Privacy Policy

What Soulbound stores, who else sees it, how long it is kept, and how to get it back or have it erased. Last updated 24 July 2026.

Who is responsible

Soulbound is run by Lilja Þorsteinsdóttir in Iceland, who is the data controller for everything described here.

Because Soulbound is operated from Iceland, the GDPR (as applied through the EEA agreement) and Icelandic Act No. 90/2018 on data protection apply to everything below.

Taking the test without an account

You can take the whole test and read your whole type page without giving us anything. Your answers are held in your own browser while you answer and are never sent to us. When you finish, the scoring happens on your device.

If you leave without giving an email or making an account, we keep no record that you took it, beyond the anonymous usage measurement described further down.

What we store if you give us your email

If you ask for your reading by email, we store your email address and your type with Resend, our email provider, so we can send you the reading and the short series of follow-up emails that goes with it. Every one of those emails has an unsubscribe link, and unsubscribing stops all of them.

What we store if you make an account

An account exists so the tools in your space can remember you. There is no password; we email you a six-digit code instead. Depending on which tools you use, your account can hold:

  • Your email address and sign-in records.
  • Your type, your dimension scores, and the results of any re-takes.
  • An optional display name.
  • Journal entries you write.
  • Your conversations with the Coach.
  • Messages you paste into Decode, and the readings produced from them.
  • What you write into "I'm triggered".
  • Your Mirror Letters, weekly Pattern reads, and daily mood check-ins.
  • People you add to your Family Map, with whatever name and type you give them.
  • Your progress through the 30-day Shadow Work programme.
  • Your plan, and a record of purchases.
  • How you first arrived at the site, if a campaign tag was present.

Some of this is unusually personal. That is the nature of the product, and it is the reason the rest of this page exists. Every one of those tables is locked to your own account at the database level, so no other signed-in user can read your rows.

Usage measurement

We count pages and steps so we can tell whether the site works. That measurement is deliberately thin: we store a random identifier for your browser, the page, where you came from, a coarse device class (mobile, tablet, desktop) and a country code. We do not store your IP address and we do not store your email address alongside it.

Alongside that, Google Analytics and the Meta pixel run only if you accept them in the banner. Decline, and neither one loads. You can change your mind at any time from the link at the bottom of any page.

Who else processes your data

We use a small number of providers. Each one only receives what it needs to do its job.

  • Supabase — hosts the database and the sign-in system. Holds everything listed under "account" above.
  • Anthropic — generates the AI readings. Receives the text you put into Coach, Decode, "I'm triggered", Mirror Letter, Pattern and Family Map, together with your type, so it can answer. Anthropic does not use it to train models.
  • Resend — sends email. Holds your email address.
  • Stripe — takes payment. We never see or store your card number; Stripe does. We keep only the identifiers Stripe gives us so we can tell what you bought.
  • Vercel — hosts and serves the site.
  • Google Analytics and Meta — only if you accept the cookie banner.

Some of these providers operate outside the EEA. Transfers to them are covered by the European Commission's Standard Contractual Clauses.

Why we are allowed to hold it

  • To run your account and the tools in it — because we have a contract with you.
  • To take payment and keep the records tax law requires — because we have a contract with you and a legal obligation.
  • To send the email series after you ask for your reading — because you consented, and you can withdraw at any time.
  • To load Google Analytics and the Meta pixel — because you consented in the banner, and you can withdraw at any time.
  • To count pages anonymously and to keep the service from being abused — because we have a legitimate interest in knowing the site works and in not being used to send spam.

How long we keep it

  • Account data — until you delete your account. Deleting it removes your profile, journal, coach history, decodes, triggered logs, letters, patterns, moods, map, programme and results.
  • Email list — until you unsubscribe.
  • Purchase records — kept for seven years, because Icelandic accounting law requires it. This is the one thing that outlives account deletion, and it is reduced to the amount, the date and the transaction identifier.
  • Anonymous usage events — 24 months.

Your rights

You can ask for a copy of everything we hold about you, ask us to correct it, ask us to erase it, object to how we use it, or ask us to hand it over in a portable form.

For the two that matter most we have built buttons rather than making you ask: Download my data and Delete my account are both in your space, under Settings. They work immediately and do not require you to email anyone.

For anything else, write to lily@soulbound.love. If you think we have handled your data badly, you can complain to Persónuvernd, the Icelandic Data Protection Authority, at personuvernd.is.

Children

Soulbound is not built for children and accounts are not intended for anyone under 16. If you believe a child has made an account, write to us and we will remove it.

This is not medical care

Soulbound is not a clinical or diagnostic tool, and nothing it stores is a medical record. If you are struggling with your mental health, please speak to a real human professional. A test on the internet is not a substitute for care. In Iceland you can reach the helpline 1717 at any hour, or call 112 in an emergency.

Changes

If this policy changes in a way that matters, we will say so at the top of this page and, where the law requires it, email you before the change takes effect.