Privacy Policy

This policy covers the Stonemind app (the "App"), published by Pocketleaf ("we", "us"). Pocketleaf is operated by Kyrylo Niesmielov, published on the App Store as "Kyrylo Niesmielov". We are the controller of the personal information described here. Questions about this policy go to support@trypocketleaf.com.

There is no sign-up. The App creates an anonymous ID the first time you carve an answer or use a community feature. It is not linked to your name, email address, phone number or Apple ID.

When you carve an answer, your position on the scale and your choice are sent to our server and counted in the world's answers. Your written reason is not.

What you write in a duel, the Agora, a club or a debate is stored on our server so the people it is meant for can read it. Every such text is checked by an automatic filter before it appears.

When you use an AI feature, the text it needs is sent through our server to Anthropic to write the reply. We do not store that text.

Your whole journal, including your written reasons, is kept on your phone and backed up to your own private iCloud.

Settings → Data & iCloud → Erase all my data erases your data from your phone, your iCloud and our server.

The first time you carve an answer or use a duel, the Agora, a club or a debate, the App signs in anonymously to our database, run for us by Supabase. This creates a random user ID. The sign-in is kept in your iPhone's Keychain, so the same ID can come back if you reinstall the App on the same iPhone.

The same random ID is used as your customer ID with our purchase provider, RevenueCat (section 10), so that a subscription and your community activity belong to the same anonymous person. We never ask for, and never receive, your email address, phone number or real name.

Your journal lives in the App's private storage on your phone: your answers and the reasons you write, third ways, drafts, the doubts you note, your conversations with Socrates and the thinkers, your shelf, streak and stone, time capsules, exam results, and your settings (language, theme, reminders, the answers you gave in the onboarding questions).

Your written reasons, doubts and notes are not uploaded to our server, except where you choose to send a reason in a duel (section 6) or to an AI feature (section 8).

Home-screen and lock-screen widgets show a small copy of today's question and your streak, kept in storage shared only between the App and its own widgets.

When you pick a friend to challenge, the App reads your contacts on your phone only to show the list. Nothing from your contacts is uploaded. If you choose a contact, the App opens Messages with the invitation, addressed to that number; the number is never sent to us.

When you carve an answer, the App sends to our server: the dilemma, the day, your position on the scale (0–100) and your choice (one side, the other, or a third way), with your anonymous ID and your app language. This lets the App show how everyone else answered. The world's answers are only ever shown as totals; no one can see an individual answer, and country and age groups are shown only once a group has at least 50 answers.

If you turn on "Count me by country & age", your country and age band (for example 25–34) are also sent and attached to your answers, so you can compare yourself with people like you. You can turn it off in Settings at any time; this clears them from your profile, but answers you carved while it was on keep the country and age band they were counted with until you erase your data.

Positions on moral and philosophical questions can reveal your beliefs. We treat them with care: they are tied only to an anonymous ID, never to your name or contact details, never shown individually, and never used for advertising or profiling. By carving an answer you choose to have it counted this way; if you prefer not to, do not carve, or erase your data at any time.

These features are optional. When you use them, what you share is stored on our server and shown to the people it is meant for:

Your name. The name you chose for your stone is sent as your display name the first time you use a duel or a club, or post in the Agora with "Show my name" on. It is shown to your duel opponents and club members, and next to your Agora posts only when "Show my name" is on. Because it can be your real name, we treat it as a name (contact information) linked to your anonymous ID. If you added your country, it is shown next to your Agora posts and to a debate opponent.

Duels. A duel stores the dilemma, both positions and choices, and both reasons. When you challenge someone, the reason you carved is sent with your answer. Anyone who has the duel link can open its web page at trypocketleaf.com and see your display name and the dilemma; after a friend answers there, both answers are shown only in that friend's browser. A duel link expires after 24 hours.

The Agora. Your argument (up to 280 characters), your position, and the votes and hides you give. Arguments are visible to people who answered the same dilemma.

Clubs. The club name, its members and their roles, the answers and short messages posted in the club. They are visible to the club's members only (up to 12).

Debates. Your turns in a one-to-one debate with someone who answered the other way, and your feedback at the end. Your opponent does not see your name. If you choose an AI opponent instead, your turns are sent to Anthropic to write its replies (section 8).

