Privacy

What you can do without an account

You can answer all nine questions without giving us your name or your email address. While you are answering, your answers and the two intake choices — which state you are in, and whether you are answering for yourself or for someone else — are held in a cookie in your own browser. Nothing is written to our database at that point.

That cookie is signed so it cannot be altered, but it is not encrypted: it holds your own answers, which are not secret from you, and signing is what stops someone changing a score.

Signing in

There are two ways in, and you choose. Google — we use Google sign-in to confirm you own an email address. Google tells us your email address, your first name and an account identifier; we do not ask Google for anything else, and we never receive your Google password. A link by email — we email you a one-time link. The link works for 24 hours, can be used once, and is stored only as a hash, so a copy of our database cannot be turned back into a working link.

There is no password to choose, and so none to lose.

What we store when you have an account

Your account: your email address, the first name you gave us, the state you chose, when the address was verified, and when the account was created.

Your answers: the option you chose for each of the nine questions, and the score, band and wording that follow from them. If you are answering for someone else, we store the first name you use for them and which pronouns to use — nothing else about them.

What you have marked done: which plan items you have completed, and when.

How you signed in: for Google, the identifier Google gave us. Never a password.

Your sessions: a hashed session token and its expiry, so you stay signed in. The token itself exists only in your browser.

Your choices: whether you agreed to us saving your answers, and whether you agreed to be contacted about a free review.

If you write to us: the name, email address and message you send, and whether our email to you went out.

If you book a call: the time, the timezone you read it in, phone or video, the name, email address and phone number you gave, anything you wrote for us before the call, and where you booked from. Afterwards, whether the call happened and the navigator’s own notes about it, which only Act III staff can see. Your phone number is remembered so the next booking can fill it in.

If you use the question box on a guide page while signed in: each question and the answer it got, so the navigator you talk to can see what you asked. Signed out, nothing you type there is kept.

What you do on the site while signed in: which guides you open, the questions you ask (as a short topic, not the words), items you mark done, stuck or not now, printing or sharing your plan, looking at Talk to us, and when you sign in. We use this to decide whether an email from us would help, and nothing else.

A short label for each guide question, email reply and note you write us: a topic of a few words, a mood (worried, confused, neutral or ready), and whether it mentions something serious — a death, a hospital stay, money being taken, mistreatment, or thoughts of self-harm. When it does, we stop sending you emails until a person at Act III has looked.

Your email choices: whether you asked for fewer emails or none, whether an email to you bounced or was marked as spam, and, for each email we send, the exact text, whether it was delivered, and whether you clicked it or replied.

Cookies, and what each one is for

We use no advertising cookies, no analytics cookies, and no third-party cookies of any kind. Nine cookies exist and all nine are strictly necessary for something you asked for.

act3_session — your answers and intake choices while you work through the questions. Signed, and readable only by the server.

act3_auth — your sign-in session, once you have an account. Readable only by the server, and it expires after 30 days.

act3_oauth_state and act3_oauth_verifier — created only when you start Google sign-in, used to prove the reply came back from the same browser that began it, and deleted the moment the sign-in completes. They last ten minutes.

act3_post_auth — used only on the administrative sign-in page, to remember which page to return to. Also ten minutes.

act3_return — set when you choose to sign in to book a call, so you come back to Talk to us afterwards. An hour.

act3_tz — your timezone: the one your browser reports, or the one you picked. Set on the sign-in pages and when you look at call times, so call times and our emails arrive at a sensible hour. A year.

act3_book_draft — what you typed on the booking form, kept for an hour so a mistake or a time someone else took does not make you type it again. Deleted when the call is booked.

act3_gcal — used only by Act III staff connecting a Google Calendar, to prove Google’s reply came back to the browser that asked. Ten minutes.

Your text size and contrast choices are kept in your browser’s local storage, not in a cookie, and are never sent to us.

Who else sees anything

Google, if you choose Google sign-in — the sign-in itself. If you use the email link instead, Google is not involved.

Mailgun, which sends our email. It handles your email address and the contents of what we send you: a sign-in link, a copy of your plan if you ask for one, our reply if you write to us, the confirmation and reminders for a call you book, and occasional emails about your plan. It tells us whether each of those was delivered, bounced or marked as spam, and passes on any reply you send. Links in our emails about your plan come back through our own site, so a click tells us which email it came from; Mailgun does not track them. Every one of those emails has a link to get fewer and a link to stop them, and neither needs you to sign in.

Anthropic, whose models do three things for us. If you use the question box on a guide page, what you type there and the guide you are reading are sent to compose an answer; your name, your email address and your answers to the nine questions are not. What you type there, a reply to one of our emails, and the note on your result are also sent to be given the short label described above. And once a day, to decide whether to email you and to draft the email, a summary is sent: your first name, the first name of the person you are answering for, your state, where each item on your plan stands, the labels (never the words), what you did recently, and the emails we have sent you. Your email address is never sent. Every email drafted this way is read and approved by a person at Act III before it goes out.

Google Calendar, if you book a call and the navigator has connected their calendar: the time of the call, your name, your phone number for a phone call, and a link to Act III’s notes for the call, which only staff can open. For a video call, the link comes from Google Meet.

Railway, which hosts the site and the database, in the United States.

We do not sell anything to anyone, and we do not share your information for advertising.

What we do not do

No analytics. No tracking pixels. No advertising networks. No third-party scripts of any kind — even the fonts are served from our own domain rather than fetched from Google, so that visiting a page tells nobody but us that you visited it.

How long we keep it

[NEEDS INPUT: retention period for accounts and answers — e.g. "until you ask us to delete it", or a fixed number of years of inactivity.]

[NEEDS INPUT: retention period for enquiries you send us.]

Sign-in links expire after 24 hours and can only be used once. Sessions expire after 30 days.

Asking for your data, or its deletion

Email [NEEDS INPUT: contact email address] and say what you want: a copy of everything we hold about you, a correction, or deletion. Write from the address you signed up with, or tell us which address it is, so we can be sure we are answering the right person.

Deletion removes your account, your answers, what you marked done, and your sessions. Enquiries you sent us are deleted too unless we still need one to answer you.

We will respond within [NEEDS INPUT: response time commitment — 30 days is the usual standard].

[NEEDS INPUT: which privacy laws you are claiming to comply with, and therefore which rights to list — e.g. UK/EU GDPR, or a US state law such as the CCPA. This changes the wording of this whole section.]

Children

Act III is for adults. It is not intended for anyone under 18, and we do not knowingly collect anything from a child.

Changes

If this notice changes in a way that matters, we will say so on this page and update the date at the top.