Privacy Policy

Effective September 29, 2026 · Last reviewed September 29, 2026 · See also the Terms of Service

1. Who we are and what this covers

Theraglee ("Theraglee," "we," "us") runs the website at theraglee.com, a library of self-guided mental health tools and a directory of licensed therapists. This Privacy Policy explains what information we collect when you use the site, why we collect it, who we share it with, and the choices you have. It applies to visitors who browse without an account, to members, and to therapists who list a practice with us.

Theraglee is designed for people in the United States and follows United States federal law and the laws of the states where our members live. Several states now give you specific rights over personal data and, separately, over health-related data. Where a state law gives you a right, we honor it for you regardless of which state you live in.

2. What we collect

We collect as little as we can while still making the tools work. What we hold depends on how you use Theraglee.

If you browse without an account

• Technical information that any website receives when you load a page: your IP address, browser type, device type, the page you asked for, the time, and the page that referred you. Our hosting provider keeps this in short-lived server logs so the site can be served and defended against abuse.
• Answers to the self-discovery tools, which are saved only in your own browser's local storage so you can pick up where you left off. They never leave your device unless you create an account and choose to save a tool to your dashboard.

If you create a member account

• Account details: the name or nickname you want to be greeted by, your email address, a password (stored only as a one-way hash), and the date you joined.
• Profile and preferences: your zip code, the topics you are interested in, whether you want a daily email and which kinds of content it should include, and whether you allow therapists to reach out to you. If you switch on Theraglee Match Mode, also the details you give for it: a pseudonym, your age range, your gender (or that you prefer not to say), broad topics, how you would like to meet, and how you plan to pay (your insurance plan's name, out of pocket, or not sure).
• What you create in the tools: journal entries, quiz answers and results, worksheet responses, checklist progress, challenge progress, goals, your quest map and what-helped notes, mood logs, favorites, items saved for later, and which tools you have started or finished.
• Messages: messages that verified therapists send you through Theraglee when you have allowed outreach, and messages you send to a therapist through a profile's contact form (your name, email, optional phone number, preferred times, and what you wrote).
• Membership and payment records: which plan you are on, when it renews, and a record of payments. Card details go directly to Stripe, our payment processor. We never see or store your full card number.
• Support correspondence: anything you send us by email, and our replies.

If you list a practice as a therapist

• Account and practice details: your name, email, credentials, license number and issuing state, practice name, locations, phone number, website, specialties, insurances accepted, languages, fees and telehealth availability. Most of this appears on your public profile; your license number and your real phone number do not.
• License verification records: the result and date of each check we make against your state licensing board or a primary-source verification service, kept as the audit record behind your verified badge.
• Referral activity: counts of profile views, calls to your Theraglee tracking number, messages, website clicks and profile shares, so you can see what the listing brings you. Calls are counted, not recorded.
• Membership and payment records, handled the same way as for members.

Information we deliberately do not collect

• We do not run advertising trackers, social media pixels, session-replay tools or third-party analytics scripts.
• We do not collect precise location. If you press Use my location on the resource map, your browser shares your position with the map for that one view and we do not store it. To find treatment facilities near you, our server sends that position, rounded to about half a mile, to SAMHSA's treatment locator.
• We do not collect Social Security numbers, government ID numbers, biometric data, or genetic data.
• We do not build advertising profiles or infer anything about you for marketing.

3. Where it comes from

• You, when you create an account, fill in your profile, use a tool, or send a message.
• Your device, which sends technical information when you load a page.
• Stripe, which tells us whether a payment succeeded and what plan it was for.
• State licensing boards or a primary-source verification service, for therapists, so we can confirm that a license is current and in good standing.
• Therapists, when they send you a message you have allowed.

4. How we use it

We use your information to:

• create and secure your account, sign you in, and sign you out after fifteen minutes of inactivity so an unattended screen does not stay open;
• run the tools you use and show you your own history, progress, favorites and results;
• pick daily content that matches the topics you chose (this is done with simple rules on our own servers, not by profiling you);
• send the emails you asked for: sign-in links, password resets, receipts, the daily email if you turned it on, and messages from therapists you allowed to contact you;
• process membership payments, renewals and cancellations through Stripe;
• verify therapist licenses, publish therapist profiles, route calls and messages, and report referral activity to the therapist it belongs to;
• answer your questions and requests, including privacy requests;
• keep the site working, find and fix problems, and protect against fraud, abuse and security incidents;
• comply with the law, and establish or defend legal claims.

