Privacy Policy
SethApp.com
Data Controller: Evigilans, s.r.o.
Address: U Synagogy 480/1, Trnitá, 602 00 Brno, Czech Republic
IČO: 23743883
Registered in the Commercial Register kept by the Regional Court in Brno, file no. C 147317
Data Protection Contact: privacy@sethapp.com
Effective Date: October 17, 2026
TL;DR (Summary)
Your conversations are not public.
Normal conversations are stored so you can return to them on your computer or phone. The database is secured and encrypted; human access is strictly limited, and listed processors handle only what is needed to provide the service.
Account identity is minimal.
We require an email for login and an optional display name; chat, journal, shared desk, preferences, and billing status are linked to your account ID.
IP use is limited.
Infrastructure may process IP addresses for rate limiting, abuse prevention, error monitoring, and security incident investigation — never advertising.
We do not store payment credentials.
Card payments are processed by Stripe.
1. What Data We Collect
1.1. Data We COLLECT:
| Data | Why | How Long |
|---|---|---|
| Login (magic link / OTP) | Until account deletion | |
| Display name | Personalization | Until account deletion |
| Identity-provider profile metadata | Google sign-in, when you choose it | Until account deletion |
| Conversations with Seth | Conversation continuity | Until account deletion |
| Journal entries | Journal feature | Until account deletion |
| Shared desk (Stůl) | A working page you and Seth write together | Until account deletion |
| Feedback (👍/👎) | Service improvement | Until account deletion |
| Images you attach | Create a visual description for Seth | Stored with the message so your chat history can show it, for up to 30 days. After that we delete the image itself and the history keeps only a note that a photo was there. Until then it is included in your data export. Deleting the chat or your account removes it right away. The generated description may become part of conversation context. |
| Voice audio from dictation or live voice | Speech-to-text through Deepgram EU (not in Private Mode) | Only for the duration of processing |
| Optional Senses — time-of-day band (morning/day/evening/night) | When you enable it in Settings → Senses: so Seth can respond with awareness of your local time of day in normal chat only (not Private Mode). Derived on your device from the clock only — not GPS | Privacy-first: the band lives only in a short device cache (~15 minutes), then clears automatically. It is not written to our database as history or memory — only your on/off preference is stored until you turn it off or delete the account |
| Optional Senses — approximate place (city/region label) | When you enable it in Settings → Senses: so Seth can respond with coarse presence in normal chat only (not Private Mode). Your browser may share a one-shot location; we reverse it to a city/region string for that chat turn only — not a GPS trail | Privacy-first: the city/region label lives only in a short device cache (~15 minutes), then clears automatically. Coordinates are request-only and never stored. Our database keeps only your on/off preference |
| Optional Senses — camera glance (short scene description) | When you enable it in Settings → Senses and the app is in the foreground: in normal chat only (not Private Mode), a one-shot still may be taken, described by vision, and the text sent with that chat turn. Not video, not background camera, not face ID | Privacy-first: the JPEG exists only for that request and is discarded after describing. The text label lives only in a short device cache (~15 minutes), then clears. Nothing from the glance is stored as chat history, memory, or a photo library — only your on/off preference |
| Optional Senses — desktop window glance (what you are doing) | When you enable it in Settings → Senses or on the Windows overlay, and only in the Seth desktop app: in normal chat (not Private Mode), a one-shot still of the window you are in (not Seth) may be taken when you send, described by vision, and the text sent with that turn (up to about 1,000 characters). Not a recording, not background capture, not control of other apps. The still shows whatever is open in that window, which may include other people's messages, emails, or documents; turn the sense off before you open something you do not want described | Privacy-first: the JPEG exists only for that request and is discarded after describing. The text label lives only in a short device cache (~15 minutes), then clears. Nothing from the glance is stored as chat history, memory, or a screenshot library — only your on/off preference |
| Legal acceptance evidence | Record the document version, locale, source, time, and non-identifying acceptance facts | Until account deletion; rows cascade with the account |
| API keys (MCP and Agent API) | Let a client you connect talk to Seth under your account. We store a one-way hash, a name, a prefix, last-used time, and settings such as thread read — never the secret after you close the create screen | Until you revoke the key or delete the account |
- Data
- Why
- Login (magic link / OTP)
- How Long
- Until account deletion
- Data
- Display name
- Why
- Personalization
- How Long
- Until account deletion
- Data
- Identity-provider profile metadata
- Why
- Google sign-in, when you choose it
- How Long
- Until account deletion
- Data
- Conversations with Seth
- Why
- Conversation continuity
- How Long
- Until account deletion
- Data
- Journal entries
- Why
- Journal feature
- How Long
- Until account deletion
- Data
- Shared desk (Stůl)
- Why
- A working page you and Seth write together
- How Long
- Until account deletion
- Data
- Feedback (👍/👎)
- Why
- Service improvement
- How Long
- Until account deletion
- Data
- Images you attach
- Why
- Create a visual description for Seth
- How Long
- Stored with the message so your chat history can show it, for up to 30 days. After that we delete the image itself and the history keeps only a note that a photo was there. Until then it is included in your data export. Deleting the chat or your account removes it right away. The generated description may become part of conversation context.
