Your privacy.

Step by step

1. Your browser. The conversation is held in the page while it’s open. We don’t automatically save chat in cookies or local storage. Closing the tab or refreshing clears the conversation. You can separately choose to save an edited note, comfort preferences, or a check-in recovery key on your device. The page will still be in your browser history, which is something you control and we can’t.
2. Our server. It passes your message along and passes the answer back. It doesn’t write your chat into a database. The optional check-in service stores its own setup separately; it never receives your chat history.
3. The AI service. They generate the reply. Retention depends on the provider and account settings. Confide supports Groq and Anthropic; both describe exceptions for safety or legal requirements. Read the Groq data policy or Anthropic API retention policy. When Cohere is enabled, recent messages are also sent to it to help choose tools, health sources, and support listings. This includes any personal or health details in those messages. Cohere’s enterprise policy normally deletes API logs after 30 days, with exceptions for legal, contractual, or abuse-related reasons. Retention and use for training depend on the account type, settings, and terms; trial keys have different terms. Read Cohere’s data commitments. Requests come from our server, so we do not forward your IP address to any AI provider. Any personal details you type are part of the message.

Things we won’t claim

We won’t say this is “100% private” or “completely anonymous”, because your message does leave this website in order to be answered, and saying otherwise would be a lie you couldn’t check.

What’s true is narrower and, we think, more useful: you can chat without an account or contact details. If you type identifying details into chat, they are part of the message sent to the AI service. Check-in setups contain a contact number and may contain identifying details in the message you choose.

If something goes wrong

When reporting is enabled, a link under a completed answer lets you share that one exchange to report something harmful or wrong. It sends only the message and the reply you flagged, only when you tap it, and it’s the way an exchange can be shared with us for review. We need it, because a tool that stores nothing otherwise has no way of finding out it made a mistake.

Optional tools and saving

• Site translation. Off by default. Choosing a translated language loads Google Translate and shares visible page text, including conversation text, with Google under its own privacy practices. Your language choice is saved in this browser’s local storage so it follows you between pages. Switching back to English removes that saved choice and the translation cookie.
• Web search. Off by default. Turning it on for a message allows the AI provider to send search terms to its search service. Use a city or general area instead of an address. Search providers have their own retention practices.
• Local service lookup. A ZIP entered in a tool is matched in your browser. Loading a map shares your IP, the map area, and Confide’s site address with OpenStreetMap. It does not share your chat, page path, or precise device location. Opening directions or a provider website opens an external service with its own privacy practices.
• Finding and contacting support. Resource filters, reasons for looking for another option, and editable contact openers stay in the page. These tools don’t save those choices or send them to the AI or a provider. Copying an opener only copies it to your clipboard. Opening a contact link takes you to an external service or your phone app; it does not send your conversation.
• Listing flags. Choosing to report a listing sends its resource ID and a preset issue type to our resource reviewers. We store one open flag per listing and issue type, with a random version to protect concurrent reviews. No name, free-text story, contact details, chat, or visitor identifier is stored with a flag. Repeated flags are combined, and resolved flags are deleted.
• Location. Requested only when you tap the location button. Your browser may use a device location service. Confide keeps the result in the page unless you explicitly share it or include it in a check-in message. It is a dated snapshot, not live tracking.
• Comfort preferences. Appearance, spoken voice, follow-up, reading level, and communication choices last for this visit unless you explicitly choose to remember them on this device. That option uses browser local storage and never includes chat or an exact age. A school or age-group cue typed in chat is part of the message sent to the AI service, like any other chat text. Turn saving off in conversation preferences to remove the saved choices.
• Conversation intent and craving support. The optional conversation style goes with your chat request so the AI can respond accordingly. It isn’t saved with your preferences or usage counts. Choices in the craving exercise stay in the page and are cleared on refresh. The exercise does not send those choices to the AI.
• Reply corrections. Choosing “Too much advice,” “You misunderstood,” or “Keep it shorter” sends a new chat request with the current conversation and your correction. It does not file a report or save a personal feedback profile. Like other chat requests, it contributes only to aggregate query and reply counts.
• Your notes. Continuation notes, appointment worksheets, and “what helped” reminders stay in the page unless you explicitly save or copy them. You can select chat excerpts for a continuation note and edit them. Save buttons keep only the note text and a local entry key in this browser’s local storage. These notes are not uploaded to our server, analytics, or the AI. Anyone using the same browser can read them; this is not an encrypted vault. Browser settings, private mode, or clearing site data may remove them.
• Using or deleting saved notes. Open Your notes in chat to review, edit, or delete your continuation note and reminders. Appointment notes have their own controls in the appointment worksheet. Edits require another Save. New conversation and Quick exit leave saved notes in place. Deleting a saved note does not erase text you already copied or sent. Putting a continuation note in the message box does not send it; pressing Send then shares that text with our server and the AI service like any other message.
• Spoken voices. Audio is off by default and online voices are currently unavailable. You can choose a voice marked as on-device by your browser, which sends no text for speech generation. Confide does not save audio. Audio does not play automatically unless you choose Speak & send in voice conversation. Each spoken turn can read its new reply aloud. Audio stops when the page loses focus, you leave, or you stop it. Previously saved online voice choices are reset to audio off.
• Voice input. The microphone starts only when you choose Start dictation or Speak & send and grant browser permission. The voice panel identifies the service before you start. When dedicated transcription is configured, your recording is held temporarily in memory and sent through Confide to Groq when you tap Done speaking. Confide does not save recordings. Groq’s data policies apply. Otherwise, your browser may send audio to its own speech service under its policies. Dictation lets you review text before sending; voice conversation sends recognized text after you finish speaking. Sent text is handled like any chat message. The microphone stops when you cancel, close the voice panel, or leave the page.
• Check-in messages. When enabled and chosen by you, Confide stores your contact’s email address, the chosen message, deadlines and delivery references encrypted in its check-in database, along with a scrambled form of the one-time verification code (never the code itself). Setup awaiting verification expires after 30 minutes; an activated setup expires 24 hours after its final deadline. Resend, our email service, receives the address and message to send the verification code and the scheduled email, and may retain its own records. If this installation sends check-ins by text instead, Twilio receives the contact’s number and message in the same way. This exception allows a message attempt even after the tab closes. It does not save chat. We do not sell or share check-in contact details, SMS opt-in data, or personal information with third parties for marketing purposes.
• Save access on this device. This optional button saves a private check-in recovery key in browser local storage. Anyone using that browser, or anyone with the private link, can view and cancel the plan. Removing saved access does not cancel texts. Use “Cancel all remaining texts” first if that is what you want. Exit and closing chat do not cancel them.
• Remembering a check-in contact. Off unless you tick it after your contact gives you a code. This browser then keeps a random key in local storage, and Confide stores a scrambled pass made from that key and the contact’s address for 90 days. The pass can’t be turned back into the address, and it only works from this browser. Until it expires, new check-ins from this browser to that contact skip the code. Instead, Confide emails your contact a notice with a link to stop the check-in, and stopping it also deletes the pass. “Forget them on this device” removes the key from this browser.