What we do not do with it. We do not use your information for targeted advertising. We do not sell it. We do not use your personal data, your journal, or anything else you write to train artificial intelligence or large language models, and we do not let anyone else do so. We do not make decisions about you by automated means that have legal or similarly significant effects. (License verification for therapists may use an automated lookup, and any therapist whose license cannot be confirmed automatically is reviewed by a person and can ask us to look again.)

No AI therapy. Theraglee does not offer an AI chatbot, an AI companion, or any artificial intelligence that talks with you, gives you advice, or acts like a therapist or counselor. Every tool on the site is a fixed, written exercise. If that ever changes, we will update this policy and the Terms of Service first, tell you clearly that you would be talking to a machine, and follow the state laws that govern such tools.

5. Who we share it with

We share information only in the following situations.

Companies that run Theraglee for us

These service providers process your information under contracts that limit them to doing work for us and forbid them from using it for their own purposes.

Therapists, only with your permission

If you switch on Theraglee Match Mode, verified therapists with an active membership can see a pseudonymous profile made from the details you give us when you switch it on: the pseudonym you choose, your age range, your gender (or that you prefer not to say), the broad topics you want to work on, whether you prefer in-person, video, or either, your insurance plan (or that you plan to pay out of pocket), and the first three digits of your zip code so they know you're nearby. They can send you a message through Theraglee. They do not see your name or your exact location. If you choose to reply to a therapist's message, your reply carries your real name, which you type at that moment, to that one therapist, and we email that therapist your name and message so they know you wrote back. They never see your email address, your journal, your quiz results, your worksheet results, your mood logs, or anything else in your private dashboard. Switch it off and you disappear from their view, and you can block any therapist with one tap so they can no longer see or message you. If you send a therapist a message from their profile, we pass your name, email, optional phone number, preferred times and message to that therapist by email so they can reply to you directly.

The public, for therapist profiles

A therapist's profile is public once the license is verified. It shows practice details, a Theraglee tracking phone number and a contact form. It does not show the therapist's license number, email address, or real phone number.

When the law requires it

We may disclose information if we believe in good faith that doing so is required by law, a court order, or a valid government request; to enforce our Terms; or to protect the rights, property or safety of Theraglee, our members, or the public. We will narrow any disclosure to what is required, and where the law allows we will tell you first.

If Theraglee changes hands

If Theraglee is sold, merged or reorganized, your information may move to the new owner. We will require the new owner to honor this policy for information collected under it, and we will tell you before your information becomes subject to a different policy.

Aggregated information

We may share statistics that cannot reasonably identify anyone, such as the number of members or the most-used tools.

6. Cookies and local storage

Theraglee uses your browser's storage only to make the site work. There are no advertising cookies and no third-party tracking cookies.

Because we do not sell or share personal information and do not use it for targeted advertising, there is nothing for a browser opt-out signal such as Global Privacy Control to switch off. We treat every visitor as opted out of sale and sharing already, whether or not the browser sends that signal.

7. How long we keep it

Downgrading or canceling a paid membership never deletes what you created. It only locks the tools that made it until you upgrade again.

8. How we protect it

• Every connection to Theraglee is encrypted with TLS, and data is encrypted at rest by our database provider.
• Access rules are enforced inside the database itself, so each member's journal, results and logs can be read only by that member. Which tools you can open is decided by the database, not by the page, so it cannot be bypassed by editing the page.
• Passwords are stored only as one-way hashes. We never see them.
• You are signed out automatically after fifteen minutes without activity, after a warning.
• Card details go straight to Stripe, a PCI DSS Level 1 processor, and never touch our servers.
• Only the people who run Theraglee can access the administrative screens, and only for the purposes described in this policy.

No system is perfectly secure. If a security incident affects your unencrypted personal information or your health information, we will notify you and any regulator the law requires, without unreasonable delay and within the deadlines set by your state's breach notification law and the FTC's Health Breach Notification Rule.

