Your information, your choice.
Private beta · Updated 29 October 2026 · Operated by Daniel.
What we store
Your account details, password hash, goals, plans, actions, answers, conversations, explicit memories, reminder preferences, progress and feedback. Recovery codes are stored as hashes. Request records contain model names, token counts, timing and success status, not raw prompts.
Beta invitations and service improvement
We store invited email addresses, invitation expiry and acceptance, and delivery status to manage beta access. Managed invitation records are removed 90 days after link expiry, except suppressed addresses retained to prevent further mail until support resolves a bounce or complaint. Operators see aggregate counts of signup, verification, onboarding, saved plans and completed plan tasks to identify friction. These counts use existing account records; private disclosures and goal titles are excluded from the activation overview. Invitation records are included in account export and removed with account deletion.
Payments
If you choose a paid subscription, Paystack or Flutterwave receives your email address, payment reference, selected plan and amount, and collects payment details on its own checkout page. We store your recurring-billing agreement, provider customer and subscription identifiers, payment references, amount, currency, status and paid-through date. We do not store card numbers, security codes or reusable card authorizations, and do not send your personal disclosures to payment providers. Minimal financial records may remain separately after account deletion for accounting, refunds and disputes; contact support for retention and erasure requests. Account deletion first confirms cancellation so billing cannot silently continue.
Google sign-in
If you choose Google sign-in, Google provides your verified email, name and account identifier so we can create or connect your account. We store that identifier with your account. We do not request access to Gmail or Google Drive, and your Unstuck conversations and plans are not sent to Google as part of sign-in.
How AI uses your information
After you accept AI processing, requests for advice or plans send relevant answers and saved context are sent to the configured AI providers. The hybrid setup uses DeepSeek for advisor conversations and reviews, and OpenAI for diagnostics, plans and decisions. OpenAI also assesses submitted and generated content for safety, including opening answers before signup after your age and processing choice. Automatic reviews run only if enabled in Settings. Turning off saved memory does not stop your profile and goals providing context.
Providers process content under their own service policies. Do not enter another person's identifying details or sensitive information you do not want transmitted to these services. AI processing may take place outside your country.
Service providers and processing
Cloudflare serves the website; DigitalOcean hosts the API and background jobs; Supabase stores account records. Resend receives your email address and message content to send invitations, verification, password reset, welcome and optional reminder emails. These emails exclude your personal disclosures, task titles and relationship details. Our mailbox provider handles support messages. Google handles sign-in and browser push providers deliver generic reminders. Providers may process data internationally. The operator must document applicable lawful bases, sensitive-data conditions and transfer safeguards before public launch.
Your controls
Settings lets you correct or delete memories, export your stored information and delete your account. You can stop future AI requests in Settings; this does not erase previously sent content. Contact support for access, correction, restriction, objection or vendor-side requests. Deletion removes your active account records; aggregate operating budgets remain. Encrypted backups, when configured by the operator, must expire within 30 days. Account records remain until deletion; operational AI request records are removed after 90 days by scheduled cleanup. Provider, support-mail and infrastructure retention is governed by their applicable arrangements; contact us about requests involving those copies.
Cookies and reminders
Daily-action email reminders are on by default unless you turn them off. We send at most one per local day, around noon in your saved timezone, only when your daily action is unfinished. You can stop them in Settings or through the unsubscribe link in any reminder. Existing opt-outs remain off. Security emails are separate. Verification links expire after 24 hours; reset links after 30 minutes. Token records are removed one day after expiry. Pending email content is encrypted, expires within 20 hours and is erased on sending or cancellation. Delivery and bounce-event metadata is removed after 90 days by the worker. A bounce or complaint stops further emails until support resolves it.
Essential cookies keep you signed in. A temporary browser-session draft offers your opening answers for explicit adoption into your account and becomes unavailable after 30 minutes. Browser storage is cleared while the tab is active and on account deletion or sign-out. Browser notifications require your permission and use generic wording. We do not sell your personal information or use advertising trackers.
Google Calendar
If you connect Google Calendar, you grant access to a separate calendar created by Unstuck. We store your Google account identifier, that calendar's identifier, an encrypted refresh token, your chosen local time, a title-sharing preference and synchronization status. Access tokens stay in memory. We do not request access to your other calendars. Events use generic wording by default; enabling titles sends those titles to Google and may reveal personal information in calendar previews or shared devices. We send event times, a generic description and a link to Unstuck; no conversations or task descriptions are included. Event links still require sign-in. The background worker updates today's and tomorrow's events about every five minutes. Disconnecting requests deletion of the dedicated Unstuck calendar and all events inside it, including any you added manually, then removes the stored token. Account deletion attempts the same cleanup first. If you already revoked Google's permission, remove the calendar in Google yourself; downloaded or retained copies are governed by Google's policies. Calendar synchronization and email reminders have separate controls.
Access and feedback
The operator can access stored records to maintain the service and investigate a reported problem. Submitted feedback is available to the operator. Include only details needed to describe the issue.