Counting usage

Confide keeps daily and lifetime totals for submitted questions, completed, failed or stopped replies, and visits. The separate analytics database keeps metric names, dates, and numbers. It contains no conversation text, names, phone numbers, IP addresses, visitor IDs, page histories, or individual answer logs. To avoid duplicate counts during retries, it also keeps short-lived random submission receipts with no answer attached; these are not visitor IDs. Check-in storage is separate.

A visit normally contributes only to an unclassified visit total. If you choose the option below, your browser remembers a “visited before” flag and last counted day. It sends only new/returning and first-visit-today flags, never an identifying code or the saved date. Those flags immediately become aggregate counts. Turn the option off to remove the marker. Aggregate totals cannot be traced back to you to remove an individual contribution.

Visit measurement respects Do Not Track and Global Privacy Control. Overall question and reply counts still measure whether the service is working. Our hosting infrastructure receives normal connection information to serve requests; that information is not copied into the analytics database.

Counting what happens next

To show that Confide helps, we count a few actions the same way, as anonymous totals: taps to call or text a crisis line, a listed service, or a naloxone pickup site; message drafts sent or copied; practice conversations started; and confirmed check-ins. The tap adds 1 to a total. The number, the listing, and what you wrote are not sent. These taps respect Do Not Track and Global Privacy Control.

Sometimes Confide asks one optional question, like “Planning to pick some up?” or “Were you able to reach them?” Your answer adds 1 to that answer’s total. Answers aren’t linked to each other, to a conversation, or to you. Each submission has a fresh random retry token, not a visitor identifier. The server retains only a receipt for up to 48 hours (expired local-development receipts are cleared on the next survey write). Retries are accepted for 24 hours. No answer or contact details are stored with the receipt.

After some answers, you can switch on “Check in about this on a later visit.” Only then does your browser save a small note with the topic and the date, on this device only. The next visit from the following day, a card asks how it went; its first line doesn’t name the topic. The note is deleted when you answer, choose “Don’t ask about this again,” switch it off, or expires after 30 days. Different topics are kept separately. Anyone using this browser could read the saved topics.