Privacy Policy

Effective date: August 7, 2026
Operated by: Happiness Global Inc. | support@meetstoa.com

Stoa is an AI relationship guide designed to help you reflect on and navigate your personal relationships. Because Stoa works by understanding context about your life and relationships, it necessarily processes personal and sometimes sensitive information. We take that responsibility seriously.

This Privacy Policy explains what data we collect, why we collect it, who we share it with, and the rights you have over it. We have written it to be as plain and specific as possible, because we believe you deserve to know exactly what happens to your information.

1. Who We Are

Stoa is operated by Happiness Global Inc., a Delaware C-corporation. For the purposes of EU data protection law, Happiness Global Inc. is the data controller. If you have questions or requests relating to this policy, please contact us at:

Happiness Global Inc.
support@meetstoa.com

2. What Information We Collect

2.1 Account Information

When you create an account, we collect:

Your email address and display name
Your preferred name, as set during onboarding
Your birth month and year, which is converted to an age range and stored in your memory profile
Your Google name and email address if you sign in with Google Sign-In

2.2 Conversation Content

We store the full text of every message you send to Stoa and every response Stoa sends to you. These transcripts are retained according to your chosen retention setting (see Section 6). In addition, we generate and store the following metadata for each conversation:

A short title and summary
Hashtags categorising the conversation topic
A structured “Stoa Take” where relevant (a brief analysis of the relational situation you described)
Your feedback rating (nope / meh / yes), if you provide one

2.3 Memory Data (Persists Across Conversations)

This is one of the most important things to understand about Stoa. After each conversation, our system automatically extracts information that may be relevant to future conversations. This includes:

Personal details you share (e.g. your age, life stage, location)
Information about people in your life: their names, your relationship to them, notable events, and relational dynamics
Themes and concerns you return to across conversations
Values and patterns in how you approach relationships

This extracted data is consolidated into a memory summary that is included in the context of every future conversation, so Stoa remembers what you've shared.

Important: Memory data persists even if you delete a conversation or set a short retention period. Deleting a conversation removes the transcript, but not the memories extracted from it. You can delete all memory data by deleting your account entirely (see Section 6).

2.4 Usage and Technical Data

We collect limited technical and usage data, including:

Monthly token usage (an estimate of how much processing your conversations require)
Analytics metadata such as model used, response latency, and session events (via our analytics provider). This does not include conversation content.
Session cookies and a JWT token used to keep you logged in
Your selected AI model preference, stored locally in your browser

We also enforce a burst rate limit of 8 messages per 60 seconds to ensure fair access for all users.

2.5 Information You Provide About Others

Stoa is a relationship guide, so you will naturally share information about other people — partners, friends, family members, colleagues. We process this information solely to provide the service to you. We do not use it to build profiles on third parties, and we do not share it with anyone except as described in Section 4.

2.6 Payment and Subscription Data

Payment processor customer ID and subscription ID (identifiers linking your account to our payment processor's system)
Subscription status (trialing, active, cancelled, past due)
Trial end date and billing period dates
Card details are collected and processed directly by our payment processor — we never receive or store your full card number, CVV, or bank details
Notification dismissal records (tracking which account alerts you have seen)

2.7 Voice Notes

You can send a message to Stoa by recording a voice note instead of typing. When you do, your device records audio and sends it to us to be transcribed into text. Stoa then reads the text, exactly as if you had typed it — it does not hear your voice.

The transcript becomes part of your conversation and is treated like any other message: it is stored, used to generate memory, and retained according to your retention setting (see Section 6).

The recording itself is handled separately:

It is sent to a third-party speech-to-text provider to be transcribed (see Section 4). They do not retain it or use it to train their models.
If your conversation retention setting is “Keep my conversations”, we also store the recording ourselves, privately, for up to 7 days. Human review can occur to evaluate transcription accuracy. If you have chosen any other retention setting, we do not keep the recording at all.