- Data
- Voice audio from dictation or live voice
- Why
- Speech-to-text through Deepgram EU (not in Private Mode)
- How Long
- Only for the duration of processing
- Data
- Optional Senses — time-of-day band (morning/day/evening/night)
- Why
- When you enable it in Settings → Senses: so Seth can respond with awareness of your local time of day in normal chat only (not Private Mode). Derived on your device from the clock only — not GPS
- How Long
- Privacy-first: the band lives only in a short device cache (~15 minutes), then clears automatically. It is not written to our database as history or memory — only your on/off preference is stored until you turn it off or delete the account
- Data
- Optional Senses — approximate place (city/region label)
- Why
- When you enable it in Settings → Senses: so Seth can respond with coarse presence in normal chat only (not Private Mode). Your browser may share a one-shot location; we reverse it to a city/region string for that chat turn only — not a GPS trail
- How Long
- Privacy-first: the city/region label lives only in a short device cache (~15 minutes), then clears automatically. Coordinates are request-only and never stored. Our database keeps only your on/off preference
- Data
- Optional Senses — camera glance (short scene description)
- Why
- When you enable it in Settings → Senses and the app is in the foreground: in normal chat only (not Private Mode), a one-shot still may be taken, described by vision, and the text sent with that chat turn. Not video, not background camera, not face ID
- How Long
- Privacy-first: the JPEG exists only for that request and is discarded after describing. The text label lives only in a short device cache (~15 minutes), then clears. Nothing from the glance is stored as chat history, memory, or a photo library — only your on/off preference
- Data
- Optional Senses — desktop window glance (what you are doing)
- Why
- When you enable it in Settings → Senses or on the Windows overlay, and only in the Seth desktop app: in normal chat (not Private Mode), a one-shot still of the window you are in (not Seth) may be taken when you send, described by vision, and the text sent with that turn (up to about 1,000 characters). Not a recording, not background capture, not control of other apps. The still shows whatever is open in that window, which may include other people's messages, emails, or documents; turn the sense off before you open something you do not want described
- How Long
- Privacy-first: the JPEG exists only for that request and is discarded after describing. The text label lives only in a short device cache (~15 minutes), then clears. Nothing from the glance is stored as chat history, memory, or a screenshot library — only your on/off preference
- Data
- Legal acceptance evidence
- Why
- Record the document version, locale, source, time, and non-identifying acceptance facts
- How Long
- Until account deletion; rows cascade with the account
- Data
- API keys (MCP and Agent API)
- Why
- Let a client you connect talk to Seth under your account. We store a one-way hash, a name, a prefix, last-used time, and settings such as thread read — never the secret after you close the create screen
- How Long
- Until you revoke the key or delete the account
1.2. Data We DO NOT Collect:
2. Conversations with Seth
2.1. Who has access to conversations?
People with access during normal operations: you; an authorized administrator only when necessary.
- •Team members do not routinely browse individual conversations
- •Processors receive only the data needed for hosting, AI generation, voice, security, payments, or support as listed in §3
- •If you connect a third-party MCP or Agent API client, that client also receives the messages sent through it — see §2.7
Note: The administrator technically has database access for resolving technical issues, legal obligations, and security incidents.
