Our promises, and what proves them

This is a draft. The code has had an internal review, no external audit yet, and the service is not open.

A call lasts about five minutes.

The four-minute signal and the invitation to close go only to the person listening. The software has no path from time to the end of a call in progress. One technical limit: if our whole server goes down, a call in progress holds for another three to four hours.

No recording, and an announced live listening.

The server never receives the voice, and the software has no capture function. A supervisor may listen live to a small share of calls: you are told before the call.

No transcript, no artificial intelligence.

The voice goes from one person to another, encrypted end to end. No service can reach it, and no key leaves your devices in clear.

We cannot hear your calls.

This is true by design, not against a malicious operator: whoever controls the server also controls the code sent to browsers.

Nobody calls you back.

We have neither your number nor your name. A call leaves only closed categories, with no link to a person: a rounded hour, a duration band, a country, a language, how it ended, and whether a risk, help or going over time was noted.

We avoid putting you through to the same person again.

The software refuses to pair one invitation link with one person twice within thirty days. This memory never leaves the server, and it is lost if the server restarts.

At least twenty hours of preparation.

This is a commitment for the opening. The training does not exist yet and will be written with a clinician.