Privacy Policy
Last updated 29 September 2026
Willii is a place to write honestly. That only works if what you write is yours. So the design rule underneath everything below is simple: your journal, your gratitude lists, your reframes, and your practice history are saved on your device, and nothing is ever taken from them quietly. Willii is never handed your private writing as context behind your back. Some things do leave, and only in the moment you ask for them: a message you send Willii, something you ask him to reframe, reflect on, or help you write as a blessing, and your voice if you speak instead of typing. Every one of them is spelled out below.
This policy covers the Willii iPhone app and the website at billionaireoflove.com, both published by HDR Holdings, LLC, the company of Hal D. Rosen. "We" below means HDR Holdings, LLC and the small service that runs Willii.
Signing in
Most of Willii needs no sign-in at all: the book, the practice, your journal and your gratitude lists work without one. You do not give a name, email, or phone number to use them, and nothing you write is filed under a person.
While Willii is invitation-only, talking with him means asking Hal to let you in. You ask by signing in — with Google on the website, or with Apple or Google on the iPhone — which tells us your email address and your name, so Hal knows who is asking. He reads the request himself and decides. If he says yes, we keep your email address, so that signing in again on another device lets you straight back in. That address is kept until you delete it, which you can do yourself from inside Willii (see Deleting your information). None of it is attached to anything you write.
The sign-in itself is handled by the company you choose, Google or Apple, not by us. As part of providing it, that company may process limited information of its own — about your account, the device and browser you sign in from, how the sign-in is used, and your approximate (coarse) location, such as one worked out from your IP address — under its own privacy terms. Willii itself does not request your precise location.
Two other things are kept only if you hand them over on purpose: an email address typed into the book's reader list, and the first name and email address typed in to ask for The Next Step Compass.
What stays on your device
All of the following is written to storage on your own phone or browser and stays there. We never collect it, and none of it is sent anywhere on its own — only in the moments you ask for, described below:
- Journal entries and any reflections saved with them
- Gratitude lists
- Reframes (the situation, the new meaning, the gentle step)
- Practice logs, streaks, and progress through the Practice Path
- Chapter progress, commitments, and exercise reflections
- Your saved conversations with Willii
- Blessings you have written
- Your settings, such as whether Willii speaks replies aloud
On iPhone this lives in the app's private storage; if you use iCloud Backup, Apple's backup of your phone will include it, under Apple's encryption and Apple's terms. On the web it lives in your browser's local storage for this site.
There is one button that deliberately breaks that wall, and it only moves when you press it: at the bottom of a journal entry or a gratitude list, you can ask Willii for a short reflection on what you just wrote. That sends the words you wrote, that once, so there is something to reflect on. We do not keep them, and nothing else on this page travels with them. If you never press it, nothing you write here is ever sent.
What leaves your device, and exactly when
Willii's replies are written by Claude, an AI model made by Anthropic, and his voice — both hearing you and speaking — comes from ElevenLabs. Everything below that goes to either company travels through Willii's own server, which passes it on and does not keep it. On the iPhone, Willii asks for your agreement before the first time any of your words or your voice go to either company, and you can withdraw it at any time under Privacy & your data, at the foot of the Today screen. Until you agree, nothing is sent.
When you send Willii a message
The message you send, the earlier messages in that same conversation, and some of your earlier messages from previous conversations with Willii — up to a few thousand characters of them, word for word, so that he remembers you — are sent to Anthropic, which runs the Claude model that writes Willii's reply. Nothing that identifies you is sent to Anthropic: no name and no email. If you are signed in, your invitation, which carries your email address, travels with the request to our server so it can count your daily allowance; it goes no further.
When you ask for a reframe
The situation you describe is sent to Anthropic so that Claude can offer a new way of seeing it. The finished reframe is saved on your device; we do not keep what was sent.
When you ask Willii to reflect on something you wrote
At the bottom of a journal entry and a gratitude list there is a button that asks Willii for a short reflection on what you just wrote. Pressing it sends that entry — the words themselves — to Anthropic, so that there is something to reflect on. It is the only way anything from your journal or your gratitude lists ever leaves your device, it happens once per press, and we do not keep what was sent. Nothing else goes with it: not your other entries, not your history, not a name or an email. If you never press it, none of that writing is ever sent.
When Willii helps you write a blessing
If you ask Willii to suggest the words, what you chose and typed for it — who it is for (a kind of relationship, such as "a friend", not a name), the occasion, a detail, and your intention — is sent to Anthropic so Claude can draft it. The blessing itself is yours: it is sent by you, through whatever you use to reach that person, and it never passes through our server. We are told only that one was sent, as a random number used to keep the shared count honest.
