Privacy

Your creative journey is personal. Here's how we treat your data:

What you write, and what we keep

Your conversations and reflections: The free-text responses you type during the experience (memories, project descriptions, chat messages) are sent to Anthropic's AI to personalize your experience in real time, but they are not stored on our servers unless you choose to save your journey (see below). Your conversations are not saved after your session ends unless you opt in — though what you have typed stays in this browser for up to 24 hours so you can pick up a journey where you left off, and is deleted after that (see Local storage below).

What we do collect: We store anonymous, non-identifying response patterns (like which creative medium you chose or which fear resonated) in a database hosted in the United States via Supabase. Long-form answers are never included in this collection—only structured selections, plus one narrow exception: if you type your own reason for creating and tick the box to show it on the community wall, that phrase is stored with the anonymous snapshot, capped at a sentence or two, with obvious contact details removed before storage (email addresses, links, phone numbers, and social handles), and may appear, unattributed, with your creative medium, on the community wall (the home page and the community page) — and you see that exact card, your words as they will be kept with your medium beside them, on the screen before you tick.

The wall works the same way for everyone else: after you choose your reason, you are shown the exact card the wall would display — a line in the site’s words for the reason you chose, with your creative medium — and it appears there only if you tick the box beside it. The card you see is the card that is kept: it is stored exactly as shown and never re-worded afterwards.

You can take your card down again at any time from the device you added it on — on the closing screen, or on the community page (see Your control below). Your card goes up only once that browser has kept the key for it; if it can’t (private browsing, a full store), the card isn’t added and the closing screen says so. A card with words you typed also goes up only after an automated check (Anthropic’s AI) has read them: if they look wrong for a public wall (for example hateful, sexual, threatening, about self-harm, swearing, an ad, or identifying someone), neither the card nor your words are kept, and the closing screen says the card didn’t go up. We also review the wall and can take a card down ourselves, which deletes any words typed with it. Every card on the wall is one whose person holds that key: cards added before the key existed were taken down on 1 September 2026. The wall shows nothing about where you are, and we no longer record your location with the snapshot at all.

Leave a box unticked and your answers only ever join the anonymous counts; the other “other”-style answers you might type (what you want to give, why this project, what’s in the way) are never part of this collection at all. Snapshots taken in a workshop room are never on the community wall and never in the community page’s counts — the newest answers there would otherwise be readable as that room’s; they do count in one site-wide figure, the fear percentages shown mid-journey, which are counts, never anyone’s individual answers.

If you open the site through a shop’s or library’s link, finishing the journey adds four of the answers you picked (what you make, why you create, what gets in the way, what you gave yourself permission to do) to that place’s totals: in groups of ten, never your words. The line at the start says so; “Don’t count me” there, or “Don’t count this one” at the end, leaves you out. Like any small group’s totals, a place’s can sometimes point to a person: someone who knows how nine people in a group of ten answered can sometimes work out some of the tenth’s choices.

If you leave a message for future visitors, that message is stored and may be shown to others after an automated moderation check (we also review and can remove messages).

If you provide your email for a reminder, follow-up nudge, or community check-in, we store your email along with the context you provided (such as your commitment, core reason, project details, and relevant selections) so we can personalize the message. For forge follow-ups, this includes your project name, description, scope, check-in status, and day-one actions so we can remind you what you committed to. Emails are used only for the purpose you signed up for and are never shared or used for marketing.

If you send someone an invitation at the end of a journey, we never ask for your email. Theirs is used to send that one email and is kept only as a one-way code: for up to about nine days, so the same inbox isn’t invited over and over, and for about 90 days as the record that the email went out, or for good if they mark the email as spam, so we never email them again. The email tells them someone visiting the site typed in their address and didn’t leave a name.

