data Retention

We keep your data only as long as needed. Here's how long each type of data is retained:

• Account & profile data: Kept until you delete your account
• Posts & replies: Kept until you or a moderator deletes them, or you delete your account
• Mood entries & journal: Kept until you delete individual entries or your account (journal entries are always private)
• Direct messages: Kept until you delete the conversation or your account
• AI analysis results: Content flags retained for 90 days, then automatically deleted
• Server & access logs: 30 days
• Rate limiting data: 24 hours

You can request complete data deletion at any time via Settings → Account → Delete Account, or by emailing privacy@sharecare.app.

Your Rights (GDPR & CCPA Compliant)

You have full control over your data. These rights are guaranteed under GDPR (European users) and CCPA (California users), but we extend them to all users worldwide.

• 1
  Access: Request a copy of all your data via Settings → Data & Privacy
• 2
  Correction: Update or correct your information anytime via your profile settings
• 3
  Deletion: Delete your account and all data permanently via Settings → Account → Delete Account
• 4
  Portability: Export your data in machine-readable JSON format via Settings → Data & Privacy
• 5
  Objection: Object to data processing by emailing privacy@sharecare.app
• 6
  Restriction: Request restriction of processing by emailing privacy@sharecare.app

Security Measures

We take security seriously. Here are the technical measures we use to protect your data:

• Encryption in transit: All data transmitted between your device and our servers uses TLS 1.3 encryption
• Encryption at rest: All data stored in our database is encrypted using AES-256 encryption
• Password security: Passwords are hashed using bcrypt with 12 rounds — we never store plain-text passwords
• Rate limiting: API rate limits prevent brute-force attacks and abuse
• Access controls: Database access is restricted to essential services using role-based access control (RBAC)
• Monitoring & alerts: We monitor for suspicious activity and have incident response procedures
• Regular audits: We conduct regular security audits and dependency updates to address vulnerabilities