When you use your voice
Anywhere Willii offers a microphone — in chat, and also when you speak a journal or gratitude entry, a check-in, a reframe, or a reflection on a chapter — the recording is sent to ElevenLabs to be turned into text, and the text is handed back to you to edit before anything is saved. The recording is not kept afterwards, by us or on your device.
This is worth being clear about, because it is the other place your private writing does travel: the finished gratitude entry stays on your phone, but if you spoke it, the audio of you saying it had to go out to be transcribed. Typing instead keeps it entirely on your device. On the website, if your browser cannot record audio, the microphone uses the browser's own speech recognition instead, which in most browsers (such as Chrome and Safari) sends the audio to the browser's maker — Google or Apple — under their terms.
When Willii speaks aloud
When spoken playback is used, the text of Willii's reply may be sent to ElevenLabs to generate the spoken audio, in the author's voice. The same applies to a reframe he wrote or a passage of the book when it is read aloud. Your own words are never sent for this.
When you report a reply
If Willii says something wrong or hurtful, you can report it from inside the iPhone app. Doing so sends us the reply you are reporting, the reason you picked, and anything you wrote in the note, along with the random identifier your app uses to count its daily allowance. Your own preceding message is included only if you switch it on, and the screen shows you exactly what will be sent before you send it. The report is emailed to Hal through our mail service (Mailgun) and written to our server's log. Reports are read by a person and are not used for anything else.
When you join the reader list
Only if you type your email address into the signup box. We keep it ourselves, in a small hosted store (Upstash), along with the date and a short note of which page you signed up from — nothing else about you goes with it. It is used for one thing: to tell you when the book is out. Nothing has been sent to the list yet. When the book is out, the list will be moved to an email service to send that announcement, and this policy will name it before that happens. It is not sold, not rented, and not handed to an advertiser. Write to the address at the bottom of this page and it comes off the list.
When you ask for The Next Step Compass
The two pages that offer it — /next-step and /reframe — ask for a first name and an email address. We keep those, in the same small hosted store (Upstash), with the date and which of the two pages you came through, and nothing else. The compass is emailed to you through our mail service (Mailgun). They are used for one thing: to send you the compass. If that ever becomes anything more, this policy changes first and says what. They are kept apart from the reader list, not sold, not rented, and not handed to an advertiser. Write to the address at the bottom of this page and they come off.
The compass itself sends us nothing. Everything you write into it is saved in your own browser, on the device you wrote it on, and there is a button at the end of it that erases all of it. It is never transmitted, so there is no copy of it here to ask for or to lose.
| Who | What they receive | Why |
|---|---|---|
| Anthropic | Your messages to Willii and the earlier messages sent with them; a situation you ask to have reframed; a journal entry or gratitude list you ask Willii to reflect on; what you choose and type when asking for help with a blessing | Claude writes Willii's replies |
| ElevenLabs | Audio you record; the text Willii reads aloud (his replies, reframes he wrote, passages of the book) | Speech-to-text and text-to-speech |
| Upstash | The email address of each person Hal has let in; your email address, only if you join the reader list; your first name and email address, only if you ask for The Next Step Compass; the blessing count | They store these for us |
| Mailgun | Your name and email address when you ask for an invitation (sent to Hal), and your email address when he lets you in (sent to you); your first name and email address when the compass is sent to you; the contents of a report you send | They deliver our email |
| Your sign-in, if you choose to sign in with Google, with the limited account, device, usage and approximate-location information Google processes to provide it (see Signing in). On the website, Google's sign-in script and our fonts load from Google's servers, which see your IP address | Sign-in, and the site's fonts | |
| Apple | Your sign-in, if you choose to sign in with Apple on the iPhone, with the limited account, device, usage and approximate-location information Apple processes to provide it | Sign-in |
| PostHog | Website only: anonymous usage events (see Analytics), with your IP address and browser details | To see whether the website is being used |
| Render | Standard web traffic, including your IP address; our server's logs | They host the site and service |
Each of these companies handles what it receives under its own privacy terms. We do not sell your information to anyone, we do not use it for advertising, and we do not use it to track you across other companies' apps or websites.
What our server keeps
Nothing you write to Willii. Willii's server passes your message along, returns the reply, and holds on to none of it. The text of your conversations is never written to a log or saved to disk.