AI: This experience uses Anthropic's Claude to generate personalized reflections, power the chat mode, moderate community messages, check a reason you typed before its card goes on the community wall, and, when a kindler asks for one, write a short recap of a closed circle from its anonymous totals. Your inputs are processed by Anthropic's API in real time. To personalize return visits, locally saved summaries of your previous journeys — which feelings or fears you chose or wrote, your commitments, your forge project history, and key phrases from what you shared — are sent along with your new session so the AI can build on what you've already explored rather than starting from scratch. Anthropic does not train on this data, though they may retain API inputs for up to 30 days for trust and safety purposes per their terms. We log each AI request with a one-way hash of your IP and email (not the originals), along with the model used and token count, so we can monitor costs and detect abuse. This log is never used to identify you personally. See Anthropic's privacy policy for details.

Guides and Spark Circles

Guided sessions: If you have given a guide access to your journeys, they can see the reflection from each one — the structured choices you made (like your creative medium, the fear that resonated, the permission you needed, and your confidence rating), your personalized manifesto (it is written from what you typed, including in a conversation, and can quote your words), and what you shared during the experience (your commitment, dedication, project details, and any custom answers). Your guide cannot see the letters from your journey (your letter to your past self, and the letter written to you), the dated notes you write to yourself on your journey page, your raw AI conversation and the private signals drawn from it, or — if you've journeyed before — your private reflection on how your reasons have changed.

Quick logs are different: when you leave a quick log, your guide sees the whole entry — the note, the mood, the medium you picked and the date — and the AI session preparation built for your guide draws a mood pattern from your logs over time. Your guide also sees the profile details you keep on your journey page: what you're working on, your creative intention and cadence, and the display name you choose. A quick log that can't reach your account (you aren't signed in, or we can't confirm who is) stays on that browser, where your guide cannot see it, until someone signed in at /journey on that browser adds it, note included, to their own account, where their guide can see it. On a shared browser that could be someone else, though before they add it the page shows them only its date, what was made, how it felt and whether it has a note. Signing out of your journeys there, or clearing your data there, removes it, and so do 90 days without a visit.

If a summary of your conversation was generated, it and the line you chose to keep from the conversation stay private unless you choose to share the summary with your guide from your saved journey page; your earliest creative memory is likewise private by default and shared only if you choose. You can change either decision at any time there. AI-powered session preparation for your guide uses the same boundary — it only sees what you've chosen to share. So does a check-in the AI drafts for your guide to send.

Your guide can also download what they can see, as a PDF or as a spreadsheet (a CSV file), and the PDF also carries the messages between you. A downloaded copy is on their computer, not ours. Revoking their access, or deleting your data here, ends what they can see on the site, but it can’t reach a file they already downloaded.

If your guide has turned on emails about new journeys, they get one when you save a journey. It says only that you saved one, under the name your guide knows you by. Your answers stay on their dashboard, where revoking their access or deleting your data here reaches them. Until October 2026 that email also carried some of your answers, and those emails stay in their inbox.

Your guide’s notes can come by email. If you’d like that, you give the email you signed in with when you connect a guide (or later, on your journey page), and we keep that address so their check-ins and messages reach you. If you were already connected to a guide before October 2026, the address we keep is the one you signed in with. It’s kept only while you’re connected to a guide: when your last connection ends it’s removed, straight away if you disconnect and within about a week if a connection runs out, and deleting your data removes it too. So does the “Stop all the others too” button on our unsubscribe page. Without it, your guide’s notes reach you on your journey page.

Spark Circles are different, and a kindler is not a guide. Being in a circle gives nobody access to your journeys. The kindler running it sees anonymous counts across the whole room (how many people chose each fear or medium, and the like) and never what anyone wrote or who they are. In a small circle, or as people finish, those counts can point to a person. While a circle is live the kindler also sees how many people are on each screen, and once it closes, where anyone who stopped partway was last seen. Anyone with the circle’s code can see how many people are in it and how many have finished, and people in it see how many others are on the same screen as them. A light, if you choose to leave one along the way, is shown to later visitors to the site without your name, as on any journey.

At an event: the other kindlers running it see the event’s counts and each group’s. Anyone with your group’s code or link can open your group’s counts while the event is live, and anyone with the link for 30 days after it closes; once it has closed, anyone with the event’s link can open the whole event’s counts for those 30 days. Once the event has closed, the kindler can turn both off.

