Skip to main content
Donate

Privacy Policy

Last updated: September 5, 2026

KeepCalm.org is a mental-wellness service, so your privacy is not a legal afterthought here; it is part of the care. This policy explains exactly what we collect for each feature, why, who processes it, and the rights you have. It is written to meet the strictest US state health-privacy standard we know of, Washington's My Health My Data Act, and to respect the GDPR and California law.

The short version

  • You can read everything on this site without an account, and we do not use advertising, ad-tech, cookies for tracking, or third-party trackers. Anywhere. Ever.
  • We keep anonymous tallies (a number goes up, that is all) and we skip even those if your browser sends Do Not Track or Global Privacy Control, or if you turn counting off on your account page.
  • We never sell personal information, and we never share it for advertising.
  • The Calm Companion is adults-only, nothing you say in a crisis is ever stored, and its optional memory is visible to you and deletable by you.

What we collect, feature by feature

Reading the library

No account, no personal data. Our measurement script keeps anonymous aggregate counts (visits, poster shares, signups) with no cookies, no identifiers, no fingerprinting, and no storage of your IP address or browser details. It honors Do Not Track and Global Privacy Control and can be switched off on your account page. Our hosting provider (Vercel) keeps standard, short-lived server logs for security and operations, and provides privacy-preserving, cookieless aggregate analytics.

Making a poster or song

The phrase you write is processed to render your poster and is screened by automated content-safety services (OpenAI's moderation service and Anthropic's Claude) before it can be shared or published; some submissions are also reviewed by a person. Published posters are public. Song audio is generated by ElevenLabs from a prompt derived from your phrase. Phrases are stored with the poster, not with your identity, unless you save the poster to a member account.

The Calm Companion (adults only)

Before it will talk with you, the Companion asks your age and your consent. Conversations are processed by Anthropic's commercial API to generate replies, under commercial terms that do not use your conversations to train models. Crisis-related messages are answered with a fixed, safe response that points to verified help, and nothing you say in a crisis is ever stored; we keep only an anonymous monthly count of crisis referrals, as some state laws require. Memory is opt-in, small, shown to you in full, deletable by you, and never contains transcripts or health details.

Calm Places

Calm Places works from a rounded location, never an exact one. Your device's own location is used only when you tap the near me button, and your browser rounds it to a square about 5.5 km across before the request leaves your device; our server rounds it again on arrival, and distances are worked out on your device, which already knows where it is. We pass that rounded square to the OpenStreetMap Overpass API (overpass-api.de and overpass.openstreetmap.fr), which lists the places, and to Google's Places service, which supplies ratings, photos and opening details for them. If you type a place name instead, we look it up through OpenStreetMap's Nominatim service. Nothing about these requests is logged or stored against you, and the ratings you leave are whole-number counts on a place, not a record of your visit.

Buying from the shop

Orders are placed through our Shopify checkout, which takes the payment; we never see or store full card numbers. Our print-on-demand partner (Printify and its print providers) receives what any shipper must: your name, shipping address, email, and the items ordered. On our own servers we keep only order counts and amounts for the accounting, never your name, address or email.

Donating

Donations and memberships run through Givebutter. Givebutter processes your payment and gives us your name, email, and donation amount so we can thank you and issue receipts.

About-you details you choose to share

When you create an account we offer one short, skippable set of optional questions: your country, your state or region and city, your age range, your gender, your ethnicity, what your life looks like right now (for example parenting, caregiving, studying, working, or retired), and the music you like. Every question is optional, nothing is pre-selected, and "Prefer not to say" is always there. We use what you share to personalize what we show and suggest on the site, and to choose the wording and the photographs in the email we send you, so what you see reflects the life you actually live. Gender and ethnicity are special categories of personal data: we ask for them only for that purpose, we keep them private to your account, we never display them on a public profile, we never sell them, and we never hand them to advertisers or to anyone else. We also count these answers in the aggregate, coarsely and with no names attached, so we can understand who our members are and report honestly to funders. You can see, change, or clear every one of these answers on your account page at any time, and deleting your account deletes them with it.

Email updates and accounts

If you subscribe to updates, we keep the email address or mobile number you give us, your first name if you add it, the page you signed up from, and a record of the consent wording you saw and when. Updates go out through Klaviyo, our mailing-list provider; texts are sent only with your express written consent, and replying STOP ends them. If you create an account, we keep your email address, a salted hash of your password (never the password itself), and the date and version of the terms you accepted, and we use them to sign you in, send what you asked for, and send receipts. Sign-in links and receipts go through Resend, our transactional email provider. Every email includes a way out, and you can delete your account whenever you like.

Writing to us

The contact form asks for an email address, because it is the only way we can reply, plus an optional name and subject. What you write passes the same automated safety screen as everything else written on this site and is then emailed to our inbox through Resend; nothing about your message is stored on our servers, and we do not add you to any list. A person reads the inbox and replies by email. The form is not a crisis service and nobody watches it around the clock; the get help page lists free lines that are. To stop abuse, our forms keep a short-lived count of submissions per network address that expires within a day and is not linked to what you sent.

Consumer health data

This section is our notice under Washington's My Health My Data Act and similar health-privacy laws, and we apply it to everyone, not just Washington residents.