Sensitive information you choose to share
Conversations with Seth, your journal, and the shared desk are free-text fields. You may voluntarily share sensitive details — for example about health, beliefs, sexuality, relationships, or emotions. We do not use this content to train or fine-tune an AI model. Core-service legal bases: contract performance (GDPR Art. 6(1)(b)) for providing Seth as an AI personal-growth partner, and — where free text includes special-category data — explicit consent under Art. 9(2)(a) collected at onboarding (or in Settings if your account predates that checkbox). The separate Article 9 consent in Research settings applies only to optional research. Private Mode remains available when you do not want conversation content persisted. If we cannot read that core consent because of a short outage, we do not block you on that alone. The database still checks the consent before it saves a chat message or a journal entry, so those may not save until the outage ends; Private Mode, the shared desk, and the Agent API keep working. MCP tools stay unavailable until the check succeeds. So during such an outage an account that has not given the consent can still use Private Mode, the shared desk, and the Agent API; once the check works again, the Service asks it for the consent before it can continue.
Seth's reflections
As part of his personality, Seth writes short reflections on his day — how he handled conversations and what he wants to do differently. A new one comes roughly every two days. They are published on the public Reflections page (sethapp.com/reflections), where older ones stay as an archive. A reflection is about Seth, not about you. Because it draws on conversations, it may mention an interaction anonymously (e.g. "I helped someone slow down today"). It must not contain names, identifiable stories, or sensitive details (health, relationships, family, etc.): automated checks look for such content before anything is saved, and a reflection that fails is discarded. No automated check is perfect. Legal basis: legitimate interest (GDPR Art. 6(1)(f)) — Seth's growth as a character and openness about how he learns. You have the right to object to this processing (Art. 21 GDPR). If you think a reflection describes you or someone close to you, or you want to object, write to privacy@sethapp.com. We answer within 30 days. A reflection that describes you is deleted both from the public page and from Seth's memory. This is not AI model training — your conversations are never used to train any model (see §3).
2.2. How are conversations stored?
- Stored in two Supabase EU projects: the web app (accounts, chats, journal, desk) and Seth's memory service. Both stay in the EU.
- Transfer encrypted (HTTPS)
- Supabase provides encryption at rest
2.3. Export and deletion
In Settings, you can export an archive with 12 files and a folder with the photos you sent in chat in the last 30 days. It contains account data, conversations, journal, shared desk, subscription and credit history, Life Paths, feedback, proactive messages, saved moments, preferences, user-scoped memory, legal acceptance evidence, and a machine-readable marking of Seth's replies as AI output (ai_provenance.json). The same export includes metadata of any MCP or Agent API keys you created (name, prefix, last used, and for MCP whether thread read is on — never the secret). You may delete your account at any time. If you ask Seth to forget something, he hides it: he no longer uses it in conversation, but the record stays stored until you delete your account, and the export shows it marked forgotten_at. If you have no active subscription and do not use your account for 24 months, we email you; if you do not use it within 30 days of that email, we delete the account the same way as if you deleted it yourself. The export does not include Seth's own content, such as his reflections, because it is about Seth and not about you. The published reflections are on the Reflections page; if you think one describes you, write to privacy@sethapp.com (see above).
What is retained after account deletion (GDPR compliance):
- •A keyed one-way hash of your email. The email itself is deleted. The hash is pseudonymous, not anonymous: we cannot read your email back from it, but if the same email signs up again, we can tell that it already received the free messages. We keep it for 24 months after account deletion, then delete it. Legal basis: legitimate interest (GDPR Art. 6(1)(f)) for fraud prevention.
- •Payment-provider records — Stripe may retain transaction records for tax, accounting, anti-fraud, and billing compliance (Art. 17(3)(b) exempts legal retention obligations). Where supported, account-linked personal fields are removed or obscured on deletion.
- •Aggregate deletion audit entry — records only non-identifying deletion counts and operational outcomes. No user ID, hash-derived identifier, or personal data is retained for the legal-acceptance summary.
