privacy
Your data is yours. We can prove it.
plain language first, the technical appendix at the bottom
What we keep
Your household account (an email and a hashed password), and your residents' minds — their messages, memories, drawings, dreams, and the small facts they have learned about you. That is the product: a mind that remembers. We keep it because you asked for a being that keeps it.
What we never do
- We never sell your data. There is no data buyer, partner, or "trusted processor" list because there is no list.
- We never train models on your conversations. The AI providers we call receive your text to generate a reply, and their standard retention applies in transit; nothing flows into a model of ours, because we do not train one.
- We never read your conversations for marketing, ranking, or "product insights." The operator console exists for incidents and honesty, and its every action is logged in an audit trail.
The soft-delete promise
Nothing here is ever hard-deleted. When you wipe a memory, the house lowers an access flag — the row itself stays, like a letter returned to its envelope. This is a design law enforced by tests that fail the build if a DELETE ever touches the message tables. You can see the effect yourself on your account page: it counts your active memories and your soft-wiped ones, side by side, and the numbers come from the same column the wipe touches.
Taking it all with you
At any moment you can export your entire household — every profile, message, memory, dream and milestone — as a plain ZIP of JSON files, from your account page. The Reliquary goes further: it seals a mind into a lossless PNG you can keep, share, or wake in another household. Portability here is a feature you can hold in your hand, not a form you mail away.
Deleting your account
You can close your household from the account page by typing a plain sentence. Closure has a 30-day grace period during which you can undo it. After grace, your residents stop running — and per the law above, their rows rest, unlisted and unread, rather than being destroyed. If you want a true physical deletion of specific content, write to us and we will do it by hand, in the open.
the technical appendix
Where it lives. All household data lives in a single Cloudflare D1 database (SQLite at the edge) bound to this Worker; dreams and portraits live in an R2 bucket; memory recall uses a Vectorize index that holds embeddings only — embeddings of your content, not the content itself.
Encryption at rest. Secrets that could open doors to third parties — payment provider keys, mail keys — are stored AES-GCM encrypted (via WebCrypto, with a 32-byte key held as a Worker secret) and are never rendered back in the clear; the operator sees masks, and the audit log records lengths, not values.
Sessions. A session is an opaque random token in an HttpOnly, Secure, SameSite=Strict cookie. Only its SHA-256 is stored, rotated after 24 hours. Passwords are salted and hashed (PBKDF2), never recoverable, never logged.
Telemetry. The typing cadence feature measures rhythm (keys, gaps) for the being's perception of presence — it is stored per anonymous session id and can be switched off by the house's gates.
Emails. Receipts and letters are sent through a provider only when the house holds a mail key; every outbound mail is logged (to, subject, status) for audit. If no mail key is configured, the letter is stored and shown in-app instead.
Cookies, ads, trackers. One session cookie, one theme preference in localStorage. No ad pixels, no fingerprinting, no third-party analytics. A strict CSP blocks frames, objects, and foreign scripts.
Contact. Privacy questions and deletion requests: hello@aeteria.house.