Privacy Policy

version 1.0 · 24 august 2026

This is a draft. It was written from the code, file by file, and it is waiting on its final review at Honey Digital before it is signed. If anything below turns out not to match what the app does, that is a bug in the app, and the app is what gets fixed.

This page covers Breakwater: the website, the app, and the small amount of it that runs on a server. If you want the same story in fewer words and no legal scaffolding, the anonymity page tells it plainly.

the short version

Nothing you write in the journal ever reaches us.

It is held by your own device and we have no copy of it. Everything else on this page is the list of what we do hold, who is able to read it, how long it stays, and how to make it go.

Breakwater sells nothing and shows no advertising. There is no analytics package, no tracking pixel, and nothing counting your visits. None of what follows is needed to open a jar.

The journal stays on your phone.

What you write in the jar is stored by your own browser, on your own device. It is never sent to us.

The journal, and the draft you have not put in the jar yet, live in this device's own storage. We do not receive them, cannot read them, and could not recover them for you if you asked. The one exception is a bottle you deliberately float, which is its own section further down.

That is a real trade and we would rather say it now than have you find it out at a bad moment. Because we keep no copy, clearing your browser data, reading in a private window, or moving to a new phone loses what is in the jar. There is no backup and no export.

What else this device remembers.

A short list of small things, all of them held by your own browser. Where one of them touches the server at all, the line says so.

The jar itself, and the draft still being written.
The country you chose for the crisis lines.
Whether you asked for less motion.
Whether you have already seen the walk around the jar, and the note about dictation, so neither of them interrupts you twice.
The last two hundred things a current has shown you, by id, so it never deals you the same hand twice. That list goes up with the request and is used to pick the next hand. It is not kept on the server.
A rough location for the sky, if you ever offered one. See two sections down.
When you last left the water, so Drift can offer you one more current a couple of hours later, and a note if you have told it to stop offering.
A sign-in token, if you have an account, so you are not asked to log in again on every screen. It is the one thing on this list the server issued and the server reads, and signing out takes it away.

Deleting everything wipes the jar and its draft from this device and signs you out, which takes the token with it. The rest of the list goes when you clear your browser data for this site.

Saying it out loud.

Dictation is done by your device. Breakwater never receives any audio.

The mic in the journal uses the speech service already built into your phone or your browser. The audio goes there, on whatever terms your device maker or browser already has with you, and Breakwater is not part of that exchange. What arrives in the journal is text, and it stays on the device like the rest of the journal. The app tells you this on screen the first time you press the mic.

Where the browser has no speech service, no mic is drawn. We do not put a button there that cannot listen.

Where the sky is looked at from.

Optional, asked once, rounded to roughly eleven kilometres, and kept on your device.

Drift puts the real stars where they actually are tonight, which needs a rough idea of where they are being looked at from. If you offer it, your browser is asked for your location exactly once, the answer is immediately rounded to a tenth of a degree, which is a city rather than an address, and it is written to this device's storage and nowhere else. It is never transmitted, never attached to anything you write, and clearing your browser data removes it.

Saying no costs you nothing. The sky falls back to the middle of the country you already chose, and failing that to a fixed latitude, so there is always a sky.

What Breakwater holds.

An account, the bottles you choose to float, the replies they get, and the record of the safety checks.

Your account. The email address you signed up with, the alias generated for you, the country you chose, your motion settings, whether you have taken the responder pledge, and whether you have finished onboarding. The email is what the sign-in works from: a six-digit code goes to it when you make the account, and a reset link if you ever lose the password. It is never displayed beside anything you write, and the one screen in the product that shows it at all is the moderator's console. The section after this list is about the one place it does get written down anyway.
A bottle you float. The words you sent to be screened, and the sanitised version that strangers actually see. Both are kept against your account. Pulling a bottle back closes it so no new replies can arrive; deleting everything is what removes the record.
The published copy of that bottle, which is the version floating in the water.
Replies written to you, whether you kept or discarded each one, and the reason you gave if you discarded it.
If you answer other people, the replies you draft, the screening verdict on each one, and any coaching note it came back with. A reply is never rewritten for you: it is delivered as you wrote it, or not at all.
If you use Stay, your own reasons to stay and your safety plan.
If you offer a reason to the shared pool, that reason. It is screened, then held for other people to borrow, which is the whole point of offering it, so deleting everything leaves it where it is.
If you write to us, what you wrote and the reply that comes back. You and the moderator can read that thread and nobody else, and deleting everything takes it with the rest. It is ordinary correspondence, not part of the safety record, so it is not one of the exceptions further down.
When something is blocked, held for a human, or discarded, a moderation record: the exact text that was screened, the decision made about it, the reason you gave if you were the one discarding a reply, and any note the moderator left.

That is the whole list. There is no profile, no photograph, no display name you have to invent, no phone number, no contacts, no address book, no location, and no history of what you looked at.

What the platform stamps on every record.

Every stored record carries who made it and when. That is precisely why almost nothing is read straight from the database.

Breakwater runs on Base44, and every record it stores carries the same automatic fields: an id, the date it was created, the date it was last changed, the id of the account that created it, and that account's email address. We do not choose those fields and we cannot switch them off.