Using a mental-wellness service can itself reveal something sensitive about you. We treat the fact that you use KeepCalm.org's wellness features, anything you tell the Calm Companion, and any crisis-related interaction as consumer health data. We collect only what the feature you chose needs in order to work, as described above, and we use it only to provide that feature.

  • We do not sell consumer health data, and no one may buy it from us.
  • We do not share it for advertising, and we run no ad-tech anywhere on the service.
  • We do not use it to build profiles of you.
  • Processors listed in this policy handle it only on our instructions.
  • There is no tracking near our crisis resources, and crisis conversations are never stored.

You may ask us to confirm what consumer health data we hold about you, ask for a copy, withdraw consent, or have it deleted, and we will honor deletion requests including in backups as they cycle. Email Contact@KeepCalm.org. If we decline a request, you may appeal by replying to our decision, and we will have someone who was not involved in the original decision review it. You will never be treated worse for exercising a privacy right.

Who processes data for us

We share personal data only with service providers acting on our instructions, and only what each needs: Vercel (hosting, file storage, and cookieless aggregate analytics), Upstash (the database behind accounts, sessions and counters, provisioned through Vercel), OpenAI (automated content-safety screening of submitted phrases), Anthropic (content-safety review and the Calm Companion), ElevenLabs (song generation), Shopify (shop checkout and payment), Printify (printing and shipping products), Givebutter (donations and memberships), Klaviyo (the email and text updates you subscribe to), Resend (sign-in, receipt and contact email), Google (ratings, photos and opening details for Calm Places; it receives only a rounded location square), OpenStreetMap's Nominatim (place names you type into Calm Places) and the OpenStreetMap Overpass API servers overpass-api.de and overpass.openstreetmap.fr (the rounded square Calm Places sends to list nearby places). We would also disclose information if the law genuinely required it, and we would tell you unless legally forbidden. We never sell personal information.

If you are in the European Union or UK

We process personal data to perform the service you ask for (Article 6(1)(b)), with your consent where we ask for it (Article 6(1)(a)), and for our legitimate interest in keeping a free nonprofit service safe and running (Article 6(1)(f)). Where anything you share reveals information about your health or mental wellbeing, we rely on your explicit consent (Article 9(2)(a)), which you may withdraw at any time. You have the rights of access, rectification, erasure, restriction, portability, and objection, and the right to complain to your data-protection authority. Data is processed in the United States by the providers named above; where required, transfers rest on standard contractual clauses or an adequacy framework. Contact for all of it: Contact@KeepCalm.org.

If you are in California

As a nonprofit, KEEP CALM INC is generally outside the CCPA, but we honor its spirit for everyone: we will tell you what we hold about you, delete it on request, and we do not sell or share personal information as the CCPA defines those terms. We also honor Global Privacy Control signals.

Children

The site is a general-audience library and is not directed to children under 13. Reading requires no account and no personal information. Where a signed-in member can volunteer something about themselves, such as the questions shown while a song is being made, we ask only for things that cannot reveal an age: the birthday question takes a month and a day and never a year. The Calm Companion is for adults 18 and over; if it learns a user is a minor, it locks and purges. If you believe a child has given us personal information, email us and we will delete it.

Things you tell us on purpose

While your song is being made we show a mix of facts, small games and light questions, such as a favorite color, the music you reach for, or when your birthday is. Answering is entirely optional: every question has a Skip, and skipping records no answer. We do keep a list of which facts, questions and games you have already been shown, so that nothing repeats; it holds only which items appeared, never a response, and it is erased along with everything else when you ask. We keep only what you volunteer, together with the date you gave it, which you can see beside every answer in your account. We use all of it for one thing, making KEEP CALM feel like it knows you: songs suggested to your taste, and a card on your birthday rather than a generic newsletter.

We never ask for your year of birth. The birthday question records a month and a day only, which is enough to celebrate you and not enough to tell us how old you are. We do not sell this, share it, or use it to advertise to you.

You can see exactly what you have shared, question by question, in your account under Things you have shared, and erase all of it with one button. Erasing is immediate and needs no email to us.

Keeping data, and keeping it safe

We keep personal data only as long as the feature needs it: account and subscription data until you delete it, order and donation records as long as tax and accounting law requires, Companion memory until you delete it or it expires after about a year of inactivity, and anonymous tallies indefinitely because they identify no one. Everything moves over encrypted connections, access is limited to those who need it, and if a breach ever put you at risk we would notify you and regulators as the law requires.

Changes and contact

If we change this policy in a way that matters, we will update the date above and note the change here before it takes effect; where a new use of consumer health data would need fresh consent, we will ask first. Privacy questions, requests, and appeals: Contact@KeepCalm.org, or write to KEEP CALM INC, Attn: Privacy.

Change on September 5, 2026: we named every processor the site actually uses, including Klaviyo, Shopify, Upstash, Google, Nominatim and the Overpass API, corrected where the counting switch lives, and added sections for writing to us and for Calm Places. This edit describes what the site already did; it adds no new collection.

Keep Calm offers free educational self-help tools. This is not medical advice, diagnosis, or therapy, and it is not a substitute for professional care.