Privacy and security
Your world.
Your boundaries.
A personal workspace should make its data choices understandable. Here’s what applies to this website today, and the principles guiding the product we’re building.
A first look, with a light footprint.
This is a public information site. It has no accounts, chat, uploads, payment forms, or mailing-list sign-up.
- The site runs no JavaScript, uses no analytics or advertising trackers, and does not set application cookies.
- Its fonts, styles, and artwork load without third-party embeds. Appearance controls are local to the page.
- Vercel hosts the site and handles the requests needed to deliver it. That includes ordinary connection information such as an IP address; a visit is not an anonymous connection to the hosting provider.
The interactive preview.
The separate “Try it out” frontend runs on sample data. It uses JavaScript to let you explore the interface, but makes no live AI calls or account requests.
Messages, sample edits and the email signup preview stay in the browser’s memory and reset when refreshed. The signup preview clears its email field when continued or closed. Device preferences may remain in browser storage. Microphone capture and browser notifications are disabled in the public preview. Hosting still receives ordinary requests for the app files. Please use sample information.
The choices we’re building around.
- Memory you can understand, revise, and take with you.
- Clear approval at the point where an assistant acts on your behalf.
- Separate treatment for sensitive work, with sharing choices you can see.
- Plain explanations of what the service and its providers receive and retain.
These describe our product direction. The authenticated service is not open yet. Its privacy policy, terms, provider details, and available controls will be published before sign-up opens.
Automated checks. Clear boundaries.
We’re building checks for unsafe requests and malicious instructions before relevant material reaches an assistant or an action proceeds. That is automated processing, not routine staff review of your conversations.
Relevant content may be sent to an approved cloud classifier under the route’s data rules. File malware scanning is a separate server-side step. Checks can withhold a request or pause work; they are not a guarantee that every threat is detected. Repeated or serious policy violations may affect account access.
Security records and any encrypted copies kept for your review have their own retention rules. Human support or appeal review is a separate, authorized path. We will publish the full screening and review policy before the service opens.
Your tools keep their own data rules.
A tool connected through your account is a separate service. You choose which supported folders and private items it may use. That choice may send content to the tool and its provider, under their terms and retention settings.
Our managed-model ZDR policy does not automatically apply to Claude Code, Codex, or another outside tool. Revoking access can prevent future sharing; it cannot promise to erase information that another service already received. Local integrations remain in development.
Your privacy, in plain language.
- What can my employer read?
- Our company-workspace design distinguishes “Personal to each member” from “Held by the company.” Personal work memory and private chats are treated differently from company-held memory, shared project conversations, documents, and uploads. The workspace policy matters; company privacy is not one universal setting.
- Does my assistant send my work to your team?
- Your assistant processes your context to do your work. The product is designed to keep conversation and file text out of product analytics, and your workspace is not a staff browsing feed. Providing the service still means storing account records, searching information, and sending selected context to approved model providers or tools. A private workspace does not mean a separate physical database for every person, or that information never leaves one database.
- When could a person see content?
- You can deliberately submit feedback or selected excerpts, authorize support, or request review of a dispute or appeal. Those are specific access paths, separate from ordinary staff access. Support grants are time-limited and recorded in your account. Company access depends on the workspace policy. Legal processes have separate limits, and some notices may be delayed where disclosure is restricted. The complete access policy will be published before sign-up opens.
- What does zero data retention mean?
- Our model-selection policy requires approved zero-data-retention (ZDR) and no-training routes. ZDR concerns eligible provider processing under specific terms; it is separate from the records saved in your workspace. Models, features, and fallback providers must satisfy the route policy, and provider-specific limits must be checked and disclosed. A ZDR setting is not a promise that every connected website or tool retains nothing.
- What does a dedicated database change?
- It can separate storage. It does not by itself prevent access by the application or isolate every connected service. Dedicated hosting is an option we are exploring, not an available plan.