Privacy
What we hold, and why.
You write things here you would not write anywhere else. This page says plainly what happens to them.
What we collect
- Your account — email address and name, via Google sign-in. We never see or store your Google password.
- Sessions you book — the practitioner, the time, what you told us the session is for, and payment status. We do not store card numbers; payment is handled by the payment provider.
- Messages — between you and your practitioner.
- Your quiz result on LINE — If you send the full-result message on LINE, LINE passes it to our system so we can reply with your result straight away. Our system keeps no copy of the message or of your LINE user ID, but like any chat with our LINE account, our team can see it there, and LINE’s own privacy policy also applies.
- Life Graph — your name, birth date, birth time and birth place, and the daily notes you write.
How it is stored
Journal entries, messages, and your birth details are encrypted before they are written to the database, using AES-256-GCM. Someone reading the raw database sees ciphertext, not your words. Everything is held in AWS in Bangkok, Thailand.
Derived data that is not sensitive on its own — the numbers behind your Life Graph, for example — is stored unencrypted so the chart can be rebuilt without decrypting anything personal.
Where your journal text goes
When you submit a daily note, the text of that note is sent to Anthropic’s Claude API so it can be read back to you through an IFS lens. Anthropic processes it to produce that response. It is not used to train models. Your previous notes are never included — only the note you just wrote, plus the numeric scores from recent days.
If that service is unavailable, the reading is produced locally instead and your note still saves. You never lose a day’s writing because a third party was down.
Analytics and cookies
We use Google Analytics to see which pages are read and for how long, so we can write more of what helps. If you accept, Google sets two cookies in your browser (_ga and _ga_…, kept for up to two years) and receives the address of each page you open, an approximate location worked out from your connection, and the kind of device and browser you use. That is held by Google under its own terms. No advertising features are switched on, and nothing you write, book or say in a message is ever part of it.
InsideAway also runs its own visit analytics, kept in our own database in a data centre in Thailand and shared with no one. It records which pages are opened, how long they are read and how far down, which buttons and links are tapped, which tools are used (the quiz or the mood book, say, never what you answer or write), where a visit came from (a link on Facebook, or an ad), and the kind of device and browser.
Before you accept, or if you decline, it stores nothing in your browser. To count how many people visit each day, the server turns your IP address and browser type into a code that changes every day and cannot be reversed. The IP address itself is not stored, and yesterday’s codes can no longer be matched to anyone. These visits are never linked to your account.
If you accept, a random code is kept in your browser’s storage for up to 13 months, so we can tell that several visits came from the same browser. It is not your name or email, and we do not link it to your account. If we ever want to, we will say so on this page and ask for your consent again first.
It never records what you type, your chat messages, mood entries, quiz answers or results, or booking details, and it never records your screen. The one exception is words searched for in the article library, which are only counted per day and never linked to anyone’s visit.
Each visit record is kept for 13 months and then deleted. What stays are daily totals that identify no one, such as how many times each page was opened.
On your first visit we may ask, briefly, what brought you here. Answering is optional, and the answer is not linked to your name or account. If you are signed in, we remember only that this account has answered, so we do not ask again; if you are not, we keep a code made from your IP address for 30 days for the same purpose. Anything you type under “Something else” is encrypted before it is stored.
You can change your answer here at any time. Declining after accepting deletes Google’s cookies and the code in your browser at once, and the button below also deletes this browser’s past visit records.
You have not answered yet.
What we never do
- Sell your data, or share it with advertisers.
- Translate, edit, or rewrite what you wrote. Your words stay your words.
- Show your journal to your practitioner. Sessions and journalling are separate.
Your rights
Under Thailand’s Personal Data Protection Act you can ask for a copy of everything we hold about you, ask us to correct it, or ask us to delete it. Deleting your account removes your journal entries, messages, and birth details. Email hello@insideaway.com and we will action it.
This is not a medical record
insideaway is a reflective practice, not clinical care, and nothing here is a diagnosis. If you are in crisis, please contact someone who can help you today — in Thailand, the Department of Mental Health hotline is 1323.