Blocking. When you block someone, we store who blocked whom and a short label of where it happened, so you no longer see each other.

Automatic filter. Before a display name, an Agora argument, a club name or message, a debate turn or a duel reason is published, its text is checked: first by simple rules (for example, links, email addresses and phone numbers are not allowed), then by an AI model from Anthropic that classifies it against the community rules. If it breaks them, it is not published. We keep only the outcome (published or stopped, and the category) for 90 days, not the text, to slow down repeated abuse. The community rules you accept before your first post, club or debate explain this check, and accepting them is your agreement to it; before a duel, the App shows the same notice.

Reports. When you report a post, a message, a duel or a person, we store your anonymous ID, what you reported, the reason and any note you add, together with a copy of the reported text so a moderator can review it. A person reviews every report within 24 hours. Content reported by three different people is hidden automatically until it is reviewed. A moderator may hide content or remove the author from the community features. The person you report is not told who reported them.

Moderators are alerted by an internal notice and, if enabled, by email sent through Resend; these alerts contain no reported text.

If something you write suggests you may be in danger, the App shows crisis resources (such as findahelpline.com) instead.

Socrates, "Against you", the steelman, talking to a thinker, My situation, A book for you and debates with an AI opponent are written by AI. When you use one, the App sends the text that feature needs over an encrypted (HTTPS) connection to our server at trypocketleaf.com: the dilemma, your position, choice and written reason, your messages in the conversation, the text you write in My situation, or — for A book for you — the titles, positions and reasons of up to a month of your carved answers. With it the App sends your app language, the date, your anonymous ID and a random device ID created by the App.

Our server passes the text to Anthropic, PBC, whose Claude models write the reply, and returns the reply to the App. Our server does not store or log the text you send or the replies. Before a reply is written, the text you wrote is checked for signs of crisis, by a phrase list and by a separate Claude request; if it suggests you may be at risk, the App shows crisis resources instead of a reply.

Anthropic processes the text only to provide the reply, under its commercial API terms. Under those terms, Anthropic does not use API inputs or outputs to train its models, and it keeps them only for a limited period for trust and safety purposes. Anthropic's privacy policy is at https://www.anthropic.com/legal/privacy.

Before you use any AI feature for the first time, the App shows a notice that names Anthropic, explains what is sent and why, and asks you to allow it. Nothing is sent until you do. You can withdraw this at any time in Settings → Privacy → AI features; the App then asks again before the next AI request. The automatic community filter (section 7) is explained separately, in the community rules and before a duel.

My situation is for a real dilemma from your own life, so the text may be personal. Please leave out names and details that could identify you or other people.

To enforce daily limits and prevent abuse, our server keeps usage counters keyed to your anonymous ID, the device ID and your IP address in a rate-limit store (Upstash). These counters are linked to your anonymous account and your device, never to your name or contact details. Most expire within an hour to three days. Two kinds have no expiry, because they track something that lasts: how many free AI questions a device has used, and how many purchased AI questions you have spent.

Everything else — reading, answering, carving, your shelf and stone — works without AI.

The daily question, the evening reminder about an uncarved draft, letters from your past self and time-capsule openings are scheduled on your phone.

If you allow notifications, the App also registers a push token (an Expo push token) with our server, stored with your anonymous ID, your platform and language, so we can tell you when a friend challenges you, a debate moves on, a club is active or you win a laurel. These notifications are delivered through Expo's push service and Apple's push service, and their text can include a display name, a club name or a dilemma's title. You can choose which ones you get in Settings → Notifications, or turn them off in iPhone Settings.

Subscriptions, packs and extra AI questions are billed by the Apple App Store. We never see your payment card details.

We use RevenueCat, Inc. to manage purchases. RevenueCat receives your anonymous ID, purchase and subscription information from the App Store, and basic technical data needed to process it (such as app version, device type, operating system, storefront country and IP address). We do not send RevenueCat your name, email or anything you write. Our server asks RevenueCat whether your subscription is active and which AI question packs you have bought, to apply the right limits and your balance. RevenueCat's privacy policy is at https://www.revenuecat.com/privacy.

