Privacy

Last updated: October 15, 2026 · Terms of use

What is Anchor?

Anchor is a mood log. You pick a mood from 1 to 5, and you can add a note and tags. It also holds your own written plan for hard moments, and an optional "hard-time" button that shows crisis-line info.

Anchor is a personal, non-commercial project.

What does Anchor store?

It depends on the mode you pick.

"Only on this phone." Everything stays in your browser's storage on your device. Nothing is sent to a server — unless you turn on Gentle reminders (below), which shares only the time of your last check-in.

"On this phone and in your account." Your check-ins are also backed up to Anchor's database so they can sync between your devices. They're encrypted on your phone before they're sent: the server only stores a locked copy of each mood, note and tags, which it can't read.

In this mode your written plan, your tag list and your hard-time-button settings are also backed up to your account, encrypted the same way, so they come back if you reinstall or sign in on another device. Reminder and Face ID settings stay on each device.

What does the server keep if I have an account?

• Your email address.
• A scrambled value made from your password. Your phone turns your password into two different keys: one to sign in (the server stores only a scrypt hash of it), and one to unlock your check-ins, which never leaves your device.
• The key that encrypts your check-ins, in locked form. It can be unlocked with your password, your recovery key, or a passkey — all of which stay with you — and with Anchor's own recovery key, kept separately from the database and used only when you reset your password from an emailed link.
• Your sign-in sessions. Only a hashed token is kept.
• Passkey public keys, if you add a passkey (Face ID or Touch ID). The private key never leaves your device.
• Records of failed sign-in attempts and sign-up attempts, by network (IP) address. We keep these for about a day, to stop abuse.
• Your plan, tag list and hard-time-button settings, encrypted the same way as check-ins.
• Your check-ins, encrypted, if you use "On this phone and in your account." The server can see when each check-in happened and roughly how long it is, but not the mood, note or tags.

What happens if I turn on Gentle reminders?

Reminders are off unless you turn them on in Settings. When they're on, Anchor's server keeps:

• A push address for your phone, created by your phone's maker (Apple, Google, Mozilla or Microsoft), so the notification can reach you.
• The time of your last check-in on that phone, your time zone, and the settings you chose (after how many days, and from what time).
• A hashed token that lets your phone change or turn off its own reminders, and a record of reminder sign-ups by network (IP) address for about a day, to stop abuse.

It never receives your mood, notes or tags for this. The notification itself only says something gentle like "Haven't seen you in a bit" — nothing about how you've been feeling — and is delivered through your phone maker's push service. Turning reminders off deletes all of this from the server.

What happens if I connect Oura?

Connecting your Oura ring is optional and needs an account. When you connect, Oura asks you to allow Anchor to read your daily summaries (Oura's "daily" permission). Then:

• Anchor's server keeps the access keys Oura gives it, encrypted, so it can fetch your sleep when you open the Trend page.
• Your sleep data (hours slept, sleep score, efficiency) goes from Oura through Anchor's server to your device, and is kept only on your device. The server doesn't store it. Unlike your check-ins, it isn't end-to-end encrypted on the way, because the server has to fetch it from Oura for you.
• Disconnecting (Settings → Sleep from Oura), signing out, or deleting your account removes the keys from the server and the sleep data from your device. You can also remove Anchor's access in your Oura account.

Who can see my check-ins?

Not other users, and not someone who only has the database: your check-ins are encrypted on your phone before they're sent. So that a forgotten password doesn't cost you your history, Anchor also keeps a spare of your key, locked with a recovery key that lives outside the database. That means the person who runs Anchor could technically unlock your check-ins; Anchor never does this except to give your key back to you during a password reset. Anchor is not monitored and nobody responds to entries.

To be completely honest about the limits: encryption protects what's stored — someone looking at the database, or a leak of it, sees only locked data. Like every website, though, Anchor's app code comes from its server, so if that code were ever changed to copy keys, encryption couldn't stop it. If you want nothing to leave your phone at all, choose "Only on this phone."

If you forget your password, reset it from the emailed link: your check-ins come back automatically, from your phone if you reset there, or from Anchor's spare otherwise. Anyone who can read your email can do the same, so keep your email account secure. The check-ins on your phone are not affected either way.

We never sell your data or share it, except with the services that run the app (below).

Which services help run Anchor?

• Vercel hosts the app and its server functions.
• Neon hosts the Postgres database.
• Resend sends account emails.
• Oura provides your sleep data, only if you connect your ring.
• GitHub runs the hourly timer that sends reminders (it never sees any of your data).
• Your phone maker's push service (for example Apple Push Notification service) delivers reminders, if you turn them on.

Our servers are in the United States. Your data is sent over HTTPS.

Will you email me?

Only account emails: to confirm your address, or to reset your password. No marketing email.

Do you use cookies or tracking?

No ads. No analytics. No tracking scripts. The only cookie is your sign-in cookie, plus a short-lived one while you sign in with a passkey.

How do I get a copy of my data?

On the Trend page, you can export your data as a file.

How do I delete everything?

Go to Settings → Your account → Delete account. This removes your account and every check-in stored on our server, right away.

Data on your phone stays until you delete the app or the website data. If you switch to "Only on this phone," all syncing stops.

Is this for children?

Anchor isn't designed for children under 13.

Will this notice change?

If it changes in an important way, we'll update this page and the date at the top.

How do I reach you?

Email smeisum@gmail.com. Please don't send crisis messages there. Nobody can respond in time.