Privacy Policy

How operates how-app.com and is the controller of the personal data described here. [Legal entity details — company name, registered number and address — to be added on incorporation.] Contact us about anything in this policy at hello@how-app.com.

• Account details — email address, name, date of birth (you must be 18+), and sign-in records.
• Peer profile — username, bio, photo, rate, and the chapters you write.
• Conversation content — voice questions and replies (audio), notes sent with a call, reviews, and reports you make. Live calls are not recorded.
• Payment information— handled by Stripe. We store references (like a customer ID and amounts paid), never your card number. Peers’ identity verification is performed by Stripe Identity — we store only the outcome (verified or not), never your documents.
• Usage and service records — records of key actions (bookings made, calls started, verification outcomes) that we create as you use the service, browser analytics only if you accept analytics cookies, and error reports if something breaks.

How is built around lived experience, and the moments people talk about — a diagnosis, fertility, burnout — can reveal information about health. You choose what to share in your questions, calls, chapters and bio; where what you share includes special category data such as health information, we handle it on the basis of your explicit consent, given when you choose to share it. We use it only to provide the service (delivering your conversation to the person you chose), never for advertising, and never sell it.

If a conversation is reported, our safety team can listen to the reported recording and may keep a short excerpt as part of the incident record.

• To provide the service (contract): accounts, bookings, payments, payouts, and the emails that keep a booking moving.
• To keep How safe and improve it (legitimate interests): moderation of reports, fraud prevention, rate-limiting, records of safety incidents, and server-side records of how the service is used.
• Browser analytics cookies (consent): only if you accept the cookie banner; you can decline and everything still works.
• Legal obligations: keeping financial records we are required to keep.

We use a small set of service providers, each bound by data-processing terms: Stripe (payments, payouts and identity verification), Supabase (database, sign-in and file storage), Vercel (hosting), Daily.co (live call infrastructure), OneSignal (push notifications), Twilio (SMS call alerts), Resend (email), Inngest (background jobs), Upstash (rate limiting), PostHog — EU hosted — (browser analytics only with your consent; service records as described above) and Sentry (error monitoring). Where a provider processes data outside the UK, transfers are protected by recognised safeguards such as the UK Addendum to the EU Standard Contractual Clauses.

• Voice recordings — deleted automatically 90 days after a booking completes; recordings you sent are deleted immediately when you delete your account.
• Account and profile data — kept while your account exists.
• Financial records — kept for as long as tax and accounting law requires, in a form that no longer identifies you once you delete your account.
• Safety records (reports, moderation decisions) — kept pseudonymised as an incident log.

You can download a copy of your data and delete your account whenever you like (once any active bookings have finished) from Settings. Deletion removes your profile, chapters, photo and voice recordings, and strips your name and contact details from records we must keep. You also have the rights to rectification, restriction, and objection under UK GDPR — email us and we will help. If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office (ico.org.uk).

Essential cookies keep you signed in and are always on. Analytics cookies are optional and off until you accept them in the consent banner; you can change your mind by clearing the site’s data in your browser.

How is for adults. You must be 18 or over to create an account.

If we change this policy in a way that matters, we will tell you before the change takes effect.