After a circle closes: it has a recap page with the same counts, for 30 days unless the kindler turns it off. Anyone who has the circle’s code can open it. The kindler can also ask the AI to write a short recap of a closed circle. What is sent for that is the circle’s counts and how many people stopped at each screen; nothing anyone typed is sent.

If your kindler has turned on shift-tracking, and you join on a device that has an earlier journey of yours on it (from a circle or on your own) and where you have signed in or opened a save link, you are asked whether to share your most recent saved journey so the kindler can see how your answers shifted; that shares your structured selections only (things like your medium, the fear that resonated, your confidence rating), and never your writing, your manifesto, or your letters. It is off unless you say yes.

Guide and kindler accounts: If you apply to be a guide or kindler, we collect what you submit on the application — your name, email, organization (if provided), and what you tell us about how you'll use the program — so we can review the application, set up your account, and send your magic-link sign-in. Approved accounts also store the operational data the dashboards need (your status, settings, and the activity described in the sections above). You only receive feature-update emails if you checked the opt-in box, and every such email includes an unsubscribe link. To close an account or remove your application data, email us.

Trailheads, for the places that ask for one: When you ask for a Trailhead, we keep what you send (your place’s name as visitors will see it, your email, and a website or public listing for the place) so we can check the place is yours and set it up. If it isn’t a fit for now, we delete your request. Once your Trailhead is set up we delete it too, and keep your email only as a one-way code, which is what lets you sign in to your dashboard; signing in keeps that browser signed in for 30 days. Emails between you and us are ordinary email, kept in our inbox. Your place’s name and its link are public: they’re on your poster and on the card a visitor sees before they begin. Your dashboard shows totals from the journeys finished through your link, in groups of ten, and never anything a person typed, their conversation with the AI, their name or email, or which answers are whose.

Spark Circle shift-tracking (opt-in, both sides): Some kindlers choose to enable a "track participant shifts" mode for their room — a setting they turn on at room creation (or later from the dashboard). When enabled, returning participants who have a previous WDYC journey see a welcome-back prompt at room-join asking whether to revisit or start fresh, and, if they have signed in or opened a save link on that device, whether to share their previous answers with the kindler for cohort discussion. If the kindler never enables shift-tracking on the room, no prompt is shown, and the kindler sees only what is described above (the default).

When you DO see the prompt and submit your choices, your peppered email hash is recorded for that workshop so we can count returners — even if you choose NOT to share prior data, a row is stored marking your participation choice (this is what lets your "no" actually mean no on subsequent visits). If you ALSO choose to share your prior journey, a reference to your most recent saved journey is linked alongside the row, and the kindler can see how your answers shifted between sessions; if you don't, the share field stays null and the kindler never sees your identity or prior data — only the aggregate count of "X chose not to share."

You can erase everything (the row, the link, all of it) at any time via "delete all my data" at /journey — every workshop participation record tied to your email is removed in the same sweep.

Analytics, feedback and the services we use

Analytics: We use Plausible, a privacy-focused analytics tool. It collects no personal data, uses no cookies, and does not track you across the web. We track anonymous usage patterns like which journeys are most popular, where people drop off, and which selections are most common (e.g., creative medium, obstacle type). When a page's web address contains a private access link — like a saved-journey, share, or sign-in link — that secret is stripped and replaced with a generic label before any analytics event is recorded, so it never reaches Plausible. Plausible also estimates which city each visit comes from, and the community page publishes some of those cities for its map: only cities from the map's own list of large cities, once one has had twenty visitors (Plausible counts someone again on each day they visit, so one person can make twenty), and none until five cities have, each with a rounded size instead of a count, and nothing else about any visit. None of this is tied to you as an individual.

Rate limiting: To prevent abuse and control costs, our server functions count how often requests arrive from your IP address. We store the address itself alongside a request count — not a hashed version, and we’d rather say so than imply otherwise. These records are removed by a scheduled cleanup, which currently runs weekly, so a record can persist for up to about a week (and up to about ten days for the daily counter that protects our AI features). They are never associated with your journey, your email, or anything else you provide, and they are never used to identify you — they exist solely to stop automated abuse and runaway costs.