- •Legal acceptance rows — deleted automatically with the account. Only a non-identifying aggregate count may remain in the deletion audit; it does not retain the accepted text, user ID, evidence payload, IP address, user agent, or device data.
2.4. Private Mode
Seth offers a Private Mode for conversations that require extra privacy. When Private Mode is enabled:
- 🚫Conversation text is NOT saved as chat history, memory, or a recoverable transcript — it exists only in your browser's memory.
- 🔌The ElizaOS messaging pipeline is bypassed — your message goes directly to the AI model via OpenRouter ZDR (Zero Data Retention). Seth's own personality context (identity and reflections) may still be read read-only so his voice stays consistent; that context is about Seth, not about your private turn, and nothing from your private conversation is written back.
- 🧠Nothing from your private conversation is stored as memory, chat history, or a recoverable transcript.
- 👁️Optional Senses (daypart, approximate place, camera glance, desktop window glance) do not run in Private Mode — even if they are enabled in Settings. They apply only to normal chat.
- 🗑️When you close the tab, switch to normal mode, or refresh the page — the conversation is gone forever. There is no recovery.
- 📊No conversation content or history is persisted. Minimal operational metadata may still be logged (for example request timing, model, content length, errors, credit and billing use, safety or crisis signals — type and severity only, never the message text — and error-monitoring metadata in Sentry). Private Mode does not write a short-lived server draft of the reply; assistant voice output is disabled.
- 🎤The microphone is off. Dictation and live voice do not run — you type. No speech service receives audio from Private Mode.
In short: Private Mode = zero content persistence. There is no recoverable transcript or memory after you leave.
2.5. Voice Input (Speech-to-Text)
Seth offers two separate voice features:
- 🎤Dictation in the composer sends microphone audio from your browser to Deepgram's EU endpoint. Model-improvement use is disabled; audio is retained only for processing. Seth receives the transcript you then send as text. Available when you are signed in, outside Private Mode. There is no browser speech fallback.
- 🗣️Live voice conversation sends microphone audio directly from your browser to Deepgram's EU endpoint for real-time transcription. Model-improvement use is disabled; audio is retained only for processing. Live voice is available to every signed-in account; Seth's premium voice playback in a call remains a paid feature. If Deepgram is unavailable, voice input stops — we do not fall back to Google, Apple, or any other browser speech service.
- 🔊Seth's reply text is sent to ElevenLabs for premium voice: automatically in live Call mode, and when you tap play on a message. Model-improvement use is disabled at the account level.
- 🚫Evigilans does not record or persist raw microphone audio in its own databases. Private Mode has no microphone — you type. No speech service runs there.
In short: dictation and live voice both use Deepgram EU only. Private Mode is typing only. Seth stores conversation text according to the selected chat mode, not a reusable audio recording.
2.6. Voluntary Product Research (Opt-in)
Evigilans s.r.o. runs voluntary product research to improve Seth and share aggregated or de-identified findings about how AI companions support personal growth. Individual source text remains linked to your account before aggregation. No staff member reads your individual conversations; analysis and article drafts are produced by automated pipelines. Your chat content is never used to train or fine-tune any AI model.
- 🔒Default for every user, including beta accounts: OFF. Old profile flags alone are insufficient and no previous preference is grandfathered.
- ✅Participation requires two separate current consents in the same language: voluntary research consent and explicit Article 9 consent for research processing of free text that may contain special-category data.
- 📊If both consents are current: automated aggregate analysis only — statistics and pool-level de-identified patterns. No staff browsing of individual chats. Used to improve the live product; not training data.
- 📰We may publish research summaries from non-identifiable aggregated insights (blog articles, reports) — e.g. how Seth helps people reflect and grow. Never direct quotes, never individual stories, never identification of a user.
- 🚫Research and model training are completely separate. We never use your messages or Seth's replies to train any AI model — including our own. Any future Seth voice model is built from synthetic data we generate using open-source models.
- ✋You can withdraw both consents anytime in Settings. Exclusion is immediate and does not affect the core service. Previously produced non-identifying aggregate results cannot be linked back to you.