9. Your choices and rights

You can do most of this yourself from your account page:

• See and change your name, zip code, topics and email settings under Profile.
• Turn therapist outreach on or off, and change what therapists see, under Privacy.
• Download everything your account holds as a file, under Privacy.
• Delete your account under Privacy. We finish deletion within 45 days and confirm by email.
• Stop the daily email under Profile, or use the link at the bottom of any daily email. Account emails such as receipts and password resets are sent only when needed and cannot be turned off while your account is open.
• Cancel or change a paid membership under Membership.

Whatever state you live in, you also have the right to ask us to:

• confirm whether we hold personal information about you and access it, including any inferences we hold and the specific pieces of information we have collected;
• correct information that is inaccurate;
• delete your personal information;
• receive a copy of your information in a portable, machine-readable format;
• opt out of the sale of personal information, of sharing for targeted advertising, and of profiling that produces legal or similarly significant effects (we do none of these, so there is nothing to opt out of, but the right is yours);
• withdraw consent you gave for sensitive or health data at any time;
• get a list of the specific third parties to which we have disclosed your personal information (the companies listed in section 5, and any therapist you contacted or allowed to contact you);
• not be discriminated against for exercising any of these rights. We will not deny you service, charge you a different price, or give you a lower level of service because you asked.

How to make a request

Email hello@theraglee.com with the subject "Privacy request," or use the controls on your account page. We respond within 45 days, and if we need more time we will tell you why and take no more than 45 additional days. Requests are free. If a request is clearly excessive or repetitive we may charge a reasonable fee or decline it, and we will explain why.

Verification. To protect you, we confirm that a request comes from you before acting on it, usually by asking you to reply from the email address on your account or to sign in. We never ask for more information than we need to match you to your account.

Authorized agents. Someone else may make a request for you, including a parent or guardian for a child, or a person with power of attorney. We will ask for proof that you authorized them and may also confirm the request with you directly.

Appeals. If we decline all or part of a request, you can appeal by replying to our decision within 45 days and writing "Appeal" in the subject line. A different person will review it and answer within 45 days (60 days in some states) with a written explanation. If you are still not satisfied, you can contact your state attorney general; we will include the address in our answer.

10. Consumer health data privacy policy

This section is Theraglee's consumer health data privacy policy under the Washington My Health My Data Act, Nevada's consumer health data law (SB 370), the Connecticut Data Privacy Act's health data provisions, and similar laws. It applies to everyone, not only to residents of those states, and it adds to the rest of this policy rather than replacing it.

What consumer health data we collect

Consumer health data is personal information that is linked to you and identifies your past, present or future physical or mental health. On Theraglee that includes:

• the topics you tell us you are interested in (for example anxiety, sleep or grief);
• your journal entries, quiz answers and results, worksheet responses, checklist and challenge progress, goals, quest maps and notes, and mood logs, to the extent they describe your mental health;
• the fact that you started, favorited or finished a particular tool;
• what you write in a message to a therapist, and the fact that you contacted one;
• information that could be inferred from the above.

Where it comes from

Only from you, when you enter it, and from your own use of the tools.

Why we collect and use it

Only to provide the specific tool or feature you asked for: to save your work, show you your own history, pick daily content for the topics you chose, deliver a message you sent, and let therapists you approved reach you. We do not use consumer health data for advertising, for profiling, to train artificial intelligence, or for any purpose other than the one you used it for. Because we collect it only to provide what you asked for, no separate consent is needed under these laws; if we ever wanted to use it for anything else, we would ask you first, and you could say no or change your mind later.

Who we share it with

• The service providers in section 5 that store or transmit it for us (Supabase and, for email, Resend). They act only on our instructions.
• A therapist, only when you send that therapist a message or switch on Theraglee Match Mode. Even then, therapists see only your pseudonym, age range, gender (if you choose to share it), broad topics, session preference, insurance plan and the first three digits of your zip code, plus your real name only if you reply to them, and never your name before that, your exact location, your journal, results or logs.
• No one else. We never sell consumer health data, and we never share it with advertisers, data brokers or analytics companies.

Your rights over consumer health data

You can confirm whether we hold it, see it, get a list of everyone we shared it with, withdraw any consent, and have it deleted, including from our backups and from our service providers. Make a request the way section 9 describes. We answer within 45 days and you can appeal the same way. We do not use geofences, and we do not track your location around any health facility.

