Legal
Privacy Policy
Last updated: 25 July 2026
The short version
ADHD Reflect is built for people in difficult parenting moments. That means the things you type, tap and answer here are often emotionally sensitive. We treat them that way.
Here is the honest summary:
- We collect the minimum we can.
- There are no accounts and no passwords. Paid access is a token in an emailed link, plus a backup saved in your browser.
- We do not sell your data.
- We do not use your data to target advertising. We do not run any analytics tool.
- We do not share what you type into the assistant with advertisers, referral partners or anyone marketing to you.
- We use four services to run the site: Cloudflare, Anthropic, Resend and Stripe. Nothing else.
- You can ask us to delete your data at any time.
The rest of this page explains how that works in detail.
If anything here is unclear, email [email protected] and we will answer in plain English.
Who runs ADHD Reflect
ADHD Reflect is operated by ABN 44 606 081 086, based in Brisbane, Australia.
In this policy, “we”, “us” and “our” mean ADHD Reflect. “You” means anyone using the site, the assistant, the quiz, the newsletter or Both of You.
We treat ourselves as bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Some small businesses are exempt from that Act. We have not relied on that exemption, because a lot of what you type here is personal and some of it is about your health or your child’s, and it should be handled properly regardless of our size.
No accounts, no passwords
There is nothing to log into. You do not create an account and you never set a password.
When you buy Both of You, we email you a link with a private access token in it. That link is how you get back in, on any device. Your browser also keeps a backup copy so you stay signed in on the device you bought it on. That is the whole system. There is no username, no password, and no account for someone to break into.
What we collect
We collect different things depending on what you do on the site.
Things you give us directly
Email address. If you sign up for the newsletter or your quiz result, or you buy Both of You, we collect your email address.
Quiz answers. If you take the parenting pattern quiz, we use your answers to work out your pattern. We store the pattern (not the individual answers) so we can send you the weekly practices that match it.
Anything you choose to type or speak. If you use the in-the-moment assistant to describe what just happened in your home, we receive that text. If you use voice input, your browser converts speech to text on your device, and we receive only the text. See “What we do with what you type” below, because this is the most sensitive part.
Payment details. If you buy Both of You, payment is processed by Stripe. It is a single, one-off payment. There is no subscription and no recurring billing. We do not see or store your card number. We receive a record that you paid and the country your card was issued in.
Anything you send us by email. If you email us, we keep your message and reply.
Things we collect automatically
Country-level location. We use your IP address to work out your country, so we can show you the right crisis lines and support resources. We do not store precise location, suburb or postcode unless you give it to us deliberately.
Basic technical information. Standard web server logs from our host, Cloudflare, used for security and debugging.
We do not run any analytics tool. We do not count page views, build visitor profiles, or track you from page to page.
Things we do not collect
We do not collect or ask for:
- your child’s name, photo, school or details;
- your partner’s name or details;
- your full address, suburb or postcode;
- your phone number, unless you choose to give it to us;
- your health records, diagnosis or prescription information;
- any details you have not chosen to share.
If you type any of these into the assistant, we will end up receiving them, but we ask you not to. The assistant is designed to work with general descriptions, not identifying details.
What we do with what you type into the assistant
This is the most sensitive part of the site, so we want to be specific.
When you type or speak something into the in-the-moment assistant (“I just yelled at my kid”, “the homework meltdown again”, and so on), here is what happens:
- Your text is sent to Anthropic’s Claude API, processed in the United States. Anthropic uses it only to help match your words to one of our pre-written cards or guides. The AI does not generate advice. Per Anthropic’s terms, API inputs are not used to train their models.
- The assistant matches you to a card or guide.
- We log what you typed in our own records for 90 days, so we can see what people are struggling with and decide what to write next. After 90 days it is deleted automatically.
We never sell this text, and we never use it for advertising. We do not link it to your email, your payment or your access token.
We also run a crisis-language check on what you type. If you describe something that looks like a safety risk to you, your child or someone else, we will not try to match a card. We will show you crisis support options for your country instead.
Information about other people
The hardest part of a tool like this is that you often type about your children. Your child has not agreed to any of this, and a young child cannot.
Here is exactly what happens to that text. It is sent to Anthropic in the United States to match your words to a card, and it is logged in our own records under our search data for 90 days so we can learn what to write next. It is never sold and never used for advertising. After 90 days it is deleted.
We ask you not to include anything that identifies your child, such as their name, school or photo. The assistant works fine with general descriptions. If you want anything you have typed removed sooner, email [email protected] and we will delete it.
Sensitive information
The Australian Privacy Act treats some information as sensitive, including information about your health.
