Privacy Policy

This Policy covers users of the Service. Spiral is not a HIPAA covered entity: we provide a consumer wellness service that you pay for directly and we do not bill health plans or conduct the electronic transactions that make a company subject to HIPAA as a covered entity. Your messages to Spiral are protected by this Policy, by federal consumer protection law (including the FTC Health Breach Notification Rule) and by state consumer health data laws, rather than by HIPAA.

In one limited part of our operations, we receive partner therapists’ identifiable session transcripts for one purpose: to de-identify them under the HIPAA standard so the de-identified transcripts (which no longer identify anyone) can be used to train and operate our AI. While transcripts are identifiable, we act as that therapist’s business associate under a signed Business Associate Agreement and use them for no other purpose. We do not use partner therapists’ identifiable transcripts to answer your messages or make them available to other users.

Your messages and any wellness-related inferences we draw from them are consumer health data under the laws of several states. We collect and process consumer health data with your consent and for the purposes described in this Policy, and where applicable law requires, we will obtain consent before collecting a new category of health data or using it for a materially new purpose. Your state-specific rights are described in Section 8 and the separate Spiral Consumer Health Data Privacy Policy provides the disclosures required by Washington law and similar statutes.

• Account data: mobile phone number, name, email address and the role or context you select at signup.
• Message content: the text conversations you have with the AI.
• Conversation memory: information the Service derives from your conversations to personalize your experience, such as facts you share, patterns and session summaries.
• Derived and inferred data: wellness-related inferences, sentiment, usage and engagement data and safety or risk flags generated from your messages.
• General location: your state and general region, derived from your phone number, network information or information you provide, used to determine service availability and comply with state law. We do not collect or track your precise location.
• Technical and SMS metadata: device and technical data and SMS delivery metadata from our carrier.
• Payment data: handled by our payment processor; we never see your full card number.

We do not share your information with third-party advertising companies and we do not use your information to build profiles for third-party advertising.

Engagement metrics (added August 30, 2026). We collect engagement metrics tied to your account, including how many messages you send, how frequently you message and which therapist persona you subscribe to. This is consumer health data. We collect it directly from your use of the Service and use it only internally for service operation, safety monitoring and account support. We never sell it and we never share it with third-party advertisers or analytics providers. You may request access to or deletion of this data at any time by emailing admin@talktospiral.com. Where the Washington My Health My Data Act applies, we honor deletion requests within the statutory timeframe and will not collect or share additional categories of consumer health data beyond those disclosed here without first updating this policy and obtaining your affirmative consent. The separate Spiral Consumer Health Data Privacy Policy has the full disclosure.

Training data. Our AI is shaped by sources that include de-identified transcripts of partner therapists’ sessions (identifying details removed under the HIPAA Safe Harbor standard before any AI system uses them), the conversations users have with the Service (which we use to operate, personalize and improve the Service and our AI models) and other materials such as information partner therapists provide about their professional approach and datasets we develop or license. Whatever the source mix, one rule is constant: identifiable therapist-session transcripts are never used to generate responses or train the AI; only their de-identified versions are.

Transcripts are de-identified through a multi-step process designed to meet the HIPAA de-identification standard: automated detection and removal of names, locations, dates and other identifiers, followed by quality-review sampling. If we learn that identifying information was not fully removed from any transcript, we promptly remove or re-process it and review the process to prevent recurrence.

We use your information to: provide, operate and personalize the Service; train, develop and improve our AI models and systems and the Service generally; remember context from your past conversations to make responses more useful; detect crisis-related messages and route you to safety resources; process payments and manage your subscription; communicate with you about the Service; secure, debug and analyze the Service; create de-identified and aggregated data; and comply with law. We do not share your personal information with third-party advertising companies and we do not sell your personal information.

AI training on your conversations is on by default. Your acceptance of the Terms of Use and this Policy is your consent to it, including wherever applicable law requires consent. Identifying details are removed first. You can turn AI training off at any time in settings, as described in the Terms of Use.

