Privacy policy

Last updated October 7, 2026.

Motivational Health Messages (MHM) is a personal support tool. This page describes what the service stores, why, and what you can do about it. It matches how MHM works today.

What MHM is for

MHM sends the reminders and encouragement you set up, and it keeps the tasks, notes, and check-ins you choose to save. It is not a medical service, and it does not sell personal information.

Information you give MHM

Creating an account asks for an email address and a password. The password is stored only as a salted scrypt hash. You can also sign in with a one-time email code. A preferred name and time zone can be saved during setup.

If you fill them in, your account can also hold a birth date, pronouns, gender identity, interests, goals, health conditions, medications or treatments, allergies, reminder notes, notes for personalized messages, and people who matter to you. Check-ins can include mood, energy, and the other questions you turn on. Tasks, notebook entries, and message templates are stored when you create them.

Messages you exchange with MHM, including on Discord, can be saved so later replies and reminders have context.

Connected services

• Discord. If you connect Discord, MHM stores the Discord user id and username for that account. You can disconnect it from Delivery settings. Delivery then falls back to email when that was your channel.
• Google or Facebook. If you use one of these to sign in, MHM stores the stable identifier needed to recognize that sign-in. When Google or Facebook shares an email and no MHM account uses it yet, MHM creates the account. If an account already uses that email, MHM signs you into it. Sign-in access tokens and refresh tokens from these providers are not stored. If Facebook does not share an email, MHM does not create an account from that sign-in. You can disconnect an extra sign-in as long as one way to sign in remains.
• Google Health. If you connect it, MHM reads sleep, activity, and health measurements you approve. Those readings are stored with your account and used for coarse summaries, such as a rounded sleep length or a heart-rate band. You can pause the connection or delete the saved health data from Integrations in Account settings.

How MHM uses it

MHM uses this information to sign you in, send messages inside the time windows you choose, run check-ins and task reminders, and show your notes and insights back to you. Optional personalized messages can include relevant profile notes and a coarse health summary. Exact heart-rate numbers and device names are not put into those messages.

Personalized text is written by a language model configured for the MHM service. The current setup runs that model on the MHM host. MHM does not send your account to a separate cloud AI company as part of that setup.

Who else receives it

• Email. Sign-in codes, password recovery, and email reminders go through the mail server configured for MHM.
• Discord. Messages you ask MHM to deliver on Discord are sent through Discord.
• Google and Facebook. Only if you start that sign-in or connection. Each provider handles that visit under its own policy.
• Google Health. Only if you connect it. Google handles the consent screen and the health data it shares.
• Cloudflare. The public website is served through Cloudflare. The gateway may use the connecting IP address to limit repeated sign-in attempts.
• Stripe. If you start or manage a subscription, Stripe receives the billing and payment details you enter on its hosted pages. MHM stores only the Stripe customer and subscription identifiers, subscription status, and relevant trial or grace-period dates. MHM does not receive or store your card number.
• Typefaces. Inter and Nunito are stored with the website and served by MHM. Loading a page does not send a font request to Google.

MHM does not use advertising cookies and does not sell or rent your information.

Sign-in sessions

After you sign in, the browser keeps an HttpOnly cookie named mhm_session. It is limited to API requests, lasts 12 hours, and uses SameSite=Lax. On the public HTTPS site it is also marked Secure. The session itself is kept in memory on the MHM gateway. Logging out revokes it. Restarting the service signs you out. Email codes expire after 10 minutes, can be tried a limited number of times, and are not written to the logs.

How long it is kept

Account files, including billing status and Stripe identifiers, stay until the account is deleted. Stripe may retain its own transaction records under its policies and legal obligations. Older sent-message history can be archived after 365 days when cleanup runs. Google Health files stay until you delete them or the account is deleted. Sessions and email codes expire on their own.

Your choices

You can edit settings, download a copy of your data, disconnect Discord or an extra sign-in, and delete saved Google Health data. Signed in, open Account, then Your data, to download a copy or delete the account. Deletion is also described on Your data.

Children

MHM is a personal tool for the account holder. It is not directed to children under 13, and it does not knowingly create accounts for them.

Changes

If this policy changes, the date at the top of this page will change.

Questions

To ask about your information, use a channel already connected to your account: a Discord message to the MHM bot, or a reply to an email from MHM. See Terms and Your data for the related pages.