Privacy Policy

What this page covers

This policy covers getsocialreps.app: the website and the Social Reps app at /app. The app is live in an early testing period, and everything it collects is described below. This page will be reviewed by a lawyer and rewritten where needed before the app is promoted.

What this website collects

The marketing pages of this site are static. They have no forms and store nothing you type. The app, described in the next section, is different: it has accounts.

The marketing pages set no cookies. The app sets exactly one, and only when you log in or create an account: a sign-in cookie (sr_session) that keeps you logged in. It is not used for anything else. Nothing here embeds advertising pixels, social-media trackers, or any third-party script other than typefaces loaded directly from Google Fonts and Cloudflare's cookieless analytics script, described under Analytics below.

Accounts and saved reps (the app)

The Social Reps app at getsocialreps.app/app lets you create an account so your practice reps are saved. This section describes exactly what that stores. Until you create an account you can play as a guest: guest reps are saved in your own browser and are imported into your account if you make one. During the current testing period, guest conversations are also sent to us and stored under a random per-browser id with no name, email, or key attached, so we can read what is working. That is stated in the app itself. It will stop, and this sentence will go, when testing ends.

Deleting as a guest reaches our copy too. When a guest deletes a conversation from the Progress screen, our testing-period copy of it is deleted as well: the conversation is removed and its score stays, the same as for an account. Wipe all progress deletes everything that browser has sent us, including reps that were never finished. If our server can't be reached at that moment, the delete is saved in your browser and sent again the next time you open the app. If you clear your browser's data before then, that saved delete is lost with it, and the copy is removed by the 90-day clean-up described under Retention.

What an account holds: your email address; a salted hash of your password (never the password itself); your three practice settings; a session token so you stay signed in; a record that you confirmed you are 18 or over, and when (see Age below); and, for each rep you save, the transcript of that practice conversation, its six scores, the two annotated moments, and when it happened.

What it never holds: your date of birth, and your AI provider key. The date you enter at sign-up is checked once and not stored. The key stays in your own browser and calls the provider directly. Our server never sees it, never stores it, and never uses it, so it cannot be leaked from us, exported from us, or deleted from us because it was never there. A breach of our servers would not expose a single key.

We do read transcripts. Saved conversations are stored with your account and we, the people who build Social Reps, read them to see what is working: which scenarios land, where the AI partner behaves badly, where the scoring is unfair, what people actually type. That review is how the app improves. It is done by us, not by a third party; nothing is shared, sold, or used for advertising; and there is no feed, no profiles, and no way for another user to see your reps. If you would rather a conversation not be kept, delete it from the Progress screen: the transcript is removed and the score stays. The score itself is produced by the AI provider you chose, from your own browser.

Your data, your call: from the Progress screen you can delete any single conversation and keep its score, or wipe all progress (every rep, every score, your streak; password required). From the Account screen you can download everything we hold about you as one JSON file, and you can delete your account. Deletion is permanent and immediate: the account, the settings, and every saved rep are removed in a single operation. It asks for your password first, so a stolen session cookie alone cannot wipe an account. There is no soft-delete and no retention window. One caveat, stated plainly: Cloudflare's database keeps an automatic point-in-time history for disaster recovery, so deleted data can remain recoverable there for up to 30 days before it ages out.

Retention: account data is kept for as long as the account exists. Sign-in sessions expire after thirty days of inactivity. Guest conversations recorded during the testing period are deleted automatically once they are 90 days old (a daily clean-up runs on our server); if you later create an account and then delete it, the guest conversations from that browser are deleted with it.

Where it lives: in a database run on Cloudflare's infrastructure, the same provider that hosts this site. Cloudflare processes it on our behalf and does not use it for anything else.

What is not here yet: password reset. If you forget your password today there is no automated way back in; contact reps@getsocialreps.app. This will be added before the app is promoted.

The AI, and who else sees your conversations

Every reply from an AI practice partner, and every score, is generated by an AI model; no human writes them. The one exception is the scripted scenes (Play a scene, no key needed): their lines and endings are written in advance, and no AI runs there. There is a fuller explanation at How the AI works.