We never use your voice to train AI models, and we do not use it to identify you. Recordings are stored in private storage that is not publicly accessible, are deleted when you delete your account or your conversations, and are otherwise deleted after 7 days.

3. Why We Process Your Data

We rely on the following legal bases under GDPR. California residents: see Section 8.2 for CCPA/CPRA rights.

Contractual necessity (Art. 6(1)(b) GDPR) — processing required to provide the service:

Creating and managing your account
Delivering AI-generated responses to your messages
Storing and enforcing your retention preferences

Legitimate interests (Art. 6(1)(f) GDPR) — our legitimate interest in improving and operating the service:

Generating conversation titles, summaries, and hashtags
Monitoring token usage to prevent abuse
Analysing aggregate, anonymised usage patterns via our analytics provider

Consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR) — for sensitive data processing:

Building and maintaining your memory profile, which may include sensitive personal information about your relationships, emotional wellbeing, and life circumstances
Sending marketing emails via our email provider, if you opt in during onboarding

4. Who We Share Your Data With

We do not sell your personal data. We do not share it with advertisers. The following third parties process your data on our behalf as data processors:

AI model providers — your conversation transcripts and memory summary are sent to third-party AI providers to generate Stoa's responses, and to produce conversation titles, summaries, hashtags and memory data. They process this data under data processing agreements and do not use it to train their models.
Speech-to-text providers — if you send a voice note, the recording is sent to a third-party provider to be converted into text. They do not retain the audio or use it to train their models.
Hosting, database and storage providers — your account information, conversations and memory data are stored with our infrastructure providers, who have access to the data we store with them. Data is hosted in the United States.
Analytics providers — we send product analytics metadata only: model identifiers, response latency, event types and session identifiers. We do not send conversation content. Once sent, these events cannot be deleted on a per-user basis; we mention it because it affects your right to erasure (see Section 8).
Email providers — if you opt in to email communications, your email address and display name are synced to our email provider for product updates and announcements, and you can unsubscribe from any email. Transactional service emails (subscription confirmation, payment failure alerts, cancellation confirmation, trial expiry notices) are sent regardless of marketing opt-in, as they relate to your account and billing.
Payment processors — your card details are entered directly with our payment processor and never pass through our servers. We store only their identifiers (customer ID, subscription ID) and subscription metadata (status, billing dates). They may store your payment method, transaction history and billing address under their own privacy policy.
Sign-in providers — if you sign in with Google, we receive your email address and name. We never receive or store your password.

4.1 Other Disclosures

We may disclose your data if required by law, court order, or to protect the rights, property, or safety of Happiness Global Inc., our users, or others.

5. International Data Transfers

Stoa is operated from the United States. If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, your personal data will be transferred to and processed in the United States.

We rely on Standard Contractual Clauses (SCCs) as the transfer mechanism for data sent to our US-based processors. Where our processors have their own SCCs or equivalent mechanisms, we rely on those. You may request a copy of the applicable transfer mechanisms by contacting us.

6. How Long We Keep Your Data

You control how long your conversation transcripts are retained. During onboarding (and in settings at any time), you can choose from the following options:

Keep forever — conversations are retained indefinitely
30 days — conversations older than 30 days are automatically deleted
7 days — conversations older than 7 days are automatically deleted
Ephemeral (12 hours) — conversations are deleted approximately 12 hours after they end

These settings govern conversation transcripts and AI-generated metadata (titles, summaries, takes). They do not affect memory data.

Voice note recordings: if your setting is “Keep my conversations”, recordings are stored for a maximum of 7 days and then deleted automatically, regardless of how long the conversation itself is kept. On every other setting, recordings are not stored at all. Deleting your account, or deleting your conversations, deletes the recordings too. The transcript is kept for as long as the conversation is.

Memory retention: Memory data (your extracted profile and per-person relationship summaries) is retained until you delete your account. This means memory persists even if you choose a short transcript retention window. To delete memory data, you must delete your account.