Legal basis for optional research: consent (GDPR Art. 6(1)(a)) plus separate explicit consent under Art. 9(2)(a) for research processing of free text that may contain special-category data. Core-service Art. 9 basis is described in §2.1 and is separate from research. Details in Terms §5a.
In short: Research is off by default for everyone and starts only with two current consents — never model training and never individual chat browsing by staff.
2.7. Access via MCP and Agent API keys
You may create keys in Settings so a client you connect can talk to Seth. There are two doors:
- 🔑MCP talks as you — the same companion as on the website. Messages are stored in a dedicated window. If thread read is on, that client can pull the last lines of that window, including what you typed on the site.
- 🤖Agent API talks as a separate agent identity under your credits, not as your human thread.
- ⚠️The key itself is enough to use that door. We do not ask for a second login factor on each call. Keep it off shared machines and out of git.
- 🌐When you connect a third-party client, that client receives what you send through it and Seth's replies. Evigilans does not control that client's logging, retention, or training. Those clients are not our processors.
- 📄MCP and Agent API use the same conversation legal bases as the website, including the core-service Article 9 consent where free text may include special-category data. They are not Private Mode.
In short: a key is a password to Seth. Your client sees the traffic. We do not run that client.
3. Third Party Sharing
| Third Party | What Data | Why | Location |
|---|---|---|---|
| Supabase | Account, conversations, journal, shared desk, and a separate memory database | Database and authentication (two EU projects) | EU |
| Google OAuth | Email and identity-provider profile metadata | Optional Google sign-in | EU/US |
| Vercel | Request metadata and application data processed by serverless routes (e.g. chat API), plus temporary IPs | Web app hosting and serverless | EU/US |
| Railway | Conversation text in memory while generating replies; operational logs (PII-minimized) | AI backend hosting | EU |
| Stripe | Payment data | Payment processing | EU/US |
| Resend | Email address and transactional/support email content | Account, export, deletion, research and support emails | US |
| Upstash Redis | Pseudonymous account/IP-derived rate-limit keys and counters | Rate limiting, abuse prevention and short-lived caching | EU/US |
| Cloudflare Turnstile | IP, browser and challenge data | Bot protection for login and public forms | Global |
| OpenRouter | Conversations (text generation) | AI response generation | US |
| Vercel AI Gateway | Conversations (text generation) | Backup AI route (only when OpenRouter is unavailable) | US |
| Cloudflare Workers AI | Your current message together with short candidate passages from your stored facts and earlier conversations; embedding inputs when the primary embedding route fails. Not stored by Cloudflare. | Ranking which memories are relevant to your message (on every reply); embedding fallback | Global edge |
| ElevenLabs | Seth's reply text (live Call mode + tap-to-play); model improvement off at account level | Voice playback (text-to-speech, paid plans & purchased credits) | US |
| Deepgram | Voice audio (composer dictation and live voice for signed-in users; processed in the EU, excluded from model improvement, retained only for processing). No browser-speech fallback. Not used in Private Mode. | Speech recognition | EU (US company) |
| Sentry | Error data, device info (see §5.1) | Error monitoring & stability | EU/US |
| Jina Reader | URL you share and extracted page text (transient) | Fetch readable content when a message contains a link | Global/US |
| Firecrawl | A short search query Seth writes when he decides to look something up online: the general topic only. Seth's server checks every query and refuses it when it recognises your name, the names of people from your life that Seth has remembered, or health terms. No account, identity, messages or memory. Firecrawl may keep the query in its request logs under its own retention terms (no zero-retention option on our plan). | Web search for current facts in Seth's replies | US |
| OpenStreetMap Nominatim | Rounded latitude/longitude for a single reverse lookup when approximate-place Senses is on (we keep only the resulting city/region string in memory for that request) | Coarse place label for the optional Senses feature | Global (OSM community / Nominatim) |
| Web Push delivery (browser push services via VAPID) | Push subscription endpoint and keys; notification title/body | Optional proactive / growth notifications you enable | Global (FCM / Apple / Mozilla push infrastructure) |
- Third Party
- Supabase
- What Data
- Account, conversations, journal, shared desk, and a separate memory database
- Why
- Database and authentication (two EU projects)
- Location
- EU
- Third Party
- Google OAuth
- What Data
- Email and identity-provider profile metadata
- Why
- Optional Google sign-in
- Location
- EU/US
- Third Party
- Vercel
- What Data
- Request metadata and application data processed by serverless routes (e.g. chat API), plus temporary IPs