The model is run by a third party, and your practice conversations are sent to it. You choose which one when you set up the app, and you supply your own API key for it:

• Groq (the default) — see groq.com/privacy-policy
• Anthropic — see anthropic.com/legal/privacy

Those requests go straight from your browser to the provider you picked, using your key. They do not pass through our server, and we never see your key. What that means in practice: your conversation text is handled by that provider under their privacy policy and your account with them, and the copies we keep are the ones described on this page: the transcript saved to your own Social Reps account and, during the testing period, the practice conversations we record to see what is working.

Everyone who touches data here, in full: Cloudflare hosts this site, runs the database that stores accounts, saved reps, testing-period guest conversations and error reports, and provides the cookieless analytics described below. Google Fonts serves the typefaces. Groq or Anthropic, whichever you choose, processes your practice conversations. There is nobody else. No advertising networks, no data brokers, no tracking pixels, and nothing is sold or shared for marketing.

Age

Social Reps is for people aged 18 and over. Before the AI part of the app, it asks for your date of birth. That check happens in your browser; the date is not sent to us, and the browser keeps only a note that the check was passed. When you create an account, the date is sent once so our server can check it too, and then discarded: the account records only that you confirmed you are 18 or over, when, and how. If the date shows you are under 18, no account is created and nothing you entered is kept.

Error reports

When something breaks in the app (most often, the AI replying in a form the app cannot read), the app sends us a short error report so we can fix it without you having to report it. A report holds: an error code, up to 500 characters of what went wrong, which is usually the AI partner's reply and so can include words from your practice conversation, the AI model name, the app screen, the scenario, the turn number, the time, and your browser's user-agent string (browser and operating system version). It holds no name, no email, no account id, and never your key: anything shaped like a provider key is removed in your browser before the report is sent, and again on our server. Reports are deleted after 90 days. The last 50 are also kept in your own browser.

If a conversation turns serious

The app watches for messages that suggest self-harm or a crisis. If one appears, it is not sent to the AI at all — the practice conversation stops and the app shows real crisis resources instead, including 988 in the US. Social Reps is practice for ordinary conversations. It is not therapy, not crisis support, and not equipped to help with that. The resources are also always available at If you're struggling.

Analytics

This site uses Cloudflare Web Analytics to count how many people visit and which pages they read. It was switched on on 16 September 2026.

It is cookieless. It does not set a cookie, does not write to your browser's storage, does not assign you an identifier, and cannot follow you to any other website. Cloudflare states that it does not track individual visitors.

What it records, in aggregate: the page visited, the referring site if there was one, an approximate country, and general browser, operating system and device type. It does not record your IP address in the analytics data, your name, your email address, or anything you type.

Why it is here, stated plainly: to know whether anyone is reading this, and in time to be able to show an accurate visitor count to a potential advertiser. Those numbers are counts of visits, never profiles of people, and there is nothing here to sell or share about you as an individual.

The analytics set no cookie. The only cookie anywhere on this site is the sign-in cookie described above, which exists only to keep you logged in, so this site does not show a cookie-consent banner. If that changes, the banner appears and this policy changes with it, on the same day.

No mailing list

Apart from any email you choose to send us, which sits in our inbox like any other email, the only email address we hold is the one you sign up with, and it is used only to log you in (and, once password reset exists, to reset your password). Nothing here adds you to a list.

If you'd like to reach us for another reason, see Contact below.

Hosting logs

This site is hosted on Cloudflare Pages. Like most web hosts, Cloudflare may keep standard technical request logs (things like IP address and timestamp) as part of running the servers and keeping them secure. We don't otherwise access, analyze, or use that data ourselves.

To stop people hammering the sign-in and save endpoints, our server counts requests per IP address and per account over short windows. It stores those counts under a one-way hash of the address or email, not the address itself, and deletes them within a day or two.

Changes to this policy

If what this site or the app does changes, this page will be rewritten to match, and the date at the top will change.

Contact

Questions about this policy: reps@getsocialreps.app.

Legal entity operating this site: to be added once formation is complete.