ADHD Reflect is not a health service. We do not provide diagnosis, therapy, treatment or clinical care. But we recognise that ADHD-related content, quiz answers about your parenting and descriptions of moments at home are emotionally sensitive, and may be considered sensitive information under Australian law.
We treat all of this as sensitive by default. That means:
- we only collect it with your knowledge and where it is needed to give you what you came for;
- we do not share it with advertisers, marketers or referral partners;
- we do not use it to build a profile that follows you around the internet.
Who we share data with
We use four services to run ADHD Reflect. That is the whole list.
| Service | What it does | What we share with it |
|---|---|---|
| Cloudflare | Hosts the site and stores its data in Cloudflare KV. | Your email, quiz pattern, drip schedule, access token, and what you type into the assistant. |
| Anthropic (Claude API) | Matches your assistant input to the right card or guide. Processed in the United States. | The text you type into the assistant. Not used to train their models. |
| Resend | Sends the welcome email and weekly practice emails. Your subscriber data sits on Resend’s servers in Japan. | Your email address and which pattern you scored on. |
| Stripe | Processes the one-off payment for Both of You. | Name, email, country and payment details, handled by Stripe directly. |
We do not share what you type into the assistant with anyone other than Anthropic. We do not share your quiz result with anyone other than Resend, so we can send you the weekly practice that matches your pattern.
If we ever change a service in this list, we will update this page.
We will only share your data outside this list if:
- you ask us to;
- we are required to by law;
- we need to protect someone’s safety;
- we sell or transfer the business, in which case we will tell you first and the new owner will be bound by this policy.
Where your data is stored
Your data lives in Cloudflare KV. Two of our services also process it overseas: Anthropic in the United States when the assistant matches your text, and Resend in Japan when we send you email.
Where data leaves Australia, we rely on the contractual protections those providers have in place to handle it consistently with the Australian Privacy Principles and other applicable laws.
How long we keep it
Almost everything lives in Cloudflare KV and deletes itself on a timer. These are the real numbers, read from the code:
| What it is | How long we keep it |
|---|---|
| A short-lived cache of which card your text matched | 30 days |
| What you type into the assistant | 90 days |
| Your drip schedule and quiz pattern | 60 days |
| Your unsubscribe record | 5 years |
| Your purchase access token | 2 years |
| Your contact record held in Resend | Until you ask us to delete it, or we remove it |
Your contact record in Resend does not expire on its own, so it stays there until it is deleted. Everything else expires automatically on the timer above.
Your rights
You have the following rights, no matter where you live:
- Know what we have about you.
- Access a copy of your data.
- Correct anything that is wrong.
- Delete your data.
- Opt out of marketing emails at any time, using the link at the bottom of every email.
- Complain to us first, and to a regulator if we cannot fix it.
To use any of these rights, email [email protected] with a short description of what you want. We will respond within one month. If we need more information to check it is really you, we will ask.
If you are in Australia and you are not happy with how we have responded, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.
If you are in the UK or the EU
If you are in the UK or the EU, you also have rights under the UK GDPR and GDPR.
Our lawful basis for sending you email is your consent, which you gave when you signed up and can withdraw at any time using the unsubscribe link in any email. Our lawful basis for the assistant is our legitimate interest in matching what you type to the right piece of writing, which is the entire point of the tool.
You can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it, by emailing [email protected]. We will respond within one month.
Your data is processed outside the UK and EU: in the United States by Anthropic when the assistant matches your text, and in Japan by Resend when we send you email. We rely on the standard contractual clauses those providers have in place.
If you are in California, you have rights under the CCPA and CPRA, including the right to opt out of the sale or sharing of personal information. We do not sell or share personal information as those terms are defined under California law.
Children
ADHD Reflect is built for adults, especially parents. It is not designed for, marketed to or intended for children or teenagers.
We do not knowingly collect personal information from anyone under 18. If you are a parent or carer and you believe your child has used the site and given us information, email [email protected] and we will delete it.
We also ask that you do not type information about your child that would identify them (name, school, photo, exact age, exact suburb) into the assistant or any form on the site. The site works with general descriptions of moments. It does not need identifying details about your child, and we do not want them.
Security
We use industry-standard protections, including encryption in transit and tight access controls. Because there are no accounts and no passwords, there is no login for an attacker to guess or steal.
No system is perfectly secure. If we ever have a data breach that is likely to cause you serious harm, we will tell you and the relevant regulator, as required under the Notifiable Data Breaches scheme in Australia.
Changes to this policy
If we change anything important on this page, we will update the date at the top and tell newsletter subscribers by email. Small clarifications or typo fixes may happen without a separate notice.
Contact us
Privacy questions and deletion requests: [email protected] General contact: [email protected]
Both addresses reach the same inbox. We aim to reply within five business days, and always within one month.