Here is the path it takes, where it sits and how it is protected. No marketing fog: everything on this page is in the code that way.
You type something. Up to here nobody has seen it.
The connection is encrypted (TLS), like online banking. The session cookie is httpOnly and only set over HTTPS.
Sensitive fields are encrypted BEFORE they are stored: birth data, names, notes, chats, messages to friends, medication, cycle. 165 fields across 53 tables.
What you upload - contracts, IDs, documents inside a plan and attachments in a conversation - is encrypted before it leaves the server and sits in the media store as ciphertext too. Images and songs sit there unencrypted, because your device has to show and play them directly. They only come out through your login, which issues a short-lived link for them - except for whatever you published or shared as a card yourself.
On the website: no tracking, no advertising cookies, no analytics services. The cookie notice names exactly one purpose: your login.
We don't build tracking pixels into our emails. Whether the sending service adds one is a setting on their side - we keep it off and check it. If you want to be sure: don't let your mail app load images automatically.
And loading this page makes not a single request to an outside server. The typeface sits on our server, not Google's, and Stripe's script only arrives when you actually pay. Open your browser's network tab and see for yourself.
Never sold. SMPLYOU is self-funded; there is nobody we owe data to.
Error reports go out without personal data (send_default_pii=false). We see THAT something broke, not who it happened to.
Passwords exist only if you want one. The normal way in is a link by email. A password you set is stored as a hash (PBKDF2-SHA256, salted), never in plain text.
Your name, your age and the blueprint our server calculated from them. Your date, time and place of birth are NOT sent along: they are needed here to calculate the blueprint, not there to interpret it. Depending on the feature, your daily mood, your journal, your cycle, your medications and whatever you've noted about yourself go along. Every text is written there: the chat, but also your daily reading, your month and your year.
Only when you generate an image: your description, and for a hero avatar your photo.
Only when you generate a song or a video: the text it is built from.
Only when you pay: your payment details. We never get to see your card number. It is also the only case where an outside script runs in your browser.
Your email address and the content of the mails we send you.
Your images, songs and documents. Encrypted before they go there.
The place name you type into your birth details, so we can find the coordinates.
Error reports when something breaks. Personal content is switched off; an identifier such as your account ID can still appear in one.
Whoever gets hold of the database gets ciphertext. But the server itself has to be able to read your data in order to show it to you. So “encrypted” here means: protected against theft and against copies of the database. It does not mean that nobody with server access could technically read it.
Not only when you talk to Alfred. Your daily reading, your month, your year and every other text about you are written by an AI model. Your name, your age and your finished blueprint go there for that, every time. Your date, time and place of birth stay here: our own server calculates the blueprint, the model only interprets the result. That's not a side effect, that IS the feature: without this path there would be no reading. What Alfred doesn't need for an answer he still doesn't get — a plan you didn't mean isn't included.
What you write to a friend sits encrypted in the database, like your chats and blueprints. But not end to end: the server has to be able to read the lines in order to show them to the other person. And it CANNOT be otherwise as long as the butler is meant to read along and plan for you both. He only runs when someone brings him in, and the fact that he is there stands as a line in the conversation.
Invite someone into a plan and they see what is in that plan - that is exactly the point. You decide per building block who sees what, and single files can be locked. Your cycle, your medication and your private notes are never part of it.