Privacy

Basketcase keeps only what its features need, never sells or shares it, and shows no ads. There are no analytics or tracking scripts, and the only cookie is the one that keeps you signed in.

What is stored, and why

• Your account: your email, display name and a salted hash of your password (never the password itself), so you can sign in. Each sign-in is a session that lasts 60 days from last use; only a hash of its token is stored. If you turn on two-factor sign-in, its authenticator key, your passkeys and hashed recovery codes are stored too.
• What you save: reading history, favorites, preferences, practice records and notes, journal entries, check-ins (including any questionnaire answers) and books you upload. Only your account can see them. Your journal, check-ins and meditation notes (with their template answers and place) are encrypted in your browser before they’re saved, with a key that belongs to your account: it opens them wherever you’re signed in, including after you reset your password by email. Basketcase keeps that key encrypted with a secret held apart from the database, so a copy of the database alone can’t read them, but Basketcase itself could; it doesn’t look. If you turn on check-in reminders, which questionnaires and how often are encrypted the same way; Basketcase keeps in readable form only when the next reminder is due and, for each browser you allow to show them, its push address. Reminders carry no content, so the push service your browser uses (Google, Apple, Mozilla or Microsoft) learns only that Basketcase sent one. Each app can instead keep your practice in your own iCloud or Google Drive (Keep my practice in, in practice settings): then it goes straight from your device to Apple or Google, in a private space only Basketcase can open, and not to Basketcase’s server, and you can remove what the server already holds.
• Messages you send through the feedback form, with the name and email you choose to give. The site owner reads them, and gets an email copy.
• New accounts: the site owner gets an email with the new account’s name and email.

Some things stay only in your browser and never reach the server: search bookmarks, word choices, the daily journal reminder and a few display settings. Clearing your browser’s site data removes them.

In the phone and watch apps

• iPhone and Android: your practice, settings and notes are saved on the phone, and shared with your account once you sign in to basketcase.io in the app. Notes are encrypted on the phone before they’re sent, the same way as in your browser. The journal, check-ins and reading open the website inside the app, so everything above applies to them. The daily journal reminder is scheduled on the phone (and watch) and never sent to the server.
• Apple Watch and Wear OS: a sitting you finish on the watch waits there until your phone takes it, then joins your path on the phone and syncs from there. The watch never contacts basketcase.io itself.
• Audio you listen with: a file you choose for “Listen with gaps” stays on your device and is never uploaded. The phone apps keep a copy of it inside the app.

Removing an app removes what it saved on that device; anything already shared with your account stays there until you delete it.

What is not stored

Basketcase does not keep your IP address. To slow down password guessing and spam, it counts recent attempts under a scrambled key that changes every day and can’t be traced back to you once that day is over; those counts are deleted within an hour of their limit ending. Error logs are kept for 7 days and don’t record who you are or what you’ve saved.

How long things are kept

• Your account and what you save: until you delete them.
• Feedback messages: one year, unless removed sooner.
• Expired sign-in sessions and rate-limit counts: deleted daily.
• Backups: the database can be restored to any point in the last 30 days, so deleted data fully disappears after 30 days.

Your choices

Under Account you can download a copy of everything you’ve saved, change your password, and delete your account. Deleting it removes everything stored under it at once, including uploaded books, mood entries and feedback you sent while signed in. To ask a question about your data, send a message.

Where it lives

Basketcase runs on Cloudflare, which stores the data encrypted at rest and serves the site only over HTTPS. Texts are fetched from SuttaCentral by the server, so your browser doesn’t contact it while you read.

Image credits

The wheel of life image is from a Tibetan thangka, about 1900, artist unknown, held by the Library of Congress. It is in the public domain.