Account data (email, name, preferences) is retained for as long as your account exists. Subscription and billing metadata (payment processor identifiers, status, dates) and notification dismissal records are retained while your account exists. Upon account deletion, we delete all account data, conversations, messages, memory logs, memory summaries, token usage records, subscription data, and notification records. Deleting your account will also immediately cancel any active subscription. Our payment processor retains its own records (invoices, transaction history) per their data retention policy.

Limitations: Analytics events associated with deleted conversations cannot be retroactively deleted from our analytics provider's system.

7. AI Nature and Memory Disclosure

Stoa is an AI-powered application. You are interacting with an AI, not a human. Stoa is not a licensed therapist, counsellor, or mental health professional. Please see our Terms of Service for important disclaimers about the nature and limitations of Stoa's responses.

During onboarding, we indicate that Stoa will remember information from your conversations even if you delete transcripts — specifically, who is in your life and the stories you share. This is intended to save you from having to re-explain context in every conversation.

8. Your Rights

Depending on where you live, you have the following rights over your personal data. To exercise any of these rights, contact us at support@meetstoa.com. We will respond within 30 days (GDPR) or 45 days (CCPA/CPRA).

8.1 Rights Under GDPR (EEA / UK Users)

Access: You have the right to receive a copy of the personal data we hold about you, including your memory profile.
Rectification: You can ask us to correct inaccurate data.
Erasure (“right to be forgotten”): You can request deletion of your account and all associated data. Note the analytics limitation described in Section 6.
Portability: You can request your data in a machine-readable format.
Restriction: You can ask us to limit processing of your data in certain circumstances.
Objection: You can object to processing based on legitimate interests.
Withdraw consent: Where processing is based on consent, you may withdraw at any time without affecting the lawfulness of prior processing.
Lodge a complaint: You have the right to complain to your local data protection authority.

8.2 Rights Under CCPA / CPRA (California Residents)

Right to know: You can request disclosure of the categories and specific pieces of personal information we have collected about you.
Right to delete: You can request deletion of your personal information, subject to certain exceptions.
Right to correct: You can ask us to correct inaccurate personal information.
Right to opt out of sale or sharing: We do not sell or share personal information for cross-context behavioural advertising.
Right to limit use of sensitive personal information: Your conversation content is used only to provide the service to you.
Right to opt out of automated decision-making: You may request that we not use automated processing in ways that produce legal or similarly significant effects.
Non-discrimination: We will not discriminate against you for exercising your privacy rights.

9. Cookies and Local Storage

Stoa uses the following cookies and browser storage:

Session cookie (NextAuth JWT): Contains your user ID, email, account type, and name. Required for authentication. Duration: 30 days.
localStorage (model preference): Stores your selected AI model locally on your device only; not transmitted to our servers.

Our analytics provider also sets its own cookies. These do not contain conversation content.

10. Security

We implement the following security measures:

Encryption in transit: All data is transmitted over HTTPS/TLS.
Encryption at rest: Data we store is encrypted at rest.
Password hashing: Passwords are hashed using an industry-standard algorithm before storage. We never store plaintext passwords.
Access controls: Access to production systems is restricted to authorised personnel.

No method of transmission or storage is 100% secure. In the event of a personal data breach, we will notify affected users and relevant supervisory authorities within 72 hours where required by GDPR or applicable law.

11. Children's Privacy

Stoa is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you are between 13 and 17, please review this policy with a parent or guardian before using Stoa.

If you believe we have inadvertently collected data from a child under 13, please contact us immediately at support@meetstoa.com and we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the effective date at the top of this page and, for material changes, notify you by email or by a prominent notice within the app.

13. Contact Us

Happiness Global Inc.
support@meetstoa.com

If you are in the EEA and believe your rights have not been addressed, you may also contact your local data protection authority. A list of EEA supervisory authorities is available at edpb.europa.eu.