Privacy

Who this is about

This page covers the Diverge app and this website, both operated by Diverge. For anything on this page, including a request to see or delete what we hold, write to hello@mindsthatwander.com.

Using the product without an account

Signed out, what you write stays in your browser's storage on that device.

We don't receive it, and we can't read it. Clearing your browser's site data removes it, and because it is only on that device, we cannot restore it for you.

If you make an account

An account exists to carry your data between devices. It holds:

Your email address

Used to sign you in, to confirm the address, and to send a reset link if you ask for one. Not used for marketing, and never passed to anyone else for theirs.

Your password, hashed

Stored as a one-way hash, never as text. Nobody here can read it, including us.

What you've captured

Your items and their steps, the people you've added and the cadence you set for them, your history of what you've done, and your settings.

Sign-in sessions

A token per signed-in device, stored hashed, so a device stays signed in. Signing out removes it.

This is stored in a database at our hosting provider, and it is not used for anything other than giving it back to you on your own devices.

The one place text leaves your device

When you capture something, the text is sent to Anthropic's API to work out where it belongs and what the first step is.

It goes through our server, which attaches our credentials and forwards it — we do not store the text of that request or its reply, and we do not log it. Anthropic processes it to produce the response, as a processor acting on our instructions and under their commercial terms, which say they do not use it to train their models.

If that step is unavailable, the product falls back to working it out on your device instead. Nothing else you do in the product makes an outbound request apart from syncing an account.

The text that never leaves your device

Text that reads as distress is never sent anywhere and never stored by us.

The check runs on your device before anything is written and before any request is made, so it does not reach the step above, it does not reach our database, and it is not held on our servers in any form. There is no table for it and no endpoint that would accept it. What happens instead is that you are shown ways to get help.

Cookies and analytics

This website sets no cookies and runs no analytics.

There are no tracking pixels, no advertising tags, no third-party scripts and no consent banner, because there is nothing to consent to. The app doesn't use cookies either — a signed-in session is kept in your browser's local storage, not in a cookie, and it is only ever sent to us.

Our hosting provider keeps ordinary server logs, including IP addresses, for security and troubleshooting. We also count failed sign-in attempts per address for a short window, so that the sign-in form can't be attacked by brute force.

The beta list

If you give us your email address for the beta list, we store the address and the date, and we use it once — to tell you when there is something to try. It is not added to a mailing list, not used for anything else, and not passed to anyone. Ask us and we'll remove it.

How long we keep things

Your data, while your account exists

Until you delete it or delete the account.

After you delete your account

Seven days, then it is permanently removed. The account stops working immediately; the week exists so that a delete you regret can be undone by signing back in. Signing in during those seven days cancels the deletion.

Sign-in sessions

Ninety days, or until you sign out.

Reset and confirmation links

Twenty-four hours, and each one can be used only once.

Your rights

Under UK data protection law you can ask for a copy of what we hold about you, ask us to correct it, ask us to delete it, and object to what we do with it. Two of those don't need us at all: you can export your data from the product at any time, and you can delete your account from settings.

For anything else, write to hello@mindsthatwander.com. If we get it wrong, you can complain to the Information Commissioner's Office at ico.org.uk.

Legal basis, in the usual terms

We process your email address and password hash to provide an account you asked for — that is performance of a contract. We keep security logs and rate-limit counts in our legitimate interest in keeping the service working and not being broken into. We rely on consent for the beta list, and you can withdraw it by replying to us.

Children

Diverge is made for adults and is not directed at children under 13. If you believe a child has given us their details, write to us and we'll remove them.

Changes to this page

If what we do changes, this page changes with it, and the date at the foot moves. Anything that materially affects what we hold or where it goes will be told to account holders by email rather than left here to be discovered.