Privacy Policy

1. Who this covers

Two different people appear in this policy and they are not in the same position.

The account holder is our customer. They signed up, they agreed to the Terms, and they chose to connect a conversation.

The other person is whoever the account holder is talking to. They are not our customer. They did not sign up and they have not agreed to anything. Most of what follows exists because of that.

2. What we collect from the account holder

An email address, taken at signup or from the interest list.

A description of how they write, built from their own messages in the conversations they connect. The messages are read to build it and the description contains no quoted message; it is theirs to read and rewrite.

Their standing instructions for a conversation.

Telegram session credentials, which authenticate as their account. These are stored encrypted, under a key that is kept apart from the data it protects, never written to logs or error reports, and destroyed when the connection is removed.

Ordinary service records: billing, sign-in times, support correspondence.

3. What we process about the other person, and the problem with it

To reply in a conversation, the service reads that conversation. That means we process messages written by someone who never agreed to us reading them, and who may not know the service exists.

We are not going to pretend that consent from the account holder is consent from both of them. It is not. Where the law requires the other person's own consent — and in some places it does — the account holder is the one who has to obtain it, and the Terms make that their obligation. It is also possible that in some jurisdictions this service cannot lawfully be used at all.

What we can control, we do. We read only the conversations the account holder connects, filtered at the point of ingestion; every other conversation in their account is discarded before it reaches storage. We do not build a profile of the other person, sell anything about them, or use their messages to train models.

4. How long we keep it

Conversation content is retained for 12 months and then deleted automatically.

Deleting a connection deletes its conversation, its instructions and its scheduled queue, and destroys its session credentials. The description of how the account holder writes belongs to the account, not to any one connection, and is deleted with the account.

Audit records of when a rule blocked or shaped a message are kept longer, because they are the only way to answer a dispute about what the service did. They record the event — which rule, what it decided, and when — not the message that triggered it or the conversation around it.

5. Who can see it

The account holder can see everything about their own connection.

Internally, access to conversation content is role-limited, logged, and used only to investigate a fault or a safety report. It is not browsed.

We use third parties to run the service: Render and Vercel for hosting, MongoDB Atlas for storage, Anthropic, OpenAI and xAI for model inference, Resend for email, and Stripe for payments. Each processes what it needs to and nothing more, under contract, and conversation content reaches only the inference providers, only to write or check a reply.

We will disclose content if we are legally compelled to, and we will tell the account holder unless we are prohibited from doing so.

6. Rights, including the other person's

The account holder can access, correct, export, or delete their data from their dashboard.

The other person can ask us to delete their messages through Contact Support, choosing the data request topic. That request does not go through the account holder, is not shown to them, and does not need their agreement. We will also confirm to the other person whether a connection involving them exists, because refusing to answer that question would be the more harmful choice.

Either party can complain to their data protection authority.

7. Security

Conversations are encrypted at rest and in transit. Session credentials are encrypted under a key held apart from the data, are scrubbed from logs and crash reports, and are replaced whenever an account holder pairs again.

No system is perfect. If we suffer a breach affecting conversation content, we will notify affected account holders and the relevant authority within the periods the law requires, and we will say what actually happened.

8. Children

The service is for adults. An account holder must attest that the other person is an adult before a connection can be switched on. If we learn that either party is a minor, we delete the connection and its data.

9. Who we are, changes and contact

996 Butler is operated from British Columbia, Canada, and is the party responsible for the data described here.

Material changes are announced to account holders before they take effect, and the date at the top of this page changes with them.

Reach us through Contact Support.