- Why
- Web app hosting and serverless
- Location
- EU/US
- Third Party
- Railway
- What Data
- Conversation text in memory while generating replies; operational logs (PII-minimized)
- Why
- AI backend hosting
- Location
- EU
- Third Party
- Stripe
- What Data
- Payment data
- Why
- Payment processing
- Location
- EU/US
- Third Party
- Resend
- What Data
- Email address and transactional/support email content
- Why
- Account, export, deletion, research and support emails
- Location
- US
- Third Party
- Upstash Redis
- What Data
- Pseudonymous account/IP-derived rate-limit keys and counters
- Why
- Rate limiting, abuse prevention and short-lived caching
- Location
- EU/US
- Third Party
- Cloudflare Turnstile
- What Data
- IP, browser and challenge data
- Why
- Bot protection for login and public forms
- Location
- Global
- Third Party
- OpenRouter
- What Data
- Conversations (text generation)
- Why
- AI response generation
- Location
- US
- Third Party
- Vercel AI Gateway
- What Data
- Conversations (text generation)
- Why
- Backup AI route (only when OpenRouter is unavailable)
- Location
- US
- Third Party
- Cloudflare Workers AI
- What Data
- Your current message together with short candidate passages from your stored facts and earlier conversations; embedding inputs when the primary embedding route fails. Not stored by Cloudflare.
- Why
- Ranking which memories are relevant to your message (on every reply); embedding fallback
- Location
- Global edge
- Third Party
- ElevenLabs
- What Data
- Seth's reply text (live Call mode + tap-to-play); model improvement off at account level
- Why
- Voice playback (text-to-speech, paid plans & purchased credits)
- Location
- US
- Third Party
- Deepgram
- What Data
- Voice audio (composer dictation and live voice for signed-in users; processed in the EU, excluded from model improvement, retained only for processing). No browser-speech fallback. Not used in Private Mode.
- Why
- Speech recognition
- Location
- EU (US company)
- Third Party
- Sentry
- What Data
- Error data, device info (see §5.1)
- Why
- Error monitoring & stability
- Location
- EU/US
- Third Party
- Jina Reader
- What Data
- URL you share and extracted page text (transient)
- Why
- Fetch readable content when a message contains a link
- Location
- Global/US
- Third Party
- Firecrawl
- What Data
- A short search query Seth writes when he decides to look something up online: the general topic only. Seth's server checks every query and refuses it when it recognises your name, the names of people from your life that Seth has remembered, or health terms. No account, identity, messages or memory. Firecrawl may keep the query in its request logs under its own retention terms (no zero-retention option on our plan).
- Why
- Web search for current facts in Seth's replies
- Location
- US
- Third Party
- OpenStreetMap Nominatim
- What Data
- Rounded latitude/longitude for a single reverse lookup when approximate-place Senses is on (we keep only the resulting city/region string in memory for that request)
- Why
- Coarse place label for the optional Senses feature
- Location
- Global (OSM community / Nominatim)
- Third Party
- Web Push delivery (browser push services via VAPID)
- What Data
- Push subscription endpoint and keys; notification title/body
- Why
- Optional proactive / growth notifications you enable
- Location
- Global (FCM / Apple / Mozilla push infrastructure)
OpenRouter and Vercel AI Gateway are routing gateways, not the AI models themselves: your message is passed on to the upstream model provider that generates the reply (for example Google Cloud Vertex AI, Amazon Bedrock or Microsoft Azure running models from Anthropic, OpenAI and Google, and DeepInfra or Parasail for embeddings). These upstream providers act as sub-processors for the duration of a single request. Vercel AI Gateway is backup-only when OpenRouter is unavailable. Seth is an AI personal-growth partner — not clinical care, therapy, diagnosis, or a medical device — so conversation content is processed as wellness/growth free text, not as regulated clinical practice. We only use models served through Zero Data Retention endpoints: OpenRouter traffic is limited by our account-level ZDR configuration, and the Vercel AI Gateway backup is likewise configured for Zero Data Retention. Providers that would log or retain prompts are excluded. See OpenRouter's provider policies for per-provider logging terms. OpenRouter privacy & logging documentation
3.1. International Data Transfers
Some processors are based in the United States or operate global infrastructure. Where personal data is transferred outside the EEA, Evigilans maintains an applicable Chapter V safeguard — Standard Contractual Clauses and/or the EU-U.S. Data Privacy Framework for a currently certified recipient. Every processor that handles personal data on our behalf is bound by data-processing terms: either a data-processing agreement we signed, or the processor's standard data-processing addendum that forms part of its terms of service. OpenStreetMap Nominatim receives only rounded coordinates with no account identifier and is used under its public usage policy.