If you are signed in to iCloud, the App automatically keeps a copy of your journal and settings — including your written reasons, doubts, AI conversations, and your country and age band if you gave them — in the App's private folder in your own iCloud Drive, so it can be restored when you reinstall or move to a new iPhone. This copy is stored by Apple in your iCloud account under Apple's privacy policy; we cannot read it. You can stop it by turning off iCloud Drive for Stonemind in iPhone Settings, and Erase all my data deletes it.

When you export your Book of Answers (PDF) or Back up to Files, the file is created on your phone and goes only where you send it. When you share an inscription card, it is drawn on your phone and handed to the share sheet. If you choose Save, the App asks once for permission to add images to your photo library; it does not read your photos.

Supabase, Inc. — our database for your anonymous ID, carved positions, community content, reports, blocks and push tokens (hosted in the United States).

Vercel, Inc. — hosts our website and the server that handles AI requests, filtering, reports and duel pages.

Upstash, Inc. — the rate-limit store for usage counters.

Anthropic, PBC — AI replies, the community filter and the crisis check.

RevenueCat, Inc. — purchases and subscriptions.

Expo (650 Industries, Inc.) and Apple — delivery of push notifications.

Resend, Inc. — moderator alert emails, which contain no user content.

Apple — the App Store, iCloud and the operating system services the App uses.

Each processes data only to provide its service to us. Our servers and these providers' standard request logs (for example, IP address and time of a request) are kept for a short time for security and debugging.

Your anonymous ID, carved positions, profile, and community content (duels that were answered, Agora arguments, club posts, debates) are kept until you erase them or erase all your data.

Duels nobody answered are deleted after 30 days. Filter outcomes are deleted after 90 days, notification delivery records after 14 days and community rate-limit records after 8 days. Debate matchmaking entries last minutes.

Reports and the moderation records attached to them are kept as long as needed to keep the community safe.

Settings → Data & iCloud → Erase all my data → Erase forever. This removes your journal from your phone, deletes the App's iCloud copy, removes your push tokens, and deletes your anonymous account on our server. Deleting the account also deletes your profile, carved positions, duels (including the friend's answer in them), Agora arguments, votes and laurels, club memberships and posts, your blocks, and your community rate-limit records. If you are offline, the erasure on our server runs the next time the App goes online.

Some records are not tied to you after erasure but remain: reports you filed stay without your ID, so earlier moderation decisions can stand; reports about content stay with their moderation record; in a debate, the other person's turns remain; a club you founded continues with its members. Usage counters described in section 8 stay keyed to the erased anonymous ID and to the device ID, so they remain linked to that account and device (never to your name or contact details) until they expire as described there. RevenueCat and Apple keep their purchase records under their own policies.

Uninstalling the App removes its data from your phone, but not the iCloud copy or your data on our server; use Erase all my data first. If you can't open the App, email us from the address you want us to reply to and we will help.

We do not sell or share personal information, show ads, or track you across other companies' apps or websites. The App does not access your advertising identifier. The App contains no analytics, advertising or crash-reporting SDK. Nothing you write is used to train AI models.

Stonemind is not directed to children under 13 (or the minimum age for consent in your country), and we do not knowingly collect personal information from them. If you believe a child has used the community features or sent us personal information, contact us and we will delete it.

Depending on where you live — for example under the EU/UK GDPR or the California CCPA/CPRA — you may have rights to access, correct, delete, restrict or object to the processing of your personal information, and to receive a copy of it. We rely on your choices (consent) for carved positions, demographics and community posts, and on providing the service you asked for for AI features and purchases. You can delete everything yourself with Erase all my data, export your journal as a PDF or backup file, and withdraw consent at any time. For anything else, email us. Because your ID is anonymous, we may need you to send a request from inside the App so we can find your data. You can also complain to your data-protection authority.

Stonemind can be used worldwide. Our database, servers and providers are mainly in the United States, so your data may be processed in a country other than your own, under the safeguards those providers offer (such as standard contractual clauses).

If the App starts handling data differently, we will update this page before that version is released. The date at the top shows the latest version.

Questions about privacy, or a request about your data? Email support@trypocketleaf.com.