Before you trust a mental wellness app with your journal, check twelve things: what data it collects, whether it sells or shares it with advertisers, whether it trains AI on your entries, how you export and delete, how it protects data, what happens when you delete your account, who can read entries, how therapist sharing works, which trackers run in the app, how it handles breaches, what it does with children's data, and whether the policy is readable. Most answers take ten minutes to find.
Why privacy matters more for mental health apps
The US National Institute of Mental Health (NIMH) lists privacy as an open question for mental health technology. On its Technology and the Future of Mental Health Treatment page it asks how an app maker guarantees users' privacy, given that many apps deal with sensitive personal information. It also notes there are no widely accepted rules or checklists for evaluating mental health apps, which is why this guide gives you one.
Real cases show what can go wrong. In March 2023 the US Federal Trade Commission proposed an order against BetterHelp. The FTC alleged the company shared email addresses, IP addresses and health questionnaire answers with advertising platforms despite promising to limit how it used health data. The proposed order would ban sharing health data for advertising. That is an allegation and a proposed order, not a verdict on every app, but it shows why the questions below are worth asking.
Mozilla's Privacy Not Included team reviewed 32 mental health apps for its 2023 update and reported that 19 of them carried its privacy warning label. Practices it criticised included weak password requirements, sharing data with advertisers, heavy tracker use and vague privacy policies. Two apps, PTSD Coach and Wysa, received a "Best Of" citation. Mozilla's advice was to read the fine print before using these apps.
The 12 questions to ask
1. What data does the app collect?
List what goes in: journal text, voice recordings, mood scores, location, contacts, device identifiers, payment details. Then ask whether each item is needed for the feature you want. A mood tracker does not need your contacts.
2. Is my data sold or shared with advertisers?
This is the most important question. Look for plain wording such as "we do not sell your data" and a clear statement on advertising partners. Be cautious of phrases like "we may share with trusted partners" or "for marketing purposes" with no list of who or why. The BetterHelp case above was about exactly this kind of sharing.
3. Is my content used to train AI models?
If the app has AI features, check whether your entries are used to improve models, by the app or by a vendor. Look for opt-out controls and for a statement about which AI provider processes your text. If the policy is silent, that is a gap to ask about. For background, see AI journaling for mental health.
4. Can I export and delete my data?
You should be able to take a copy of your entries and remove them. Look for an in-app export option and a delete option that does not require a long email exchange. If the only route is "contact support", ask how long it takes and what is confirmed.
5. How is my data protected?
Look for specific statements: encrypted in transit, encrypted at rest, and what login protections exist (strong passwords, two-factor options). "Bank-level security" with no detail is marketing.
6. What happens to my data when I delete my account?
Deleting an account and deleting data are not always the same thing. Ask whether entries are removed from live systems, how long backups are kept, and whether anonymised copies stay behind. A good policy gives a time frame.
7. Who can access my entries?
Besides you, who can see them? Company staff, contractors, AI vendors, support agents? Look for statements about access limits and whether staff can read content for support.
8. How does therapist sharing work?
If an app lets you share with a therapist, check that sharing is opt-in and granular. Ideal: you choose which items to share, you can stop sharing, and your therapist does not automatically see anything. Wholesale access to everything you write is a different, riskier design.
9. Which analytics and advertising trackers are in the app?
Trackers can pass data about how you use an app to third parties. Mozilla's review noted heavy tracker use among some apps. You can usually find a list under "cookies" or "analytics" in the policy. Prefer apps that name their tools and let you decline non-essential tracking.
10. How does the company handle a data breach?
No company can promise a breach will never happen. Check whether the policy says how and when users are told, and whether there is a contact for security reports. Silence on breaches is a weak sign.
11. What does the app do with children's data?
Check the minimum age. If teenagers might use the app, look for a statement on how data from minors is handled. If an app is not designed for children, it should say so clearly.
12. Is the policy readable, and does it match the marketing?
A policy you cannot understand is a finding in itself. Compare the homepage promises with the legal text. If the homepage says "private" and the policy says "we may share with affiliates and partners", trust the policy. Check the "last updated" date and whether the company explains how it will tell you about changes.
A 10-minute policy check
You do not need legal training. Open the privacy policy and the app store listing and do this:
- Minutes 1-2: Find the policy and check the date. Note whether it is a full policy or a short summary.
- Minutes 3-4: Search the page (Ctrl+F or Cmd+F) for "sell", "advertis", "partner" and "third part". Read each hit.
- Minutes 5-6: Search for "delete", "export" and "retention". Note whether the steps are in-app or by email.
- Minutes 7-8: Search for "AI", "train", "improve" and "model". Note what is said about your content.
- Minute 9: Check the app store privacy label (data used to track you, data linked to you) and compare it with the policy.
- Minute 10: Look for a contact address and send one question. A prompt, clear reply is a good sign.
NIMH also suggests trying an app for a few days and checking the developer's background, and notes it does not endorse any apps. Treat privacy as one part of that wider choice. Our comparison of the best mental wellness apps in 2026 can help with the rest.
Red flags
- No privacy policy, or one that is only a marketing paragraph.
- Questionnaires about your mental health before you can see how the data is used (Mozilla criticised this pattern in its review).
- Language such as "we may share with partners" with no definitions.
- No way to delete your data without emailing support and waiting.
- Claims of security or compliance with no named standard.
- Heavy advertising or tracking prompts inside a mental health app.
What to do if you are unsure
You can still use an app carefully:
- Start light. Use mood scores or short notes before writing anything very personal.
- Leave out identifiers. Skip full names, addresses and employer details in entries.
- Use a strong, unique password and any two-factor option offered.
- Ask a direct question by email and read the reply for clarity.
- Choose a paper journal for your most sensitive material. There is no shame in that.
When to get support
A privacy checklist is not a substitute for care. If you are struggling, a licensed mental health professional can help. If you are in crisis or thinking about harming yourself, contact your local emergency services or a crisis line in your country right away. Symplia is not therapy and not an emergency service.
Sources and further reading
- Technology and the Future of Mental Health Treatment - NIMH on privacy as an open concern, the lack of evaluation standards for apps, and tips for choosing one.
- Shady Mental Health Apps Inch Toward Privacy and Security Improvements, But Many Still Siphon Personal Data - Mozilla's 2023 review of 32 mental health apps and the practices it criticised.
- FTC to Ban BetterHelp from Revealing Consumers' Data, Including Sensitive Mental Health Information, to Facebook and Others for Targeted Advertising - the FTC's allegations and proposed order about sharing health data for advertising.
Where Symplia fits
Symplia is a private mental health app for journaling, mood tracking and therapy support. Its privacy page states that your journal, mood entries and session notes belong to you, that Symplia does not sell your data, and that data is encrypted at rest and in transit. It also states that data is shared with a therapist only if you choose to share it, item by item. The page says a full policy is being finalised, so for questions on topics such as export, deletion or AI processing, email hello@symplia.app and apply the checklist above to the answer. You can also browse the FAQ or read what a therapy companion app is.
Try Symplia free at app.symplia.app. Monthly and Annual plans include a 7-day free trial.
Frequently asked questions
What is the most important privacy question to ask a mental health app?
Ask whether your data is sold or shared with advertisers. Look for a plain statement in the policy, and be cautious of vague wording about partners or marketing. The FTC's 2023 BetterHelp action concerned this kind of sharing.
Does a privacy policy guarantee my data is safe?
No. A policy describes what a company says it does, and no company can promise a breach will never happen. It is still a useful test of how clear and specific the company is willing to be.
Can I use a wellness app privately and still share with my therapist?
Yes, if the app lets you choose what to share. Look for opt-in, item-by-item sharing so your therapist sees only what you decide to send.
Should I put my most sensitive thoughts in an app at all?
That is your call. If you are unsure, start with lighter entries, leave out identifying details and use a paper journal for the most sensitive material.
How do I ask an app about its AI and data practices?
Email the support or privacy contact with specific questions: are my entries used to train models, who processes them, and how do I export or delete them. A clear, direct answer is a good sign.
