Awareness to Action — Privacy Notice

Last updated: 30 September 2026

This notice explains how Safe Harbour Therapy and Counselling OÜ handles personal information when you use the Awareness to Action app. The app is for reflection and coaching; it is not therapy, diagnosis, medical advice or emergency support.

Who is responsible

Data controller: Safe Harbour Therapy and Counselling OÜ. For privacy questions or requests, contact drnjenner@theonlinetherapist.blog or use our support form.

Information the app uses

Account information: your email address, account identifier and authentication information, to create and secure your sign-in and connect your access across sessions. Password authentication is handled by Supabase; the app does not send your password to the coaching AI.
What you choose to send for coaching: text you enter and submit to a coaching tool, plus any conversation context needed to respond. This may include sensitive information if you choose to share it.
Voice input: if you choose Speak or microphone transcription, your recorded audio is sent through our service to OpenAI for transcription. The resulting text is returned to the app. If you choose to submit it for coaching, that text is then processed as described below. Audio recorded for the private journal is transcribed for you; journal entries are saved on your device and are not sent to the coaching AI.
App information stored on your device: private journal entries, coaching notes and conversations, actions, evidence, preferences and other app settings are stored locally on your device. These items are not synced to our account servers. Anyone with access to your unlocked device may be able to access information saved in the app.
Purchases: Apple or Google processes payments. RevenueCat helps the app check purchase and complimentary-access entitlements using an app user identifier and purchase information. We do not receive your full payment-card details through the app.
Read-aloud voice: if you choose to hear a generated reply, the reply text and selected voice are sent through our service to ElevenLabs to generate audio.
Further Reading: when you refresh or open this section, the app requests publicly available article information from The Online Therapist blog. Your private journal and coaching notes are not included in that request.

How coaching information is processed

When you submit words to a personalised coaching tool, the app sends them securely through our Supabase service to OpenAI to generate a response. The app does not send your private journal entries to this coaching service unless you deliberately copy or submit text yourself. Please avoid including names, contact details or other information that identifies you or another person unless it is necessary for your use.

AI-generated responses can be inaccurate. They are generated to support reflection and do not make decisions about your legal rights, employment, finances, health care or access to services.

Why we use information

To create and secure your account and provide the app and its access features.
To provide coaching responses, speech transcription and optional read-aloud audio when you choose to use those features.
To recognise purchases or complimentary access and restore access across your signed-in sessions.
To protect, maintain and troubleshoot the app and its services.

We process account and access information to provide the service you request, and process coaching or voice content when you choose to use those features after the app explains the external processing. We may also use limited technical and security information to protect and operate the service. You can change your external-data choice in the app; if you turn it off, features that rely on external processing will not work.

Service providers and sharing

We do not sell your personal information or use your private coaching content for advertising. Information is shared only as needed with service providers that help operate the app: Supabase (authentication and secure app services), OpenAI (coaching responses and speech transcription), ElevenLabs (optional read-aloud audio), RevenueCat (purchase entitlement management), and Apple or Google (app distribution and payment processing). These providers may process technical and security information needed to operate, secure and troubleshoot their services, under their own terms and privacy information.

Storage, retention and deletion

Journal entries and other phone-only app content stay on your device until you delete them or remove the app; they are not removed when you delete your sign-in account. Deleting your account in the app permanently removes the sign-in account from our authentication service, but does not delete locally stored notes or cancel an Apple or Google subscription. Manage or cancel a subscription through the relevant app-store account.

We keep account information while your account is active and for as long as needed to operate the service, meet legal requirements, resolve disputes and protect security. Our service providers may retain limited operational or security records under their own retention rules. The precise retention period can depend on the record and provider; contact us if you need information about a particular request or deletion.

International processing

Some of the service providers listed above operate internationally. Depending on the provider and service, information may therefore be processed in a country outside your own, including outside the European Economic Area. Provider-specific privacy and data-transfer information is available from those providers; contact us if you would like details about the safeguards applicable to a particular service.

Your choices and rights

You can choose whether to use features that send content for external processing, edit or delete phone-only content in the app, and request deletion of your account in the app. Depending on applicable data-protection law, you may also have rights to access, correct, erase, restrict or object to processing, receive a portable copy of certain information, and withdraw consent where processing is based on consent. To make a request, contact us using the details above. You may also complain to your local data-protection supervisory authority.