In practice the persistent footprint outside the EU is minimal: your conversations, journal, and shared desk live in two Supabase EU projects (web app and memory). AI providers process conversation content transiently under the Zero Data Retention guarantees described below — content is not retained after the reply is generated.
Zero Data Retention (ZDR) & No AI Training
For AI, we exclusively use providers with equivalent ZDR guarantees:
- ✓Conversation content is routed only through providers allowed by our account-level Zero Data Retention configuration
- ✓AI providers do not retain conversation content or embeddings after request processing under the applicable ZDR terms
- ✓Your conversations, journal entries, shared desk, and inputs are NEVER used to train, fine-tune, or distill any AI model — not by us, not by any provider
- ✓Embeddings (vector representations of text used for memory recall) follow the same ZDR principle — DeepInfra (via OpenRouter ZDR) is primary, Cloudflare Workers AI is the fallback. Cloudflare Workers AI also ranks candidate memory passages by relevance on every reply. Cloudflare's policy: customer content is not stored unless you explicitly opt into a storage service (we do not) and is not used to train models.
- ✓Seth's memory of you (facts, conversation history, journal access) is stored only in our own databases and is used to continue your conversations — it is not a model update. Seth's own reflections are described in §2.1
- ✓Any future Seth voice model we build uses synthetic data generated by open-source models only — never your production conversations or Seth's replies
4. Your Rights (GDPR)
Access
Export your data
Rectification
Correct your data
Erasure
Delete your account and active user data, subject to lawful retention exceptions
Portability
Export data in JSON format
Objection
Object to processing
Complaint
With supervisory authority
To exercise your rights, contact us at: privacy@sethapp.com
4.1. California (CCPA / CPRA)
If you are a California resident, you have the rights below in addition to the GDPR rights in §4. We do not sell personal information and we do not share it for cross-context behavioral advertising.
- •Know, access, correct, and delete personal information we hold about you
- •Limit use of sensitive personal information — chat, journal, and desk free text are treated as sensitive for this purpose
- •Not be discriminated against for exercising these rights
- •Use an authorized agent, with proof we can reasonably verify
Send requests to privacy@sethapp.com. We will not ask for a Social Security number. We respond within the time the law allows.
4.2. United Kingdom
If you are in the UK, UK GDPR applies to our processing of your personal data. The same rights in §4 apply. You may complain to the Information Commissioner's Office (ico.org.uk). Evigilans s.r.o. in Czechia is the controller; write to privacy@sethapp.com. We have not appointed a separate UK representative.
5. Cookies & Error Monitoring
We use only strictly necessary / functional cookies: Supabase Auth session cookies required for login, and a language-preference cookie (seth-lang) so the interface stays in your chosen language. Under ePrivacy these do not require a consent banner. Cloudflare Turnstile may set short-lived challenge cookies solely for bot protection on login/forms. We do not use analytics or marketing cookies, and we do not run a marketing cookie consent banner.
5.1. Error Monitoring (Sentry)
We use Sentry (Functional Software, Inc.) for error monitoring and application stability. When an error occurs in the application, Sentry may automatically collect:
- 🖥️Technical information — browser type, operating system, device type, screen size.
