Privacy Policy

Last updated: March 13, 2026

Your privacy matters, especially in a space connected to your therapy. This policy explains what information Attune collects, how we use it, and who can see it. We wrote it to be short and clear because you deserve to understand exactly what happens with your data.

If your therapist recommended Attune, this policy is part of the information they would like you to review before starting.

Important: Attune is a communication practice tool, not a crisis resource or substitute for therapy. If you are experiencing an emergency or thoughts of harm, please contact the 988 Suicide & Crisis Lifeline (call or text 988) or text HOME to 741741 (Crisis Text Line). If you are outside the United States, please contact your local emergency services.

1. What your therapist can and cannot see

Your therapist can see:

  • AI-generated session summaries (a brief overview of communication patterns and skills practiced)
  • Your self-reflection answers (the optional questions you answer after each session)
  • How many sessions you have completed and when

Your therapist cannot see:

  • The word-for-word messages from your practice conversations
  • What you typed to the AI practice partner during a session

Transcripts are permanently deleted after your session summary is generated. There is no way for your therapist, Attune staff, or anyone else to retrieve them after deletion.

2. What we collect

  • Account information: Your name and email address, provided when your therapist invites you or when you sign up.
  • Session summaries: After each practice session, an AI-generated summary of communication patterns and skills observed. This is what your therapist reviews.
  • Self-reflections: Your written answers to optional reflection questions after each session.
  • Session metadata: The number of sessions you complete and when they occurred.

3. What we do not store

We do not store full chat transcripts. Messages from your practice session are temporarily held while the session is active. Once your session summary is generated, the messages are permanently deleted. We built Attune this way on purpose: the transcripts cannot be retrieved because they no longer exist.

The AI does not remember you between sessions. Each practice session starts completely fresh. The AI practice partner does not carry information from previous conversations or build a profile of you over time.

4. Safety and crisis content

If you share content during a practice session that suggests you may be at risk of harm, the AI practice partner is designed to pause the conversation and direct you to crisis resources. It will not attempt to provide crisis support.

Attune does not monitor your conversations in real time. No human reviews your messages while a session is active. Your therapist does not see your word-for-word messages. If you are in crisis, please contact the 988 Suicide & Crisis Lifeline (call or text 988) or text HOME to 741741 (Crisis Text Line).

5. How we use your data

  • To run your practice sessions and generate session summaries
  • To share session summaries and reflections with your assigned therapist
  • To send you account-related emails (invitations, password resets)

We do not sell your data. We do not use it for advertising. We do not share it with anyone other than your assigned therapist and the service providers listed below. Neither Attune nor our AI provider uses your conversation data to train AI models.

6. Service providers

To operate Attune, we use a small number of third-party providers. Each processes data only as needed to provide the service:

  • Supabase (database and authentication): Stores your account information, session summaries, and reflections. Operates under a signed Data Processing Addendum (DPA) with contractual security and data handling commitments.
  • Anthropic (AI processing): Processes your practice conversations and generates session summaries. Conversations are not retained by Anthropic or used to train their models. We are migrating to BAA-covered AI infrastructure (AWS Bedrock) to strengthen health data protections.
  • Vercel (hosting): Serves the application. Does not have direct access to your session content.
  • Resend (email): Sends account invitations and password reset emails using your email address only.

All providers are based in the United States. If this changes, we will update this policy. If you have questions about a specific provider, email support@tryattune.app.

7. Security

Your data is encrypted at rest and in transit. Access is restricted by role: only you and your assigned therapist can view your session data, and your therapist sees only summaries and reflections, never transcripts. All access points require authentication. Therapists can only access data for clients who have been linked to them in the system.

HIPAA notice: Attune is not currently a HIPAA-covered entity and does not offer a Business Associate Agreement (BAA). We are migrating to HIPAA-eligible infrastructure and intend to offer BAAs in a future release. See our Terms of Service (Section 9) for more detail.

8. Children and minors

Attune is designed for adults 18 years of age and older. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected data from a minor, we will delete it promptly. If you believe a minor has created an account, please contact us at support@tryattune.app.

9. Data retention

We retain different types of data for different periods:

  • Chat transcripts: Deleted immediately after your session summary is generated
  • Session summaries and reflections: Retained while your account is active
  • Account information: Retained while your account is active

You may request deletion of your account and associated data at any time by emailing support@tryattune.app. After a deletion request or account termination:

  • Your data is removed from active systems within 30 days
  • Automated database backups that may contain your data are rotated and permanently overwritten within 90 days

10. Your rights

You have the right to:

  • Request a copy of the personal data we hold about you
  • Correct inaccurate information
  • Request deletion of your account and data
  • Know whether your data has been shared and with whom

California residents: Under the CCPA, you have the right to know what personal information we collect, request its deletion, and opt out of data sales. We do not sell personal information. We do not share personal information for cross-context behavioral advertising.

EU/EEA residents: Under the GDPR, you have additional rights including data portability, the right to restrict processing, and the right to lodge a complaint with your local supervisory authority. Our lawful basis for processing your data is the performance of our contract with you (providing the Attune service) and your consent where applicable.

To exercise any right, email support@tryattune.app. We will respond within 10 business days.

11. Cookies and tracking

Attune uses only essential cookies required for authentication and session management. We do not use tracking cookies, third-party analytics, or advertising pixels. We do not build behavioral profiles. We honor Do-Not-Track browser signals.

12. Changes to this policy

We may update this policy as the product evolves. We will notify you of material changes by email at least 7 days before they take effect. Non-material changes (such as formatting or clarifying existing language) may be made without advance notice.

Common questions

Can my therapist read my exact messages?

No. They see an AI-generated summary only. Your word-for-word conversation is deleted after the summary is created.

Does the AI remember past sessions?

No. Each session starts completely fresh. The AI does not carry information between sessions or build a profile of you.

Is my data used to train AI?

No. Neither Attune nor our AI provider (Anthropic) uses your conversation data for model training.

Can Attune staff read my conversations?

No. Conversations are deleted after summary generation. While a session is active, access is restricted to the systems needed to run the session. No Attune staff member reads your conversations.

Contact

For privacy inquiries, email support@tryattune.app. We aim to respond within 2 business days.