Privacy Policy

What we collect

When you sign up, we collect your account details: email, name, and the business or profile facts you share during onboarding (like your north star or biggest leak), so your companion can use them in every conversation. We also store your chat identity, so we know where to send a reply.

When you talk to your companion, two processors see what you send because the product can’t work without them: Telegram, the chat platform itself, delivers every message; Anthropic, whose Claude models (see “Model provider” below) generate the reply, using your account and profile details and what your companion already remembers about you alongside your message, and checks for anything new worth remembering, like a goal or commitment. Neither is used for anything beyond that. We do not run ads, sell your data, or share it with any other third party.

If you joined the Uno waitlist before becoming a founder, we keep your email and name until you’re invited or you ask us to remove them, and, if our mailing list is configured, add you as a contact there. Neither is linked to a founder account unless and until you actually onboard.

If you’ve connected Google, we also process the calendar and Drive content needed to write your daily brief, plus your connected Google account email and encrypted access tokens (see “Google user data” below).

How long we keep it

Full conversation exchanges are encrypted and held for 72 hours, then purged automatically by the database itself. This clock governs our own database copy only; Telegram keeps its own record of your chat history outside our control, the same as any messaging app, and Anthropic keeps its own copy of what we send it (see “Model provider” below). There is one narrow, rare exception to our 72-hour purge: if a specific exchange is the subject of an active safety, abuse, or legal review, that one exchange is held only until the review closes. It’s never a blanket hold on your history, and it’s always logged, so it stays accountable, not invisible. Each stored exchange also freezes your privacy settings at the moment it was written (a “consent snapshot”), so changing a setting later never retroactively changes how an older message was treated.

Beyond that 72-hour window, four kinds of facts can be kept long-term, none purged on a timer: your account details and profile facts, kept while your account is active; which Drive files or save folder you’ve picked (their name and Google file ID, never their content), also kept while your account is active; goals, commitments, and similar operational memory your companion needs day to day; and, only if you’ve opted into product-improvement learning, the abstracted behavioral facts described in “How learning works” below. Full transcripts are never kept this long.

Your controls

You can see your key profile facts (business, north star, biggest leak) and your companion’s current behavioral pattern with /status, and change any editable profile field with /update-profile. You can see everything stored as durable memory with /memory, and delete any single entry yourself with /forget. Behavioral patterns themselves aren’t yet individually removable this way; email us if you’d like one cleared. No request to us is required for the rest.

For a full export or full account deletion, email labs@chiibitsu.com. Deleting your account removes your profile, memory, Google connection, and conversation history. Three narrow exceptions: some operational job records (like a scheduled brief run or a Drive save) can persist with your account link removed but a job or document identifier still attached, never your messages, never anything about your conversations; if you joined through an invite, the record that your email was invited isn’t linked to your account and isn’t part of this deletion; email us if you’d like that removed too; and if an anonymized pattern built in part from your opted-in data was already approved into the Aikiri Network before you deleted your account, that guidance can keep helping other founders. By design it carries no link back to you, so there is nothing left to delete.

How learning works

By default, nothing you say is used to improve the product. That only happens if you turn it on. If you opt into product-improvement learning, only abstracted behavioral facts (never your raw words) ever get used: to make your own companion work better, and, only after anonymization and a human’s approval, to help shape patterns across the Aikiri Network (more on that below). Strict confidential mode blocks product learning and exploratory human review entirely, enforced in code, not just written policy. It doesn’t change the basics every message still needs: generating your reply, and remembering what you’ve told it (like a goal or commitment) so your companion keeps working day to day.

Anonymized, aggregated patterns, never tied to your identity, may be proposed for the Aikiri Network, Lighthouse’s cross-user learning system. Nothing from it reaches anyone else’s product until a human at Chiibitsu Labs manually approves it. There is no automatic propagation, ever.

Google user data

If you connect Google, we request only read-only calendar access and access to the specific Drive files you choose to share with your companion (Google’s drive.file scope). We never touch your whole Drive. Calendar and document content is used solely to build your daily brief; it is not retained beyond the retention window above, and it is never used to train any general-purpose model. On-demand questions about your calendar or documents in chat are a planned, not yet shipped, capability.

Chiibitsu Labs’ use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Model provider

Brief generation, extraction, and conversation all go to one provider, Anthropic, whose Claude models generate that reply. Anthropic acts as our service processor and uses what we send only to produce that reply, never to train its models. Anthropic keeps its own copy of API inputs and outputs for up to 30 days by default, longer only where its usage policy enforcement or a legal obligation requires it; we have no zero-retention agreement with Anthropic, so that copy sits outside our 72-hour purge, the same as Telegram’s. We hold no API keys with any other AI provider.

Changes to this policy

If this policy changes in a material way, Chiibitsu Labs announces it directly in your companion’s chat: the same broadcast channel used for every other product announcement, not a footnote you’d have to go looking for. The effective date below always reflects the latest version.