Feedback survey: If you fill out the optional feedback survey at the end of a journey, your responses (like your rating and what stood out) are stored to help us improve the experience. After submitting feedback, you may optionally provide your email if you'd like to share more about your creative experience in a personal conversation. Your email is stored solely for that purpose, and removed after 90 days if we haven't been in touch. It is also emailed to our inbox when you leave it, so we can write back. Deleting your data removes the stored copy when it is the address you delete with, but it can't reach the inbox copy, which stays there until you ask us to delete it: write to jason@whydoyoucreate.com.

Third-party services: We use the following services to operate this experience. Your data is shared with them only as needed to provide the functionality described above: Supabase (database hosting, United States), Anthropic (AI processing), Resend (email delivery for reminders, follow-ups, and check-ins), Plausible (privacy-focused analytics), Netlify (hosting and serverless functions), Sentry (error monitoring — when something breaks, the technical error report may include a hashed identifier, never your reflections), and Stripe (payment processing for guide and kindler purchases — card details go directly to Stripe and never touch our servers). None of these services receive your data for marketing or advertising purposes.

What we don't do: We don't sell your data. We don't track you across the web. We don't run ads. We don't send marketing emails.

On your device

Local storage: We use your browser's local storage to save your progress if you leave mid-journey (cleared after 24 hours). If you complete a journey, your generated manifesto, letter, and forged project history are saved locally so you can see them if you return, with a short history of your past answers that lets the AI build on them. This data stays on your device and is automatically cleared after 90 days of inactivity, or sooner if you choose to clear it. If you save a journey, or ask for a link to save one, this browser also remembers the email address you used, so the box is filled in next time; it is cleared with the rest after 90 days without a visit, or when you clear your data. The only cookie a visitor gets is the optional sign-in session cookie described below.

You can clear local data anytime using the "clear my data from this device" button on the home page (in its menu and at the bottom), or in your browser settings. Clearing local data does not affect any journeys you chose to save to our server—you can recover your personalized experience anytime by signing in with your email at /journey.

Session cookie: If you sign in — to view your saved journeys, or as a guide or kindler using a dashboard — we set a single HttpOnly session cookie so you stay signed in (about 30 days). It contains only a signed token with a hashed identifier, never your email address or any reflection content. It is encrypted in transit (HTTPS only), inaccessible to JavaScript, and is not used for tracking of any kind. Using the save link we email you sets the same cookie, so that browser stays signed in to your saved journeys for about 30 days; the "journey saved" screen says so and offers a way to sign out. Signing out, using "clear my data from this device," or clearing cookies in your browser settings removes it. If you never sign in or use a save link, no cookie is ever set.

Tab storage: Three things are kept only for the tab you are in. A conversation with the AI, so that a reload does not lose it (the page stops using it after an hour). In a Spark Circle, which circle the tab is in: that is what keeps you in the circle through a reload or “start over”. For that the tab keeps the circle’s code and a random key for your place in the room, and nothing about you. And if you opened the site through a shop’s or library’s link, that link’s code, so the page can say whose link it was: the code says nothing about you, and it goes when the tab closes.

Saving, keeping and deleting

Saving your journey: At the end of an experience, you can choose to save your journey so you can revisit it later. Add your email and it's kept on our servers and reachable from any device by signing in; without one, the full journey stays in the browser on the device you used. If you request a reminder, a check-in, or a note to your future self, we first email you a save link — opening that link is what saves your journey to your email, and your reminder then includes a link back to what you found. Your free-text responses and AI-generated reflections (your manifesto, letter, chat responses, and other personalized content) are stored in our database.

If you share your journey's link, the person you send it to sees only part of it: what you make (which can be in your own words), the reason you chose from the list, your why and your manifesto (both can quote what you typed), and the date and the kind of journey. They don't see your private letters, chat, or other reflections; the full journey appears only when you open the link signed in with the email that owns it. What they see is still personal, so share the link thoughtfully. When you create a share link you're shown a one-time removal code — that code is the only way to take the public page down (we store it the way passwords are stored, so we can't show it again or take the page down by email address), and every share expires on its own after 90 days. Deleting your saved journeys does not remove share pages you've created.

