Skip to main content
liss

Privacy Policy

Last Updated: July 19, 2026

Bliss Therapeutic Services ("Bliss," "we," "us") is a sanctuary for your healing — and that begins with protecting what you share with us. This policy explains, in plain language, exactly what information the app collects, who can see it, how long we keep it, and the choices you have. It describes what the app actually does today; we will update it whenever our practices change.

1. Information We Collect

We collect only what is needed to provide the app's features. Depending on which features you use, that includes:

  • Account information — your name, email address, a securely hashed password (we never store your password itself), an optional profile photo, and your membership tier.
  • Journal entries — the text you write, the mood you tag it with, and any tags you add.
  • Daily check-ins — your mood and energy ratings, gratitude notes, and reflections.
  • Goals — the SMART goals you create and your progress on them.
  • Safety plan content — warning signs, coping strategies, safe-environment notes, and the names and phone numbers of the support people and professionals you choose to list.
  • Intake requests — if you request services, we collect your name, email, phone number, the type of service you are seeking, how urgent your need is, and the message you write. Intake requests can be submitted without creating an account.
  • Notification settings — your reminder preferences, an optional phone number you may save with those preferences, and, if you enable push notifications, the delivery subscription your browser creates.
  • Purchase and membership records — records of workbook purchases, donations, and subscriptions, including Stripe transaction identifiers and amounts. Your card number is entered directly with Stripe and never touches our servers.
  • Course and workbook progress — which modules you have completed.
  • Wellness activity — if you are signed in, a record of which self-help tools you use (for example, a breathing exercise or panic-mode session) and the milestone badges you earn, so the app can celebrate your progress.

What we do not do: we do not run advertising or third-party analytics trackers, we do not sell or rent your personal information to anyone, and we do not send your journal, check-in, or safety plan content to any outside artificial-intelligence service — encouragement messages are generated on our own server from a curated library.

2. Sensitive Disclosures, Including Substance Use

Your journal, check-ins, and safety plan may hold deeply personal information — including, if you choose to share it, information about substance use or recovery. Bliss is not a federally assisted substance use disorder treatment program, so the federal confidentiality rule at 42 CFR Part 2 does not directly govern this app. We nonetheless choose to treat any substance-use-related information you disclose with protections inspired by that standard:

  • We do not re-disclose it to anyone — including family members, employers, insurers, or other third parties — without your explicit written consent.
  • We do not use it for marketing, and we never disclose it to our payment processor. Like all of your private records, it is stored only on the hosting infrastructure listed in Section 4 — those providers store the data on our behalf and do not use it.
  • We will only disclose it if compelled by a valid court order or other legal requirement, and then only the minimum required.

3. Who Can See Your Information

Your private wellness records are isolated to your account. Journal entries, check-ins, goals, and safety plans are visible only to you when you are signed in — the app has no feature that shows them to other users, and no administrative screen that displays them to our team.

Our care team (the practice administrator) can see the intake requests you submit — that is their purpose — and basic account information: your name, email, membership tier, and the date you joined. They cannot read your journal, check-ins, goals, or safety plan through the app. Like any operator of its own database, we have technical access to the systems where data is stored; we access records there only when strictly necessary to operate the service, investigate a security problem, or comply with the law.

4. Service Providers (Subprocessors)

We use a small number of service providers, each of which handles only what its role requires:

  • Stripe — processes all payments, donations, and subscriptions. Stripe receives your payment details and billing information directly; we store only transaction identifiers, amounts, and your Stripe customer reference. Stripe's own privacy policy describes how it handles your data.
  • Replit — hosts the application and the database where your records are stored.
  • Google Cloud Storage (via Replit App Storage) — stores files such as course media and workbook downloads.
  • Browser push services (operated by Apple, Google, or Mozilla, depending on your device) — deliver push notifications if you turn them on. They receive the delivery endpoint your browser creates, not the contents of your private records.

5. How We Protect Your Data

All data travels between your device and our servers over encrypted connections (HTTPS/TLS) and is stored on infrastructure that encrypts data at rest. Passwords are hashed with bcrypt, so even we cannot see them. Sign-in sessions expire automatically after 7 days. No system is perfectly secure, but we design for least privilege: every request to read or change your records must prove it comes from you.

6. Data Retention

  • Your wellness records (journal, check-ins, goals, safety plan, progress, notification settings) are kept for as long as your account exists, so the app can serve them back to you.
  • When you delete your account, all of these records are deleted from our database immediately and permanently, along with your sessions and push subscriptions. Residual copies may persist briefly in encrypted infrastructure backups before those cycle out.
  • Intake requests are not linked to an account and are retained so our care team can follow up and coordinate services. You can ask us to delete an intake request at any time using the contact below.
  • Purchase records are retained as needed for accounting, tax, and dispute-resolution obligations, even after account deletion.

7. Your Rights: Access, Export, and Deletion

  • Access — you can view all of your journal entries, check-ins, goals, and safety plan anytime in the app.
  • Correction — you can edit your name and profile in the app, and edit or delete individual journal entries and goals.
  • Deletion — you can permanently delete your account and all of your wellness records yourself from your Profile page. No email or waiting period is required. The only exceptions are the retained purchase records described in Section 6.
  • Export — there is currently no self-serve export button in the app. If you would like a copy of your data, email us at support@choosebliss.app from the address on your account and we will provide it within 30 days.

8. Breach Notification

If we learn of a security breach affecting your personal information, we will notify you by email at the address on your account without undue delay, and within any timeline required by applicable law. The notice will describe what happened, what information was involved, and what we are doing about it.

9. Not a Substitute for Emergency Services

Bliss is a wellness tool. It is not a medical device, it does not diagnose or treat any condition, and it is not a substitute for professional care or emergency services. If you are in crisis or thinking about suicide, call or text 988 (Suicide & Crisis Lifeline), text HOME to 741741 (Crisis Text Line), or call 911 if you are in immediate danger.

10. Changes to This Policy

If our data practices change, we will update this policy and the "Last Updated" date above before the change takes effect.

11. Contact Us

Questions, or ready to exercise any of the rights above? Email support@choosebliss.app. This policy works together with our Terms of Service.