These are kept on purpose, and they are the whole list:
- Your email address, if Hal let you in — so that signing in on another device lets you straight back in. Kept until you delete your sign-in.
- Your email address, if you joined the reader list, and your first name and email address, if you asked for The Next Step Compass, each with the date and the page you came from. Nothing you write is stored beside them.
- The blessing count. A running total of blessings sent by everyone, a total for each day (kept a little over a year), and a random number for each blessing (kept 90 days) so the same one is never counted twice. None of it records who sent a blessing or what it said.
- A report, if you send one. Reporting a reply you found wrong or hurtful records what you chose to send, so a person can read it. That is the point of reporting.
- Our server's logs, held by our host, Render, for a limited time under its own retention policy. They record the name and email address on an invitation request and on Hal's approval, an email address given to the reader list or for the compass, and the full text of a report. They never contain your conversations, your journal, or anything else you write.
Hal also receives an email when someone asks for an invitation, sends a report, or deletes their sign-in. Those stay in his inbox until he deletes them; write to him and he will.
And these, briefly, in memory only:
- A device token. Your app or browser is issued a random identifier the first time it needs one. It is tied to nothing about you — no name, no email, no advertising ID — and exists only to count how many requests that one device has made today, so that a single user cannot exhaust the service for everyone. If you are signed in, the count is kept against your invitation instead.
- Recent request timestamps for your IP address, kept for about a minute, to block automated abuse.
- Daily request counts, which reset every day.
Those last three are erased whenever the server restarts. Deleting the app or clearing your browser data discards the device token, and the next one is unrelated to it.
Messages are screened for crisis language
Before a message reaches the model, our server checks it for language suggesting suicide, self-harm, harm to others, abuse, or a medical emergency. If it matches, Willii answers with crisis resources instead of a generated reply. This check is automatic, happens in memory, and is not recorded — nobody is notified, and no human reads your message. It exists so the app does not respond casually to something serious. On the website, the anonymous analytics event for a reply notes whether it was a crisis response; it never includes what you wrote.
Willii is an AI companion, not a therapist, doctor, or crisis service. If you are in danger, in the US call or text 988.
Analytics
The website uses PostHog to count a small number of anonymous events, so we can see whether it is being used: the app being opened and returned to on a new day, opening Willii, a message sent to him and a reply received (including whether it was a crisis response), a blessing sent or received, a practice day completed, a badge earned, an invitation asked for or accepted, a reader-list signup, and taps on a song, the newsletter, or a blessing invitation. Each carries only small details such as which page someone arrived from or how long a practice streak is — never the text of anything you write, and never your name or email. Session recording and automatic click capture are switched off. PostHog stores a random identifier for your browser in a cookie and in local storage, and receives your IP address and browser details with each event.
There are no advertising trackers and no advertising cookies. The iPhone app contains no analytics or crash-reporting service at all.
Permissions the app asks for
- Microphone — only when you choose to speak instead of type. Willii never listens in the background.
- Notifications — only if you allow them: a gentle daily practice reminder, which is not asked for until you have completed a day of the practice, and a reminder to send a blessing, if you ask for one.
Willii does not request your precise location, your contacts, photos, calendar, health data, or financial information. A sign-in provider may process an approximate location as part of signing you in (see Signing in).
Children
Willii is written for adults and is not directed to children under 13. We do not knowingly collect information from children. We hold very little to begin with; if you believe a child has sent us information, contact us and we will remove what we can.
Deleting your information
- Everything you have written: deleting the app from your iPhone removes it. On the web, clearing this site's browsing data removes it. Because it was only ever stored on your device, that is the whole deletion — there is no server copy to request. Export anything you want to keep first.
- Your sign-in: on the iPhone, open Privacy & your data at the foot of the Today screen and choose Delete my sign-in; on the website, open Settings from the More menu and choose the same. It erases, from our store, your approval and any reader-list or compass entry under that email address, and removes the invitation from that device. Hal is told, so he can delete the request email by hand. The link in the welcome email Hal's approval sent you would still let you back in, so delete that email too if you want to be sure. Our server's logs age out on their own.
- The reader email list, or The Next Step Compass list, without signing in: write to us and your address comes off. What you wrote inside the compass is not on it — that lives only in your browser, and the Erase button at the end of the compass removes it.
- A report you sent, or anything else: write to us.
Changes to this policy
If this changes in a way that affects what leaves your device, the date at the top will change and the new version will be posted here before the change takes effect.
Contact
Questions about privacy, or a request to delete something, go to halrosen613@gmail.com. See also the support page.