Privacy Policy

Version 1.21 · Effective November 3, 2026

Stabilibuddy holds a record of your mental health. This page says plainly what we collect, where it goes, and what you can do about it.

1. Who we are

Stabilibuddy is operated by ChillyPixel LLC. We decide how the data described here is handled, and we are the people to contact about it: privacy@chillypixel.com.

2. What we collect

• Your account. Email address, a display name if you set one, a one-way hash of your password, your time zone, and your reminder settings. If you turn on reminder notifications, also the address your browser's notification service gave that device, and the keys that encrypt a notification to it.
• What you log. Mood and symptom ratings, notes you type, sleep, menstrual cycle if you track it, and the medications you record along with doses and whether you took them.
• What you import. If you bring a history over from eMoods or Bearable, the entries in it become part of your record. The eMoods web import additionally takes your eMoods username and password, which we use to sign in to your eMoods account on your behalf and fetch that history — see section 5.
• What the app produces. Generated summaries, saved forecasts and sleep insights derived from the above.
• Your answer to “Was this forecast helpful?”, if you give one. We keep it with the forecast it is about, and it is deleted when you delete that forecast.
• Operational diagnostics. Timings, errors, which pages were requested, and your account identifier (or, where no account can be identified, a scrambled code of the address involved, described below), so we can tell when the application is broken and for whom. These are meant to record that something happened rather than what you recorded. Where our own diagnostics refer to a symptom or medication you added, they use a scrambled code in place of the name. While our key stays the same, the same name gets the same code, so we can follow one problem across records; when we change the key, the codes change. Without our secret key the code cannot be turned back into the name; with it, we can match a code to a name we test it against, including the names in your account, which is how we investigate a problem you report. Our own diagnostics do not write down your email address or your IP address either. Where nothing else identifies the attempt (an address typed into the registration, verification or password reset form, or the network address behind repeated attempts we limit), they record the same kind of scrambled code in its place, which we can match against an address we test it against. A filter also removes the fields we know carry your entries. We will not claim more than that: an error passed on from the database or another component can repeat a name or an address in its own words, and these protections cover the ways of writing a diagnostic we know about rather than every line ever written. Treat a diagnostic as something that may contain a fragment of what you logged.
• A bug report, if you send one. Only when you choose to. We keep exactly what you wrote, linked to your account, and we read it with the help of AI tools (Anthropic's Claude). Nothing removes names or contact details from it, so please leave out names, email addresses, phone numbers and street addresses, yours or anyone else's.

Registration asks for an optional display name — whatever you want to be called, and you can leave it blank. Beyond that we do not ask for your legal name, your address, your date of birth, or any government identifier, and there is nowhere in the application to enter them.

3. Where it is stored

Your account and everything you log are stored in an Azure SQL database in Microsoft's Central US region, encrypted at rest, with backup copies in its East US 2 region. The application runs in the United States. We do not store your data outside the United States.

That is about where your data is kept, not about where it is processed. Asking for a forecast sends part of your record to an AI service that may handle the request in any region Microsoft runs it in — section 6 describes that. A bug report you send is read with the help of Anthropic's Claude, and we have not established where Anthropic processes it. A reminder notification, if you turn those on, passes through your browser's notification service, described in section 5.

4. How we use it

To run the service for you: to show your record back to you, generate the summaries you ask for, send you the account email you have asked for, and keep the application working. And to learn whether forecasts are helping, by reading the answers to “Was this forecast helpful?” across everyone who gives them. We do not use your data for anything else.

5. Who else receives it

Everything below is a service we use to run Stabilibuddy. Apart from Anthropic and the notification services, described next, none of them receives your data to use for their own commercial purposes — none of them may sell it, advertise from it, or build a profile of you. Among them there is one exception to "only for us", and it is section 6's: Microsoft stores what we send to Azure OpenAI in order to detect misuse of that service, which is Microsoft's purpose rather than ours.

