This website (tapintocalm.com)
tapintocalm.com is a static site (HTML, CSS, and a small script for navigation and animations). We do not use advertising cookies, analytics pixels, or fingerprinting on this domain. When you load a page, your browser talks to our host like any normal website; standard server logs may include IP address, user agent, and requested URL for security and operations.
Fonts
Typography on the homepage is loaded from Google Fonts (fonts.googleapis.com / fonts.gstatic.com). Google may process connection data according to its own policies. Legal pages use system fonts only.
Links to other services
Pages here link to tapintocalm.app (the application), Gumroad (checkout for AI credits), and occasionally third-party references such as crisis helplines. Those services have separate privacy terms.
The Tap Into Calm app — what it does not have
- No account, email registration, profile, or sign-in.
- No advertising or in-app visitor analytics.
- No tracking cookies in the app.
- No push server for reminders (reminders are scheduled locally in the browser).
- No access to your fingerprint or face—the app does not receive biometrics; WebAuthn unlock is verified by your device.
What stays on your device
The journal lives in IndexedDB in this browser. Theme, voice, metronome, tone, reminders, and an activated license key (in localStorage) stay local too. The following are not uploaded to Tap Into Calm servers: session history, notes, favorites, statistics, setup and reminder lines you write yourself, journal lock password, backup password, biometrics, and journal history.
Without the optional journal lock, entries remain in the browser in readable form—they are not sent to us, but they are not encrypted on disk. Anyone with access to an unlocked browser or its storage could read them. Optional journal lock encrypts the journal with AES-256-GCM on the device; you unlock with WebAuthn or a password of at least ten characters (PBKDF2, 600,000 iterations). Session statistics sit behind the same lock; AI balance stays visible.
Encrypted backup export downloads a JSON file encrypted in the browser (AES-GCM, password you choose). The file is never uploaded by the app. Restoring replaces the journal on this device only.
The only data that leaves for optional AI
If you choose AI phrase suggestions, only the text you type (situation, optional feelings, optional body cue) and intensity 0–10 are sent. That text is not stored in server logs. Security logs record timing and a truncated hash of the network address, not your words. The text is processed by a language model (Llama 3.3 70B via OpenRouter) to return phrase options you can edit before saving locally. Saying “no one has access to your data” applies to the journal and settings in the browser—it does not apply literally to text you choose to send for AI processing.
Known self-harm or harm-to-others wording is filtered before it reaches the model; matching requests do not spend a credit and show crisis resources. This is a word filter, not clinical care.
Payment
Gumroad processes checkout. Gumroad sees the email and card details you provide there. Tap Into Calm does not see or store them. The app stores a license key hash on the server, not your email from Gumroad.
Contact
Privacy questions: info@tapintocalm.app.