Privacy
What is stored, and who can reach it
This is a description of the system’s actual behaviour, not a legal policy. It is written from the database schema and the code that enforces access to it.
What is stored
Your account
An email address and a password hash, held by the authentication service. The application stores a profile row and a settings row keyed to your account id.
Conversations and messages
What you write and what the model replies, so a thread keeps its context. Assistant messages record which provider and mode produced them, so you can tell a real response from a simulated one.
Memory
Facts the system has kept, each with its source, the date, a confidence score and the inputs that produced that score. Memory can be switched off entirely, and individual memories can be corrected or forgotten.
Work
Projects, tasks, the steps a task ran, documents, and the timeline of what happened. The timeline is written by the server and is readable by you — it is a record, so you cannot edit it.
Connector credentials
Access and refresh tokens for services you connected, encrypted with AES-256-GCM under a key derived per purpose. They are stored in tables the browser has no read access to at all, and they are never sent to your browser.
Security events
Failed sign-ins, origin mismatches and similar, recorded server-side with a hashed IP rather than the address itself. No client session can read this table, including an administrator’s — an attacker must not be able to watch detection working.
Who can reach it
You can. Every table holding your data is scoped by row-level security to the account that owns it. Another signed-in user querying your rows gets nothing back — not a permission error, an empty result — because the database applies the filter, not the application code.
Your model provider sees what you send it. If you use a hosted model, your prompts and the context attached to them go to that provider under their terms. Privacy modes let you prefer or require a local model instead; when a local-only request cannot be completed, you are told why rather than having it quietly sent elsewhere.
Services you connect see what you ask them to. Each action declares the scope it needs, and the authorisation request asks only for the union of the actions you actually enabled. A connector used for search never asks for permission to send.
Nobody else. There is no advertising, no third-party analytics on the application, and no sale of anything. Credentials never reach the browser, never appear in a URL, and are redacted before anything is logged.
What you control
Read everything
Brain shows every memory with its provenance. Activity shows what ran, when, and what it touched.
Turn memory off
A single setting. Nothing new is remembered, and what exists stays visible until you delete it.
Delete a memory
Any memory can be forgotten, which keeps it inspectable, or deleted outright, which removes it along with its versions, its events and its links. Deletion here is real erasure rather than a hidden flag.
Set a retention preference
A retention period recorded against your account is now acted on: a scheduled job deletes conversations older than it, together with their messages. This page said for some time that nothing read the setting, because nothing did — the job exists now, and the sentence changed with it.
Delete a conversation
Removes the conversation and every message in it, in one operation. Messages are otherwise insert-only so a transcript cannot be quietly edited, which would have made deleting a conversation a half-deletion.
Export everything
One JSON file containing every record this account owns: conversations, messages, memories, projects, documents, tasks, workflows, work items, goals and audit entries. It excludes your provider keys and connector tokens — those are encrypted at rest and never returned to a browser — and the file says so itself rather than leaving you to notice.
Delete your account
Self-service and immediate. It removes your account and everything that hangs off it. Not a flag that hides rows, and not a thirty-day grace period: the data is destroyed. A record that an account was deleted stays in the security log without your identity attached, because an audit trail that disappears on request is not an audit trail.
Disconnect a service
Revokes the stored credential and removes the grants. The connector goes back to “available” rather than pretending to still be connected.
One thing this page is not
It is not a terms of service, and there is not one yet. That is a legal document and it will be written by someone qualified to write it, rather than generated to fill a link in a footer.