Anthropic is different. We read bug reports with the help of its Claude under Anthropic's own consumer terms, not a contract with us, so Anthropic handles a report under those terms. It does not train its models on it, it keeps it for up to 30 days (up to two years if its automated safety systems flag it), and it says it does not sell personal data. That is why the box you tick to send a report names Anthropic.

So is your browser's notification service. If you turn on reminder notifications, each reminder goes through the service your browser uses for them: Google's for Chrome and most Android browsers, Apple's for Safari, Mozilla's for Firefox, Microsoft's for Edge. Your browser chooses it, not us, and it works under its own terms rather than a contract with us. It learns that the device receives notifications from Stabilibuddy, and when. The message is encrypted so that only your device can read it, and it says only “Time to log”. We have not established where these services process it. Notifications are off unless you turn them on, and reminders by email do not go through them.

And any person you have granted access to. If you have given a clinician or someone you trust read-only access to your record, they see what you logged. That only happens because you set it up, and you can withdraw it at any time — see section 9.

We may also disclose data if the law requires it of us. If that ever happens and we are permitted to tell you, we will.

6. How the AI summaries are generated

This is the largest transfer of your health data to anyone outside us, so it is worth describing exactly. It is not the only one — section 5 lists every service that receives your data, including the person you have granted access to if you have granted any, and section 2 describes the diagnostics that may carry a fragment of it.

Two features use an AI model, and both send to the same service: Microsoft's Azure OpenAI Service. Generating a forecast sends a description of what you logged — dated symptom ratings and custom symptoms, the medications you recorded with their doses and whether you took them, the routines you take your scheduled medications with (their names and usual times), sleep figures, and, if you have chosen to include them, your notes — together with figures calculated across your whole history (a simulation or backtest uses only the period it replays), such as the average of each rating over every day you recorded it. Those figures include psychotic symptoms, which is not among the dated ratings but is summarised this way. Generating a sleep insight sends your 30 most recent logged days one by one — every rating you logged, psychotic symptoms included, your custom symptoms, sleep, therapy, and each medication with whether you took it and, if you did, the dose — together with three of the figures a forecast calculates across your whole history (the average of each rating, your medication figures and your custom-symptom figures), how your sleep relates to your medications, your anxiety and elevated-mood levels and the day of the week, and, if you have chosen to include them, your notes, each with its date.

We do not add your email address, your name or your account identifier to what we send, in either case. That describes what we attach, and it is not a promise those details can never reach Microsoft: the names you give custom symptoms, medications and medication routines are sent as free text, and so are your notes if you have chosen to include them. We do not remove or reword anything in them — so if you type a name or an email address into any of them, yours or anyone else's, it goes too. The model returns the summary, and we store it in your account.

The request itself says what this app is for. Every forecast asks for an assessment of the period ahead, and that request instructs the model to read your record as a specialist in bipolar disorder would, looking for early warning signs of manic or depressive episodes. We do not send a diagnosis as a field — there is nowhere in the app to enter one — but we will not pretend the distinction protects you: anyone reading that request would take it as being about a person with bipolar disorder. If you are weighing what leaves this app, weigh that first. It is a larger disclosure than any mood score.

Your notes are sent only if you turn on Include my notes in AI forecasts and sleep insights in Settings, and it is off unless you do. When it is on, every note you have written goes with each forecast and each sleep insight, from your whole history and not just recent days (a simulation or backtest uses only the period it replays). We do not pick some notes over others, and we do not shorten them: however long a note is, all of it goes. So with the setting on, a note you wrote years ago is sent, and so is a note about being in crisis. We would rather you knew that than found it out. With it off, no note is sent, and nothing worked out from your notes is sent either.

We do not promise where this processing happens. Microsoft runs these models across its regions, and a request may be handled in any of them.

One click is not one transmission. A forecast is assembled from several requests, and features that run a forecast repeatedly — a simulation, or a backtest sweep — send your record again for each run. A single action on your part can mean many transmissions.

Each forecast request is answered directly, on the connection that asked for it. We ask for the result not to be kept in the service's stored-responses area. We have not established what Microsoft does with the result once it is complete, and we ask for it to be deleted only when we pass a deletion request on (section 8). That is separate from the abuse-monitoring store described next, which we cannot opt out of today.

