Privacy Policy

Last updated: August 2026

This explains what Mulch collects, why, and what happens to it. The short version: we collect what's needed to run the app and understand how it's used, we don't sell your data or use it for advertising, and you should never enter real client-identifying information in the first place — see our Terms of Service for why that matters.

What we collect
What we don't collect
How we use it
Third parties
Data retention
Security
Your rights
Children's privacy
Changes to this policy
Contact

1. What we collect

Category	What, and why
Account info	Username/email and a hashed password (never stored in plain text), so you can log in.
Conversation content	What you type or dictate into a note or reflection, sent to our AI provider (Anthropic) to generate a response.
Usage metadata	Timestamps, which feature was used, token counts, and estimated cost per request — used to understand usage and, eventually, for billing.
Support/feedback	Anything you submit through the in-app Support button.
Basic analytics	Google Analytics, to see which parts of the app get used. Not used for ad targeting.

2. What we don't collect

Mulch is not built to receive protected health information (PHI), and you should never enter real client names, birthdates, or other identifying details — see Section 3 of our Terms of Service. We don't run behavioral advertising, don't build ad-targeting profiles, and don't sell your data to third parties.

3. How we use it

To provide the service itself — generating notes and reflection summaries via our AI provider
To understand feature usage and reliability (usage metadata, basic analytics)
To estimate costs and, eventually, determine billing
To respond to support requests and account issues

4. Third parties we share data with

Who	What they get, and why
Anthropic (Claude API)	Conversation content, to generate note/reflection drafts.
Hostinger	Our hosting provider — everything the app stores lives on their infrastructure.
Our email provider	Account/notification emails (invites, beta signups, support replies) route through our SMTP provider.
Google Analytics	Basic, aggregate usage analytics — not used for advertising.

We don't sell data to anyone, and we don't share it beyond what's needed to run the service.

5. Data retention

Note conversations are ephemeral by design — once you start a new note or clear the current one, the underlying conversation is permanently deleted, not just hidden. Nothing lingers beyond what you choose to save.
Saved reflections persist in your Clinician Profile, even after the note conversation they came from is gone, until you delete them or close your account.
Growth Reflections conversations persist across sessions — that's the point, since they're about noticing patterns over time — until you delete your account.
Usage metadata is retained for product and billing analysis.
Deleting your account removes your conversations, profile, and reflections.

6. Security

Passwords are hashed and never stored in plain text. We take reasonable measures to protect your data, but no online service can guarantee complete security — please don't rely on Mulch to store anything you couldn't afford to have exposed, which is part of why real client-identifying information should never be entered in the first place.

7. Your rights

You can request a copy of your data or request that your account and associated data be deleted at any time by contacting us (see below).

8. Children's privacy

Mulch is intended for use by licensed and trainee behavioral health professionals. It is not directed at, and should not be used by, anyone under 18.

9. Changes to this policy

We may update this policy as the product evolves. Changes will be posted on this page with an updated date.

10. Contact

Questions about this policy, or a data request? Reach out at info@mulchpractice.com.