Today, we don't read your data, and here is the evidence trail. We are building toward can't.
That distinction is the entire page. Most products in this space write “we take privacy seriously”, which is an adjective and costs nothing to type. What follows is what the architecture actually allows right now, including the parts that are not flattering.
Not the database, and not the backups — but yes, if they work for it. Your files, their history, the answers you typed, your uploads and your digests are encrypted with a key belonging to your account before they reach the disk. The database file is ciphertext. Every backup snapshot of it is ciphertext. The keys that open them are themselves sealed under one master key that lives in the server's environment and is deliberately not in the database — which is why a copy of the backups, on its own, is worth nothing.
Here is the part other companies leave out. The operator administers the machine, so the operator can reach that master key — from the environment file, or out of the memory of the running server. Encryption at rest ends casual reading, ends the stolen backup, and ends the leaked bucket. It does not, and cannot, stop a determined operator on the live box. Only T2 does that, and T2 is not built. No promise we make on this architecture is technically enforceable against ourselves, so we are not making one.
What stands beside the encryption is evidence: every read and write of your persona is written to an access log that you can see, including access by the operator and by system jobs.
Every read, write, append, export and import of persona data: who did it (you in the browser, a named token, or a named system job), which file, and when. That includes the jobs that read you on a schedule — the weekly digest opening a week of your history is a logged read, like any other. The log is written from day one so the history exists.
The precise line, because a near-enough claim is the kind of thing this page exists not to make: your words are never materialised outside a single module that writes the log entry, and a test fails the build if a second way to read them appears. What is notlogged is metadata: counts and timestamps — how many files you have, how many have something in them, when they last changed. The operator's dashboard shows those numbers, and it gets them counted in place, so the words themselves are never in it.
The log is not yet tamper-evident: an operator with database access could edit it. Making that detectable is T1's hash-chained log.
Your persona has an API. Nothing reaches it anonymously: every caller holds a token you created (or connected) yourself, named, scoped to read, write, or append, and revocable on the Tokens page in one click, including a revoke-everything button. Token secrets are stored only as hashes; each token's every access lands in the same log as above. Connecting Telegram binds your chat to your account through a single-use link and gives the collector its own revocable token; disconnecting revokes it immediately. These rows (tokens, bindings) are erased with everything else when you delete your account.
Trust is moved, never eliminated. The strongest claim this product will ever be able to make is precise: the operator cannot access your data, and you need only trust the audited code, the hardware attesting it, and Anthropic's terms. Never “nobody can see anything”.
We tell you exactly what we can technically see, log every access to your persona and show you the log, and make export and deletion real, including in the backups.
Live on this server. Your files, your history, the answers you typed, your uploads and your digests are encrypted with a key of your own before they touch the disk, so the database file and every backup snapshot are ciphertext. The operator can still reach the key on the running machine — that is what T2 removes — but a stolen backup is now worthless, and casual browsing is over. The tamper-evident log half of T1 is not built.
The server runs inside sealed hardware running a published, audited image, so the operator cannot read your persona even by trying. Approved as a goal only.
The database is continuously replicated to a private cloud bucket, and a connected collector keeps its own snapshots. Both are retained for 30 days.
Deleting your account destroys the key your rows were encrypted with, in the same transaction that removes them. So a snapshot taken while you were here does not become readable again by being old — it is ciphertext for a key that no longer exists anywhere, and it ages out on the schedule below regardless.
Before that, you can take it all: one download gives you every file, every past version of every file, your whole access log, the answers you typed before anything distilled them, what you uploaded, and every digest we wrote back — everything we hold about you that is not a credential, and the archive names the credentials it withheld.
So when you delete your account: every row of your persona, its history, your tokens and your access log are erased immediately, and your copies age out of the backups within 30 days. A single content-free record that an account was deleted, and when, is kept so the deletion itself is auditable. 30 days is therefore the honest maximum lag on the deletion promise, and it is stated rather than minimised. Deletion that ignores backups is theater.
One copy is deliberately not erased: if you connected your own GitHub repository, that repository is yours, on your account, and we do not touch it.