This policy explains what personal information PurposeBook collects, why we collect it, who we share it with, how long we keep it, and the rights you have over it. It applies to the PurposeBook mobile and web application, our administrative website, and email we exchange with you. It supersedes our policy dated May 21, 2024.
Accounts are established by PurposeBook rather than opened by members; the service operates no open sign-up. Most members are enrolled through an institution that has arranged access on their behalf. Others hold individual accounts, established either at our invitation or following a request for access that we approved. Where we have invited you directly, that invitation may take the form of a code that lets you complete your own registration on our sign-up form; the form cannot be used without one. We do not sell subscriptions to individuals, and the application contains no payment features.
The route by which an account was established affects one matter only: the information available to an institution. The Who We Share Information With section sets out that boundary, including the position of individual members not associated with any institution.
We do not sell personal information, we do not share it for advertising, and we do not use it for advertising ourselves. There are no advertising networks, tracking pixels or cross-site trackers in our applications.
PurposeBook is not intended for anyone under 18 years of age, and we do not knowingly collect information from anyone under 18. If you believe we hold information about someone under 18, contact us at info@purposebook.com and we will delete it.
To produce your PurposeBook profile we analyse what you have written and derive:
We do not use advertising identifiers, advertising cookies or cross-site tracking. Our applications use only the storage necessary to keep you signed in and remember your preferences.
Some of our emails contain a small image and link redirects that tell us whether the email was opened and which links were clicked. We use this only to confirm delivery and to improve those emails. Most email apps let you block it by not loading images.
We use your information to:
We do not use your information for marketing without your consent, and we do not make decisions producing legal or similarly significant effects about you by automated means.
PurposeBook uses artificial intelligence to hold conversations with you, to identify passages of your writing as evidence, and to draft the strengths, impacts and purpose statement you see.
This analysis runs on infrastructure we operate ourselves. Your reflections are not sent to any third-party AI provider. If that ever changes, we will update this policy and name the provider before it takes effect.
The output is advisory. It is presented for your consideration and does not constitute an assessment of, or a decision about, you. Corrections may be submitted from within the application.
When you dictate, transcription is performed by your device’s operating system — Apple on iOS, Google on Android — not by PurposeBook. We request on-device transcription where your device supports it. Where it does not, your device may send the audio to Apple or Google for transcription under their privacy policies. PurposeBook receives only the resulting text and does not retain recordings.
We analyse aggregate patterns in order to improve the service. Before that data reaches our analytics warehouse it is de-identified: account identifiers are replaced with pseudonyms, IP addresses are removed in full, and free text is scanned automatically to redact names, email addresses, phone numbers, street addresses, dates of birth and financial identifiers. Preview, test and experimental records are excluded entirely.
PurposeBook is operated from the United States and your information is processed there. If you are in the United Kingdom or the European Economic Area, this is a transfer outside your home jurisdiction. We apply the protections described in this policy wherever your information is processed, and we are implementing formal transfer safeguards (standard contractual clauses); their current status is available on request.
We retain your account and the material you have written for as long as the account remains active.
Security records are deleted automatically: sign-in codes within minutes, rate-limiting records within a few days, and sign-in audit records after 90 days.
Records of the email we send you are deleted after 90 days, or 30 days for sign-in code emails. Records of email sent to purposebook.com addresses, which we kept until November 5, 2026, are deleted 90 days after the email arrived.
Email you send to our staff is kept for as long as we need it to deal with your message, then deleted.
If you reply to one of our no-reply addresses, we may keep a coded record of your address for about 3 days, so that we send you at most one automatic reply in that time.
Messages sent through our contact page are deleted 90 days after we receive them.
Requests for access to PurposeBook are deleted 30 days after we decide them, and no more than 180 days after we receive them while they are still waiting for a decision.
When you delete your account or your content, your information is removed from live systems after a 7-day recovery window and from encrypted backups within a further rolling 30-day cycle — see the Deleting Your Information section.
Depending on where you live, you may have the right to access, correct, delete, restrict or object to our processing of your information, to receive a portable copy of it, and to withdraw consent. Exercising these rights will not result in any reduction in the service provided to you.
Requests may be made by email to info@purposebook.com or through our contact page. We may be required to verify your identity. We respond within one month and will notify you if an extension of that period is necessary.
Concerns may be raised with us directly in the first instance, and we will seek to resolve them. If you are in the UK or the European Economic Area, you also have the right to lodge a complaint with your data-protection authority at any time; in the UK this is the Information Commissioner’s Office (ico.org.uk).
You may delete your account together with all of its contents, or retain your account and delete only the material you have written, at any time and by either of the following means:
Deletion is subject to a 7-day recovery window, during which the request may be cancelled using the link sent to you by email. After that period the deletion is irreversible, and it completes within 30 days of the request. The Delete Account page sets out precisely what is deleted and the limited set of records that are retained, such as the record of the deletion itself.
We collect the categories of personal information described in the Information We Collect section: identifiers (name, email address, IP address), what you provide to us (your writing and photographs), internet activity (sign-in and usage records), audio-derived text if you dictate, and inferences drawn from your writing (your generated profile). We collect them for the purposes described above, from you directly and from your own use of the service, and we disclose them only to the service providers listed in the Who We Share Information With section.
We have not sold personal information, and we have not shared it for cross-context behavioural advertising, in the preceding twelve months. We do not sell or share the personal information of minors. We do not collect government identifiers, financial account numbers or payment card data.
California residents may exercise their rights to know, access, correct and delete through the channels in the Your Rights section, and will not be discriminated against for doing so. California’s “Shine the Light” law (Civil Code § 1798.83) permits requests about disclosures to third parties for their direct marketing purposes; we make no such disclosures, and you may confirm this through the contact channels below.
Four of our forms are accessible to anyone holding the link: our contact form, our account and data deletion form, our password reset form, and our sign-up form. To protect them from abuse by automated scripts, they are protected by reCAPTCHA v3, a service of Google LLC.
No challenge is presented for you to complete. When you submit one of these forms your browser loads reCAPTCHA from Google, and Google receives your IP address, information concerning your interaction with the page, and information about your browser or device. It may also read and set cookies. Google returns a score estimating whether the submission came from a person or from a script.
We use that score to determine whether to accept the submission, and for no other purpose. It is not used for advertising and does not form part of your profile. reCAPTCHA does not operate while a page is merely being read; it loads only upon submission of one of those four forms.
Google’s handling of that data is governed by its own privacy policy (policies.google.com/privacy) and terms (policies.google.com/terms). If you prefer not to use it, you may email us at info@purposebook.com and we will process your request by that means, including a request to delete your account or your data.
We hold ourselves to SOC 2 and ISO/IEC 27001 practices, and to ISO/IEC 42001 for our AI system. Your data is encrypted in transit and at rest; access is least-privilege; administrative accounts require two-factor authentication; and our systems use no long-lived credentials. No system is entirely secure. We will notify you and the relevant regulator of a qualifying breach without undue delay.
We will post changes here and update the date at the top. For material changes we will notify you by email or in the application before they take effect.
For questions or comments regarding this policy and our privacy practices:
Questions about this policy? Email info@purposebook.com or use our contact page. You can also write to PurposeBook LLC, 2625 Piedmont Road NE, Suite 56-615, Atlanta, Georgia 30324, United States.