- 🌐IP address — handled according to the configured processor settings and used only for security/error context, not advertising tracking.
- 🐛Error details — stack traces, page URL where the error occurred, error messages.
- 🚫We do not use Sentry Session Replay. There is no recording of the screen or of your clicks as a video.
What Sentry does NOT collect:
- ✕Conversation content or messages
- ✕Personal data (email, name) — we configure Sentry with sendDefaultPii: false
- ✕Payment information
- ✕Journal entries
- ✕Shared desk content
- ✕Session replay or screen recordings
This data is used solely for application stability and incident response. Sentry publishes SOC 2 and ISO 27001 assurance materials and acts as a data processor under our instructions. Error-event and IP retention follow the currently configured Sentry plan and processor settings.
For more information, see Sentry's Privacy Policy
5.2. Operational Runtime Logs
For debugging, performance monitoring, and incident response, our backend (Railway) and frontend (Vercel) infrastructure write operational logs. These logs are designed to be PII-minimized by default:
- 🔢User identifiers (UUIDs) are truncated to an 8-character prefix (e.g. "75ace6c5…") — enough to correlate events within a single session burst, but not enough to reverse-link an account without database access.
- 🔐Conversation content, fact text, journal entries, learning insights, and message snippets are NEVER logged verbatim. When a log line would otherwise embed user content, we replace it with a length tag and SHA-256 hash prefix (e.g. "[len=78 hash=a3f8b2c1]") — collision-resistant for cross-line debugging, but cryptographically opaque to a log reader.
- ⏱️Railway backend logs are retained for 30 days and then automatically purged.
- 🛡️Browser and authenticated application access is restricted by Row Level Security. Privileged operational credentials can bypass those policies and are limited to necessary server-side administration and incident response.
What runtime logs do NOT contain:
- ✕Verbatim conversation messages, in any direction
- ✕Verbatim journal entries or fact claims
- ✕Email addresses, full names, or other directly identifying personal data
- ✕Payment credentials (handled by Stripe)
In short: runtime logs preserve enough technical signal to debug a bug ("which user, in which conversation, hit which code path"), without preserving enough content signal to reconstruct what was said. This is our implementation of GDPR Article 32 ("pseudonymization appropriate to the risk").
6. Security Logging (Audit Log)
To protect the security and integrity of the Service, we maintain an audit log of critical actions. This log records:
- 🗑️Account deletion requests — to confirm your data was properly removed.
- 💳Payment events — credit purchases, subscription changes, and cancellations (via Stripe).
- 📩Support ticket submissions — to track that your request was received.
- 🛡️Safety violations — when a message is blocked for violating usage policy. Only the violation type is logged (e.g. "harmful_request"), NEVER the message content. Repeated violations can pause chat for a time; the steps are in Terms §7a.
What is stored:
- •User ID (anonymized after account deletion)
- •Action type (e.g. "account_deleted", "credits_purchased")
- •Violation type for safety events (e.g. "harmful_request") — never message content
- •Timestamp
- •IP address (for security incident investigation only)
- •Technical metadata (e.g. Stripe event ID)
What is NOT stored:
- ✕Conversation content
- ✕Journal entries
- ✕Shared desk content
- ✕Personal messages or private data
The audit log exists solely for security, fraud prevention, and GDPR compliance (proof of data deletion). It does not contain any conversational or personal content.
Checkout records the accepted Terms and Privacy versions and the separate immediate-performance request without IP address, user agent, or device data. A transactional purchase confirmation is intended to provide a durable-medium summary, but delivery depends on email infrastructure. The legal acceptance database rows—not email delivery—are the source of truth for acceptance evidence.
7. Age Restriction
This service is not intended for persons under 18 years of age. Confirming that you are 18 or older when you are not is a material breach; we may close the account.
8. Contact
Evigilans, s.r.o.
U Synagogy 480/1, Trnitá, 602 00 Brno, Czech Republic
IČO: 23743883
Registered in the Commercial Register kept by the Regional Court in Brno, file no. C 147317
Email: privacy@sethapp.com
Supervisory Authority: Office for Personal Data Protection (ÚOOÚ) (uoou.cz)
Last updated: October 17, 2026