Microsoft states that prompts and responses sent to this service are not available to OpenAI and are not used to train its models.

Microsoft also stores prompts and responses in order to detect misuse of the service, and we have not been granted an exemption from that. What Microsoft's documentation states: the store is held in the same geography as the service and separated by customer; review is automated first, and content reviewed that way is not stored by the abuse-monitoring system or used to train models; a person can read content only once it has already been flagged, through controlled workstations with time-limited approval granted by a manager.

Two things it does not state, which we are not going to fill in for it: how long anything is kept, and whether every prompt enters that store or only the ones that get flagged. Microsoft offers an exemption from this to some customers. We do not hold one. We applied on 30 September 2026 and were refused: Microsoft grants it only to customers managed by one of its account teams, and tells us it is not currently accepting applications to become one.

If you would rather this did not happen to your notes, leave Include my notes in AI forecasts and sleep insights off, which is how it starts. If you would rather it did not happen to anything you log, do not generate forecasts or sleep insights. Everything else in Stabilibuddy works without them — logging, calendars, reports and imports never reach that service — and nothing is sent to it unless you ask for one of those two summaries.

7. What we do not do

• We do not sell your data, and we never have.
• We do not share it with advertisers, and there are no advertising or analytics trackers in the application.
• We do not use it to train AI models.
• We do not take payments, so no payment processor receives anything about you.
• We do not share your record with anyone unless you set that sharing up yourself.

8. How long we keep it

We keep what you log until you delete it or delete your account — there is no automatic expiry, because a mood history is only useful over years. Three exceptions, all of which happen on their own:

• A file you upload to import a history is deleted from our servers within 48 hours of the upload, whether or not you delete anything else. The entries it contained stay in your record.
• We keep backups of the database so that it can be recovered after a failure. Something you delete stays in those backups until they are removed, up to 42 days after you delete it. A backup cannot have one person's data taken out of it.
• Operational diagnostics are deleted automatically, up to 97 days after they are recorded. They carry your account identifier or a scrambled code of your email or IP address, so they can be traced back to you. See section 2 for what they may contain.

A bug report or feature request you send is linked to your account but is not part of your record. Delete My Logged Data does not delete a bug report or feature request. Deleting your account deletes it, and so does asking us. We may also delete a report once the problem it describes has been dealt with. Anthropic keeps the text of a report Claude reads for up to 30 days, or up to two years if its automated safety systems flag it, and that copy is not ours to delete.

When you delete from Manage Your Data, or ask us to delete, we also pass your request on to the services that may still hold a copy: Microsoft, for what it keeps from Azure OpenAI (section 6), and Anthropic, when what you deleted includes a bug report or feature request. We ask each of them to delete it. We cannot do that for them, and we cannot confirm that they have.

9. What you can do

• Delete what you logged, or your whole account, from Manage Your Data. The page lists exactly what each option removes before you confirm it.
• Withdraw someone's access to your record at any time from your care team settings.
• Ask us for a copy of your data, or for a correction, or for deletion of something the controls above do not reach. Write to privacy@chillypixel.com and we will respond within 45 days.

You can download a copy of your whole record, as one file other programs can read, from Manage Your Data. The file is made when you ask for it and is not stored on our servers, and it lists what it leaves out, such as your password. For anything it does not include, email us. You can also download a PDF report of a month's data for your doctor from the monthly view.

10. Security

Data is encrypted in transit and at rest. Access to the production database is limited to the operator of ChillyPixel LLC. We are a very small operation, and we would rather you knew that than assumed a security team behind it.

11. Children

Stabilibuddy is not for anyone under 18 and we do not knowingly collect data from children. If you believe a child has an account, write to us and we will delete it.

12. Changes to this policy

If we change this policy materially we will tell you before the change takes effect. The effective date at the top tells you which version you are reading.

13. Contact

ChillyPixel LLC, privacy@chillypixel.com.

---

See also our Terms of Service and our Consumer Health Data Privacy Policy.