legal.security.hero.title

Messages, memories and other sensitive content are encrypted with AES-256-GCM before storage. AES-256-GCM is a widely used, strong encryption method that is also used in high-security environments. The encryption key is kept in a separate environment, not in the database — even if the database leaked, without the key the messages are random strings. Encryption happens on the server before storage, and transfers use TLS 1.3.

Conversation summaries and titles are anonymised automatically. Real personal names are replaced with generic terms (e.g. "a close person", "supervisor") and place names with generic terms (e.g. "workplace", "hometown"). Original messages are stored only encrypted. Anonymisation happens before the AI model sees a summary — as little identifiable information as possible is passed to third parties.

Row Level Security rules ensure at the database level that no other user can see your data. There are over 70 such rules, covering every table where user-specific data appears. All access is logged to an audit trail. IP addresses are stored only as SHA-256 hashes — helps abuse investigation without retaining the original IP.

Your messages are not used to train AI models. Contracts with our providers (Anthropic, OpenAI, Groq) prohibit using your data for model training — API data is kept up to 30 days for abuse monitoring, then deleted. We don't send your name or email to the AI. Logs don't store message content, only metadata (timestamp, model name, response time).

You can download all your data as JSON at any time (Settings → Export my data). You can set automatic deletion every 90 days or 1 year. You can withdraw consent to individual processing purposes or delete your whole account — the deletion job runs within 30 days, after which identifiable data is removed, except data we are legally required to retain (see Privacy Policy).