So the app never hands you another person's bottle or reply straight from the database. If it did, it would hand you their email address with it. Instead it asks the server for a short, explicit list of fields, and anything not on that list cannot come back. For a bottle in the water that list is four things: the sanitised words, the kind of support the person asked for, any content warnings, and an id to reply to. No name, no email, no timestamp.

Who can read what.

You, and the moderator. Those access rules are enforced by the database, not by what the screen happens to show.

Your bottle in its original wording can be read by you and by the moderator, and by nobody else. What a stranger sees is the sanitised version only, through the short list of fields above, with the order of the bottles shuffled so that position gives nothing away about when something was written. Your own bottle is never handed back to you as a stranger's.

Replies reach your shore the same way, through a list of fields that carries no identity at all: no name, no alias, no account id. Nothing in what you are handed tells you that two replies came from the same person. Your safety plan and your own reasons to stay are readable by you alone.

The moderator is Breakwater's own admin account. It can read what running the review queue and keeping the audit trail requires. That is the one exception in the product, and it exists so that a person is accountable for what gets delivered to somebody at their worst hour. How that review works is described on the safety page.

What happens to the words you float.

They are read by a language model before any human sees them, and you approve the sanitised version before it leaves.

When you float a bottle, the text is sent through Base44's integration to a language model, which screens it for anything that could identify you and anything that would land badly on a stranger, then writes the sanitised version. You see your original and that version side by side, and nothing floats until you say so.

If the check fails, times out, or comes back malformed, the words are blocked and held for a human rather than delivered. When that happens, and when a reply is held back, a moderation record is written and only the moderator can read it. The full account of every place AI touches this product is on the how we use AI page.

How long any of it stays.

Until you delete it. Nothing here expires on a timer, and nothing is archived for us.

A bottle stays in the water until you pull it back or until you delete everything. Pulling it back closes it to new replies rather than erasing it, and the record stays with you until you delete everything. Replies stay on your shore until you discard them or delete everything. Your account stays until you ask for it to go.

When a record is deleted it sits in the platform's recently deleted state for thirty days, which is there so that an operational mistake can be undone. After thirty days it is permanently gone and cannot be restored by anyone, including us.

Two things outlive that, and we would rather be plain about both than quietly leave them out. Moderation records are the record of a safety decision, so they are kept as the audit trail and deleting your account does not remove them; they hold the exact text that was screened, and the bottle they were written about is gone. And a reason you offered to the shared pool stays in the pool, because you handed it to strangers to borrow and pulling it back would take it out of their hands.

Delete everything.

A button at the bottom of the me screen, one confirmation, and it means it. This is what happens, in this order.

The floating copy of anything still in the water goes first, so nothing of yours is left out there readable while the rest is still going.
Then your bottles, the replies to them, your reply drafts, your reasons to stay, your safety plan and anything you wrote to us are deleted from Breakwater.
The jar on this device is wiped, drafts included.
You are signed out.

What it cannot do: if somebody already opened one of your bottles, or already wrote back, that has happened. Words that reached another person's screen cannot be unread. There is no undo, no export, and no copy kept anywhere for you.

It also leaves the two things named in the section above, on purpose and not by accident: the moderation record of any safety decision, and any reason you offered to the shared pool.

That button does not remove the sign-in account itself, which is your email address and the alias attached to it. Ask us and it goes. Contact reaches a person.

What is not happening here.

No advertising, no analytics, no trackers, and nothing about you for sale.

There is no advertising in Breakwater and no advertiser is given anything. There is no analytics package, no tracking pixel, no session recording, and nothing that counts your visits or how long you stayed. The app deliberately keeps no streaks, no scores and no counters, and there is nothing counting underneath either.

Nothing is sold, rented, or handed to a data broker, and nothing goes to anyone outside what the next section names. Nobody is profiled and nothing is scored. The only automated judgement made about anything you write is the safety screening described above, and what it blocks goes into a queue in front of a human.

Who runs it, and the one outside request.

Breakwater is built by Honey Digital and runs on Base44. Your browser also fetches the typeface from Google Fonts.

Base44 provides the hosting, the accounts, the database and the integration that calls the screening model. It holds and processes this data on Breakwater's behalf, under its own platform terms, and a proper reading of those terms is one of the things this draft is still waiting on.

One other request leaves your browser on every page. The site loads Jost, the typeface everything here is set in, from Google Fonts, and that request tells Google's servers your IP address and which font was asked for, the way any web font request does. Apart from Breakwater's own servers at Base44 it is the only host your browser talks to on this site, and it is named here because a privacy page that quietly omits it is not one.

Eighteen and over.

Breakwater is for adults, and this policy is written for people over that line.

The Terms of Use set eighteen as the floor. If we learn that an account belongs to someone younger, we remove it. Anyone of any age can reach the crisis lines from help now, and always could.

When this changes.

The version and the date at the top change with it, and the wording follows the code rather than the other way round.

If something on this page is unclear, or you think it is simply wrong, write to us and a person will read it. If tonight is worse than a question about a policy, do not write to us: talk to someone now, and those numbers work even when our servers do not.