11. California residents

The California Consumer Privacy Act (CCPA) gives California residents the rights in section 9. The table below is the CCPA's own list of information categories, matched to what we collect. This section also serves as our notice at collection.

• Sale and sharing. We do not sell personal information and we do not share it for cross-context behavioral advertising, and we have not done so in the past twelve months. We have no actual knowledge that we sell or share the personal information of anyone under 16. Because of this, we do not provide a "Do Not Sell or Share" link.
• Sensitive personal information. We use sensitive personal information only to provide the tools you asked for, to secure your account, and for the other purposes the CCPA regulations permit without a "Limit the Use" right, so we do not provide a "Limit the Use of My Sensitive Personal Information" link.
• Purposes, sources, retention and recipients are described in sections 3, 4, 5 and 7.
• Financial incentives. We do not offer discounts or other financial incentives in exchange for personal information. Free and paid memberships differ in the tools they unlock, not in the data we collect.
• Automated decision-making. We do not use automated decision-making technology to make significant decisions about California residents.
• Shine the Light. We do not disclose personal information to third parties for their own direct marketing, so there is nothing to report under California Civil Code section 1798.83.
• Metrics. Because we do not buy, sell or share the personal information of large numbers of consumers, we are not required to publish request metrics.

12. Other state notices

Residents of Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia have the rights in section 9 under their states' privacy laws, including the right to appeal. Some of those laws apply only to businesses above a certain size; we honor the rights for everyone anyway. A few specifics:

• Sensitive data and health data. Information about your mental health is "sensitive data" under every one of these laws. We process it only to provide what you asked for, and we never sell it. Connecticut, Maryland, New Jersey and several other states now prohibit selling sensitive data outright; we have never sold it and never will.
• Connecticut. We do not use personal data to train large language models, and we do not sell precise geolocation data (we do not collect it).
• Minnesota. You have the right to question the result of any profiling that affects you. We do not profile you.
• Oregon. You can ask for the list of specific third parties to which we have disclosed your personal data. It is the list in section 5.
• Texas. This notice serves as the disclosure required by the Texas Data Privacy and Security Act and the Texas Responsible Artificial Intelligence Governance Act: we do not sell sensitive personal data and we do not use consumer data to train or run artificial intelligence systems.
• Nevada. We do not sell covered information as defined by Nevada law, and section 10 is our consumer health data privacy policy under Nevada SB 370.
• Washington. Section 10 is our consumer health data privacy policy under the My Health My Data Act. We do not sell consumer health data and we do not use geofencing.

13. Children and teens

Theraglee is for adults. You must be at least 18 years old to create an account, and we do not knowingly collect personal information from anyone under 18. We do not direct any part of the site to children under 13, and we comply with the Children's Online Privacy Protection Act (COPPA) and with state laws protecting minors, which is why we do not offer accounts to minors at all. If you believe a person under 18 has given us information, email hello@theraglee.com and we will delete it promptly. If you are under 18 and need support, please talk to a parent, a school counselor, or a doctor, or call or text 988 to reach the Suicide and Crisis Lifeline.

14. Therapists

If you list a practice, section 2 describes what we collect and section 5 describes what is public. Three points deserve their own space:

• Verification records are kept. Every license check, whichever route it took, is written to an audit record so we can show why a badge was granted, and licenses are re-checked before they expire. If a check fails, your listing comes down automatically. You can ask us to review a failed check, and a person will.
• Member information you receive is theirs. When a member contacts you or allows you to reach out, you receive their name and contact details so you can reply. Use them only to respond to that person, protect them the way your license and your own privacy obligations require, and delete them when they are no longer needed. Do not add them to marketing lists.
• Do not enter client health information into Theraglee. Theraglee is not a HIPAA business associate and does not sign business associate agreements. The Assign Remind feature is shown in preview only and does not accept client records. Keep all client treatment information in a HIPAA-compliant system.

15. Changes to this policy

We review this policy at least every three months against changes in federal and state law, and whenever we change how Theraglee works. When we make a material change, we will post the new policy here with a new effective date and, if you have an account, email you at least 30 days before it takes effect. We will never apply a material change retroactively to information already collected without asking for your consent where the law requires it.

16. How to reach us

If you have a disability and need this policy in another format, email us and we will provide it.