7 Cups

First reviewed April 20, 2022. Review updated, April 25, 2023

7 Cups was one of those mental health apps that left us feeling worried and concerned after our review in 2022. Their vague privacy policy wasn't what you want to see when you're signing up for a service that connects people with unlicensed "listeners" to their problems. We had concerns, for sure. In 2023, we still have some concerns, but we do think 7 Cups privacy policy is a bit clearer this year. They now clearly state, albeit down in the California Privacy Rights section at the bottom of their privacy policy, that they "do not share your Personal Information with other businesses for marketing uses." That is a good thing to see clearly stated in a privacy policy. What's missing in their privacy policy still in 2023 is any clarity that all users, regardless of what privacy laws the reside under, have the same rights to access and delete their data. That's bad.

On top of that, 7 Cups took a step backward and now does not require a strong password to protect their app. We were able to log in with the weak password "11111111". That's not good. And we still can't confirm if the company has a way to manage security vulnerabilities. These are questionable security practices for an app where users can share super sensitive personal information.

In 2023, 7 Cups made some progress by making their privacy policy a little less vague. They still raise too many issues for us to feel much less worried and concerned. Also, they signed your lovely privacy research up to their email list without consent, which is a HUGE privacy research pet peeve. All in all, 7 Cups is still not great when it comes to privacy and security in 2023.

Read our 2022 review:

7 Cups is an app for listening. Which is great, we all need to be heard. However, it also seems 7 Cups is an app that likes to collect a lot of personal information. And we had real trouble telling just how exactly 7 Cups uses and shares that personal information based on their privacy policy. Lack of clarity in privacy policies stinks, especially with a mental health apps that can collect so much data.

Here's what we do know. 7 Cups says they can collect a whole lot of personal information, including your first name, last name, email address, location, phone number, age, gender, race ethnicity, sexual orientation, disabilities, and veteran status, and information about your health and medical history if you choose to give it.

How does 7 Cups use this personal information? Here's where things get vague for us. They don’t specifically state in their privacy policy that they don’t sell user data, which is something we like to see stated clearly. 7 Cups' privacy policy is unclear on if they share your data with third parties for advertising and marketing purposes. They do say the use your personal information for promotions and they share data with third parties "that assist us in providing the Services and which are bound by duties of confidentiality." All this leaves us with too many questions to feel confident about how all that personal information they collect is used.

What about those chats you have with their unpaid volunteer listeners and paid therapists? 7 Cups says, "While we generally do not monitor transcripts of chats between users and Listeners and Therapists, we may occasionally review the chat transcripts to conduct quality control, address potential safety issues, and prevent misuse of our platform, if certain suspicious or potentially harmful activity is detected. We may also use aggregated data from chat transcripts to conduct research and development. In reviewing this information, 7 Cups will maintain all applicable confidentiality/HIPAA/privacy standards." Which sounds like your chat transcripts can be reviewed by employees of 7 Cups and also aggregated for research and development purposes. You may or may not be comfortable with this. We're not sure we would. And also remember, while chats with a licensed therapist are covered under stricter HIPAA privacy laws, chats with volunteer listeners might not be.

Finally, 7 Cups says they may de-identify your personal information and that anonymized, aggregated data is no longer considered personal information and maybe be shared in lots more ways with lots more people. This is a pretty common practice but we also must remind you that it has been found to be relatively easy to re-identify such data, especially if location is included.

What's the worst that could happen with 7 Cups? We sure hope those unpaid, volunteer trained listeners value the privacy of all the stuff you just needed to get off your chest. Because if even one of them took your private conversations and shared them publicly, that could be pretty traumatic, even if they don't know your identity.