Holding Space Privacy Policy
Last updated: 13/10/2026
1. Who we are
Holding Space is provided by The Golden Thread Project Ltd ("we", "us", "our"), a company registered in England and Wales (company number 16433383), with its registered office at 128 City Road, London, EC1V 2NX. For any questions about this policy or your data, contact hello@thegoldenthreadproject.org.
2. What we collect
Account information: your email address and any name you provide. Passwords are handled securely by our authentication provider, Google Firebase. We never see or store your password.
Conversations: the messages you exchange with Cara, your AI companion. Each message, together with the earlier messages in your current conversation, is sent to our server and then to Mistral AI, a third-party AI service based in France, which generates Cara's reply. We only send this after you have agreed to it in the app. Conversations are not saved in any database. Your conversation is held on your device only while you use the app, so Cara can follow what you've said, and it is cleared when you sign out.
Voice input: if you choose to speak rather than type, your speech is converted to text by your device's built-in speech recognition service (Apple or Google), which may process audio under their own privacy policies. We never receive or store audio recordings. The resulting text is treated like any other message.
Subscription information: handled by Apple and RevenueCat. We never see or store your payment details.
3. How we use your information
To create and manage your account.
To let Cara respond to you, with the context of your current conversation.
To manage your subscription.
Safety: messages are automatically checked for signs that you may be in crisis, so that support information can be shown to you. This check happens as your message is processed and nothing is stored.
We do not sell your personal data, and we never use your conversations for advertising.
4. Our legal basis
We process your account information to provide the service you have signed up for. Because conversations with Cara may include information about your health and wellbeing, we only process them with your explicit consent. Before you send your first message, the app explains what will be shared and with whom, and asks for your permission. If you do not agree, no messages are sent and you can still use the breathing practices. You can withdraw consent at any time by deleting your account.
5. Who we share data with
We only share what is needed for each service to work:
Google Firebase: account sign-in and storage of your account details, in the United Kingdom (London).
Render: hosts our server, which passes your messages to Mistral AI. Located in Frankfurt, Germany (EU).
Mistral AI (France): receives your messages and current conversation in order to generate Cara's replies. Mistral does not use our messages to train its models. It may keep messages for up to 30 days for abuse monitoring, after which they are deleted.
RevenueCat and Apple: subscription management and payments.
Each of these providers is bound by data protection terms that give your data the same or equal protection as described in this policy. Your data is processed and stored within the UK and the European Union.
6. How long we keep data
We do not store your conversations. Mistral AI may keep messages for up to 30 days for abuse monitoring. When you delete your account, your account details are deleted from our systems. Apple and RevenueCat keep records of purchases under their own legal obligations.
7. Deleting your account
You can delete your account at any time in the app under Settings → Delete Account. This is immediate and permanent. Deleting your account does not cancel an App Store subscription. Please cancel it in your App Store settings to avoid further charges. If you need help, contact hello@thegoldenthreadproject.org.
8. Your rights
Under UK data protection law you have the right to access, correct, export or delete your personal data, and to withdraw consent at any time. To exercise these rights, contact hello@thegoldenthreadproject.org. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).
9. Age restriction
Holding Space is for people aged 18 and over. By creating an account, you confirm that you are at least 18.
10. Security
Data is encrypted in transit between the app, our server and our providers. We take reasonable technical and organisational steps to protect your data, but no system is completely secure.
11. Not a crisis service
Holding Space is an AI wellbeing companion, not therapy, medical advice or an emergency service. If you are in crisis, contact your local emergency services or a crisis line, such as Samaritans on 116 123 (UK and Ireland).
12. Changes to this policy
We may update this policy from time to time. We will let you know in the app about any significant changes.