Support and troubleshooting. When you ask us for help, report a problem or when we investigate a delivery failure, a technical fault, a safety concern or suspected abuse, authorized Spiral personnel may view your account information and the content of the affected conversation in identified form, only as needed to diagnose and resolve the issue. This access is limited to personnel who need it for that purpose, is logged and is not used to train or improve the AI.

We share the minimum necessary with service providers who process data on our behalf under contract:

• SMS and telecommunications carriers: receive your phone number and message content in transit.
• AI infrastructure providers: process message content to generate responses and are contractually barred from using it to train their own models.
• Cloud hosting and database providers: store data securely.
• Payment processors: handle payment and billing.
• Email delivery providers: send Service communications.

These providers process data to deliver their services to us and their handling of that data is governed by their agreements with us and by applicable law; we do not permit them to sell your data or use your message content for their own advertising. We may also disclose data if required by law or to protect safety. These are service providers, not advertisers and this sharing is not a sale.

Separately, at your direction, we may share your information (for example, a summary of your conversations) with a person you choose, such as a therapist you want to work with. We share it only with your affirmative consent at the time and you can decline without affecting your use of the Service.

If you subscribe to a partner therapist’s AI Persona, two additional flows may make limited information available to that therapist. First, if you turn on summary sharing, your therapist can request, at any time, a short written summary of your recent conversations. The summary always covers a period of at least one week: your therapist selects how far back it looks, from the past week up to the full time since you signed up, with no daily or single-date option. It is a summary only and it never includes your individual messages. You control whether summaries can be requested at all and you can turn summary sharing off at any time in settings. If you turn it off, your therapist can no longer request a summary for any period, past or future. Any summary they have not already opened is no longer available to them. A summary your therapist already requested and viewed remains with them. We keep a record of each time you turn summary sharing on or off. Summary sharing is only available when your persona is based on a licensed partner therapist. A general Spiral persona is not based on any real therapist and no summary can be shared from it. Second, your therapist can see general usage and engagement information about the subscribers to their AI Persona, such as message volume over time, when an account was last active and how long it has been a subscriber. This is activity information only. Your therapist never sees the content of your conversations through this usage overview.

We may create de-identified data (data that can no longer reasonably identify you) and aggregated statistics from information we collect. We may use and share de-identified and aggregated data for any lawful purpose, including research, service improvement and commercial purposes. Turning off AI training in your settings does not change this: de-identified data does not identify you and is not affected by that setting. We take reasonable measures to keep de-identified data from being re-associated with you, we will not attempt to re-identify de-identified data (except to test whether our de-identification process works) and we contractually require anyone we share it with not to attempt re-identification.

We keep personal information while your account is active and as needed for the purposes above. When you delete your account or request deletion, we delete or de-identify your personal information within 30 days (and purge backups within 45 days), except where retention is required by law or permitted for security, legal compliance or internal purposes consistent with your expectations. De-identified data is not personal information and may be retained and used indefinitely, including to train and improve our AI. Washington residents’ deletion requests are honored on the timeline and scope Washington law requires.

Consent records. We keep a record of your SMS opt-in (the date, time and method of your consent) and of any opt-out, for as long as needed to honor your preferences and to demonstrate compliance with telecommunications and consumer protection requirements. We also keep a record of each time you turn summary sharing or AI training use on or off, so we can honor your current choice and show when it changed.

Depending on your state, you may have rights to know and access your data, correct it, delete it, withdraw consent, receive a list of third parties that received it and appeal a denial. We do not sell personal information or share it for cross-context behavioral advertising, so there is nothing to opt out of on that front. To exercise any right, email admin@talktospiral.com or use your in-app settings. We will verify your request, respond within the time your state requires and never discriminate against you for exercising your rights. California residents: our processing of sensitive personal information is limited to providing and improving the Service.

