Privacy

Your conversations are private from other users, and private from the assistant itself — it cannot read anyone’s chats but yours. They are not encrypted in a way that would stop the developer team from reading them. We don’t, as a rule. But you should know that the rule is a rule, not a wall.

• Your messages and the assistant’s replies.
• Facts you share that the system can use — a birth time, a preference, a detail about your work — saved to your profile so readings can use them.
• Short summaries of finished conversations, and a small set of durable “memories,” so the assistant doesn’t start from zero each time. You can switch memory off in Settings.
• Ordinary technical records: when requests happened, how long they took, what they cost. These carry no message content. A weekly picture of how the app is being used is built from these records alone — which assistant, how many messages, at what time of day, whether a fact was saved — never from what was said, and never for fewer than five people at a time.

You. Everything in your account is yours to read.

The developer team. They have database access so they can fix things. They don’t read conversations as a rule. If a bug can only be diagnosed by reading a specific exchange, we ask you first.

Not the assistant. The internal tools the developer team uses cannot access chats, memories or feedback.

Other testers: never. Nothing you write appears in anyone else’s account, readings, or results.

Deleting a thread removes the transcript permanently — it is not archived, not backed up, not recoverable by us. It also removes what the conversation produced: its summary, the memories written from it, and the profile facts captured out of it, with any earlier value those replaced put back.

One honest caveat. Memories are occasionally condensed together to stay within a size budget, and a condensed memory is rewritten rather than filed — so a fact from a deleted conversation can survive inside one, in paraphrase. The same is true of a handful of profile facts captured before September 2026, which weren’t recorded with the conversation they came from. Ask and we’ll clear them.

Generating a reply means sending your message to the model providers that run the AI — currently Anthropic and OpenAI — through their business APIs, where submitted content is not used to train their models. Images made for you go to a separate image provider as a text description. Errors and performance data go to our monitoring tools. Nothing is sold, shared with advertisers, or used to train anything of ours.

Things break here, and a broken thing sometimes has to be examined. The system is also still growing new ways to use what it knows about you. Our commitment is that the answer to “who saw this?” is always available and always true — but if something is genuinely sensitive, this is a product under construction, and that is worth weighing.

To see everything held about you, to have it deleted, or to ask who has accessed it: message the team directly. There is no form and no queue — it’s a small enough project that you can just ask.