Privacy Notice

1.1 What you give us directly. Your name, email, date of birth, country and timezone; your companion’s name, voice and temperament; everything you write or say to them; your mood entries; and any health information you choose to record.

1.2 What the service generates. Replies, memories inferred from your conversations, and the vector embeddings that let them recall them. Every inferred memory is shown to you with the sentence it came from.

1.3 What we collect to keep the service running. Device and session records, error logs, and coarse usage counts. We do not run third-party advertising or tracking cookies.

2.1 To be the companion you built. Continuity is the product. Without memory, Synora is a chatbot that makes you explain yourself twice.

2.2 To bill you, and nothing more than that. Payment data is handled by Stripe. We never see or store your card number.

2.3 We do not profile you for advertisers. There is no plan under which that changes, which is why the free tier is capped by message count rather than paid for by your attention.

3.1 Every memory carries where it came from. A memory is marked either “you told me”, for anything you typed or stated directly, or “I noticed this”, for anything inferred from a conversation. An inferred memory also shows the quote and the timestamp it came from.

3.2 Editing is allowed, not just deleting. A wrong inference is more common than an unwanted one, and correcting it is the point.

3.3 Deleting a memory deletes its vector too. The row and the embedding behind it are removed in the same transaction. They do not keep a copy elsewhere.

3.4 You can delete by category. All health facts, or all inferred facts, in one action — because someone withdrawing health consent should not have to delete memories one at a time.

4.1 Health information is special-category data. We ask for it separately from the Terms, we record what you agreed to, when, and under which jurisdiction, and we do not process it until you have.

4.2 Withdrawing consent deletes what it covered. Withdrawal takes effect in the same request, including the health-derived memories and their vectors.

4.3 Where a region is unknown, we apply GDPR. Nothing is pre-ticked, in any region.

Nothing you do in crisis mode is logged against you. Opening the breathing screen, reading a helpline list or working through a talk-down produces no analytics event and no record tied to your account, unless you explicitly ask us to keep a note of it.

5.1 This is why crisis sessions are absent from your export. There is nothing to include. We never recorded it.

5.2 Internally it exists only as a count. Our own staff see a seven-day aggregate with no ability to drill into it, and that limit is enforced in the API rather than hidden in an interface.

6.1 Four processors, each with the minimum. Anthropic for the conversation model, ElevenLabs for their voice, Deepgram for speech recognition, and Stripe for payment. Each receives only what its job requires.

6.2 No staff member can read your conversations. There is no “view as user”, and no admin screen can open a conversation, read a memory or see a mood value.

6.3 Support access is yours to grant. If a support case needs context, you grant it explicitly, it is scoped to what is needed, it expires after 24 hours, and every grant and every read is written to an append-only audit log.

7.1 Everything, as JSON plus your voice recordings. The export downloads straight to your device. We do not email it — a link in an inbox is a copy of your health data sitting somewhere else.

8.1 One action, and it runs immediately. No waiting period, no confirmation email, and no “you have 30 days to change your mind”.

8.2 What goes. Your companion, every conversation and voice transcript, every memory and its vector, your health profile, your mood and health history, your plans and journal, and your voice recordings.

8.3 What stays, and only this. Invoices, for seven years, because tax law requires it. They hold a name and an amount — nothing about your health or your conversations.

8.4 An active subscription is cancelled as part of it. We say so before you confirm, including that the current period is not refunded.

9.1 Encrypted in transit and at rest. Access to production data is restricted, logged, and reviewed.

9.2 Memory has a window, and it is enforced by a job. Free keeps 7 days, Companion 90, Inner Circle keeps it until you delete it. Rows past the window are pruned automatically rather than lingering.

10.1 Most rights you can exercise yourself. Access, correction, portability and erasure are all buttons in your account, not a request form and a wait.

10.2 For anything else, write to us. privacy@devoff.dev. You also have the right to complain to your local supervisory authority.