All data is encrypted in transit between our systems and encrypted at rest using AES-256. Access to your data is restricted through role-based access controls and row-level security and we maintain audit logging of access to sensitive data. When your conversations are processed by our AI infrastructure provider to generate responses, those requests are encrypted in transit and are not used to train that provider’s models. Standard SMS text messages are not end-to-end encrypted; this is a limitation of the SMS standard itself and by using the SMS service you acknowledge it. No system is perfectly secure, but we work continuously to protect your data.

Partner therapists provide account and professional information through the therapist dashboard (such as name, credentials, practice information, licensed states, professional focus areas and responses to onboarding questionnaires). We use that information to operate the therapist partnership, build and present the AI Persona and comply with our agreements and the law. Therapists’ personal information receives the protections of this Policy; the partnership itself is governed by the Therapist Partnership and Likeness License Agreement.

Our SMS text messaging program is called Spiral AI Companion. This section provides the disclosures required by mobile carrier guidelines and applicable telecommunications regulations.

Program name. Spiral AI Companion.

Data collected via SMS. When you use the SMS service, we collect your phone number, the content of messages you send and receive, message timestamps and delivery status information. This information is used to deliver the AI companion service, maintain conversation continuity and detect and respond to crisis situations.

How SMS data is used. Message content is processed to generate AI responses as described in this Policy. Your phone number is used solely for delivering the SMS service and is not shared with any third party except the telecommunications carriers and SMS delivery providers that transmit messages on our behalf, as described in Section 5. Your phone number and SMS data are never shared for marketing purposes or sold to any third party. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties, excluding the carriers and service providers that deliver the messages.

Opt-in. You enroll by checking the SMS consent checkbox at signup and confirming by text where prompted. Consent to receive texts is not a condition of any purchase.

Opt-out. You may opt out of the SMS program at any time by texting STOP to your Spiral number. You will receive a single confirmation message and no further messages will be sent. To re-enroll, text START. Texting STOP stops text messages but does not cancel a paid subscription; manage your subscription in your account settings.

Help. For assistance with the SMS program, text HELP to your Spiral number or contact us at admin@talktospiral.com.

Message and data rates. Message and data rates may apply depending on your mobile carrier plan. Spiral does not charge for messages, but your carrier’s standard messaging and data rates will apply.

Message frequency. Message frequency varies based on your engagement with the Service and your subscription tier. You receive messages in response to messages you send. On subscription tiers that include proactive check-ins, you may also receive periodic check-in messages, which you can turn off at any time in your account settings or by texting STOP.

Carrier liability. Mobile carriers are not liable for delayed or undelivered messages.

Supported carriers. The Spiral AI Companion SMS program is supported by all major U.S. carriers, including but not limited to AT&T, T-Mobile, Verizon and regional and smaller carriers. Carrier support is subject to change.

The Service is for adults 18 years of age and older. We do not knowingly collect data from anyone under 18. If we learn we have, we delete it.

We will post updates with a new Last Updated date and give notice of material changes; material changes will not be applied retroactively to data collected under an earlier version without your consent. Contact: admin@talktospiral.com or Time Machine Automation LLC, 3706 Butler Street, Suite 208, Pittsburgh, PA 15201.

Cross-references: Spiral Terms of Use; Spiral Consumer Health Data Privacy Policy; Spiral Website Privacy Policy; Spiral Crisis and Safety Protocol.

You can access, review and update or change your account information through our Services. If you have any questions about how to access other Personal Information, or if you would like to correct or delete any Personal Information we collect and maintain, please contact us at admin@talktospiral.com. We will accommodate requests as required by law. Otherwise, we will retain a record of your request, and your Personal Information will be maintained in accordance with this Privacy Policy and our data retention and deletion policies (“Retention Policies”).

For Residents of Washington please review our Washington Privacy Policy. For Residents of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia, ONLY: