Last updated September 23, 2026 · Operated by CBTHero.com
CBT Hero has no accounts, asks for no personal information, and does not store on our servers anything you or a child types into a game. There is no login, no email sign-up, no patient record, and no database of players. The few things that are processed — described honestly below — are either kept on your own device, passed transiently between the two players in a room, or collected as anonymous, aggregate usage statistics.
1. On your own device. Your browser’s local storage keeps a few small items so the game works between visits: your lifetime points and badges, which chapters you’ve completed, a random identifier for each room you’ve joined (so you return as the same player if you reload), and your chosen character. This never leaves your device, and you can erase it at any time by clearing this site’s data in your browser.
2. The real-time relay between two players. When a Guide and a Hero share a room, the current game state — which chapter you are on, which choice was just made, the display name each player typed — is sent through a real-time connection service so both screens stay in sync. This is transient: it lives in memory only for as long as the room is active, is not written to a database, and is discarded when the room goes idle. Room codes are random and are not linked to any person.
3. Anonymous usage analytics. We use PostHog, a privacy-focused analytics service, to understand how the site is used in aggregate — for example how many people visit, which games are started and finished, and whether the invite link is used. This is limited to page views and a handful of named events. It is configured with session recording and automatic click capture turned off; room codes are removed from web addresses before anything is sent; and scores are recorded only as broad ranges, never exact values. Like any web service, the analytics provider and our hosting provider receive standard technical information from your browser, such as your IP address (used to derive an approximate location and then not retained by us), browser type, device type, and the pages requested. These are not tied to any name or account because no name or account exists.
4. Homework codes. After a solo session, a child may choose to generate a short code to share with their therapist. The code contains only which game was played, a score range, and a general topic category (such as “school” or “friends”) plus which scenario felt closest. It contains no name and none of the child’s actual answers. It is generated on the device and is not stored by us; whether and with whom it is shared is entirely the child’s and family’s choice.
The Service is designed to be used by children and teens with a parent, guardian, or professional. Because there are no accounts and we do not ask for personal information, we do not knowingly collect personal information from children under 13 or from anyone else. A display name typed into a room is used only to label that player’s screen during the session and is not stored by us; we encourage using a first name or a nickname. If you believe a child has provided personal information to us in some way, contact us at support@cbthero.com and we will delete it.
We describe CBT Hero as “HIPAA-friendly by design” because it is built so that no protected health information reaches us: no clinical content is entered, transmitted to, or stored by our servers. We are not a health-care provider and, in the ordinary use of the Service, we do not act as a HIPAA covered entity or business associate. Licensed professionals remain solely responsible for their own privacy, security, and recordkeeping obligations, including any notes they keep about a session outside the Service.
We do not use advertising or cross-site tracking cookies. The analytics service described above may set a first-party identifier in your browser so that repeat visits from the same browser are counted once rather than as new visitors; it is not tied to any personal information. Local storage is used as described in section 1.
If we change how the Service handles data, we will update this page and the “Last updated” date above. Material changes will be described plainly here.
Questions about privacy can be sent to support@cbthero.com. This policy should be read together with our Terms of Service.