Saved journeys expire after two years of inactivity — signing in to your journey list, opening a journey while signed in, or saving one all reset the clock, so anything you're still engaging with stays available. Opening a shared or bookmarked link while signed out shows the journey but does not reset its clock.

Finding your journeys: You can access all your saved journeys by entering your email at /journey. We'll send you a secure sign-in link (valid for 30 days, single use) that opens all journeys associated with your email. If it expires, just request a new one — a lapsed sign-in link never affects the journeys themselves. When you email yourself a journey, we store a one-way hash of your email address (not the email itself) alongside that journey so it can be found later. Signing in keeps only that hash too. If you've saved multiple journeys over time, they are all linked to the same email hash so a single sign-in shows your full history. Signing in also restores your personalized return experience (welcome-back screen, creative context) if it was cleared or if you're on a new device.

Data retention: Reminder emails and forge follow-up nudges are one-time messages — once sent, your email address is removed from the record 90 days after the message is delivered. Any AI-generated content stored alongside your email (such as personalized day-one actions) is also removed at that time. The anonymous parts of the record (like your core reason and project name) are kept to help us understand how people use the experience.

Monthly creative check-in subscriptions remain active until you unsubscribe using the link in any check-in email; your email is removed 90 days after you unsubscribe. Rate-limiting records are removed by a scheduled cleanup that runs weekly, so they persist for up to about a week — up to about ten days for the daily counter behind our AI features. AI usage logs are retained for cost monitoring but contain only hashed identifiers, not personal information.

Saved journeys are automatically deleted after two years of inactivity — signing in to your journey list, opening a journey while signed in, or saving one each reset the expiry of every journey tied to your email to roughly two years from that activity (we don't rewrite a timestamp more than once a day, so it can land up to a day short). An expired journey stops being readable immediately; the sweep that physically removes it runs weekly, so the row itself can persist for up to about a week after that. Anonymous snapshot data is retained indefinitely in aggregate form.

Your control: You can permanently erase everything yourself at any time: sign in at /journey, open Account & data at the bottom of the page, and use the delete all my data link. We'll send a confirmation email; once you click through and confirm, every record tied to your email is deleted from our servers.

A few things aren't tied to your email at all, which is what keeps them anonymous — and is also why deletion can't find them: public share pages you've created, your answers to the optional feedback survey, a card you put on the community wall, and a light you left for the next creative (for now, ask us to take one down: write to jason@whydoyoucreate.com with its words). Taking a share page down requires the one-time removal code you were shown when you created the link, and each expires on its own 90 days after it was made.

A wall card comes down from the device you added it on: the browser that saved it holds a private key for that one card (we keep only a fingerprint of the key, never the key itself, so nothing else can link the card to you), and “remove it” on the closing screen or on the community page takes the card down and deletes the words you typed with it — the delete all my data flow does the same when you run it from that device. Clearing that device’s local data, or signing out of your journeys there, forgets the key, so take the card down first if you want it gone. We can also take a card down ourselves: if you no longer have the device, write to jason@whydoyoucreate.com with the card’s words and we’ll take it down. (An address you gave in the “want to go deeper” box is deleted from our records if it is the one you delete with; the copy in our inbox is not: see Feedback survey above.)

Deleted records are removed from our live systems straight away. We keep encrypted database backups on a rolling 30-day basis, which are overwritten automatically as they age out; we don't restore individual records from them. Two services we rely on keep their own records: our email provider retains delivery logs, including the address a confirmation was sent to, for a short period; and Stripe keeps the payment records it is legally required to hold. Neither is used to rebuild your journey. A copy your guide downloaded before you delete stays on their computer; deletion can’t reach it (see Guided sessions above). If you'd rather we handle it, you can also email us and we'll take care of it within 30 days.

Last updated: October 2026

See also: Terms of Service