Privacy Policy

2.4. Private Mode

Seth offers a Private Mode for conversations that require extra privacy. When Private Mode is enabled:

• 🚫Messages are NOT saved to any database — they exist only in your browser's memory.
• 🔌The AI backend (ElizaOS) is completely bypassed — your message goes directly to the AI model via OpenRouter ZDR (Zero Data Retention) endpoint.
• 🧠Seth can still read his own reflections (read-only) to maintain personality, but nothing from your private conversation is written back.
• 🗑️When you close the tab, switch to normal mode, or refresh the page — the conversation is gone forever. There is no recovery.
• 📊No conversation content or history is persisted. Minimal operational metadata may still be logged (for example request timing, model, content length, errors, credit use, and security events), never the private message text.

In short: Private Mode = zero content persistence. There is no recoverable transcript or memory after you leave.

2.5. Voice Input (Speech-to-Text)

Seth offers two separate voice features:

• 🎤Dictation in the composer uses your browser's built-in speech recognition service (for example Google Speech Services in Chrome/Edge or Apple speech services in Safari). Seth receives only the text you choose to send.
• 🗣️Live voice conversation sends microphone audio directly from your browser to Deepgram's EU endpoint for real-time transcription. Model-improvement use is disabled; audio is retained only for processing.
• 🔊Seth's reply text is sent to ElevenLabs only when premium voice playback is requested.
• 🚫Evigilans does not record or persist raw microphone audio in its own databases.

In short: dictation is handled by your browser provider; live voice uses Deepgram EU. Seth stores conversation text according to the selected chat mode, not a reusable audio recording.

2.6. Voluntary Product Research (Opt-in)

Evigilans s.r.o. runs voluntary product research to improve Seth and share aggregated or de-identified findings about how AI companions support personal growth. Individual source text remains linked to your account before aggregation. No staff member reads your individual conversations; analysis and article drafts are produced by automated pipelines. Your chat content is never used to train or fine-tune any AI model.

• 🔒Default for every user, including beta accounts: OFF. Old profile flags alone are insufficient and no previous preference is grandfathered.
• ✅Participation requires two separate current consents in the same language: voluntary research consent and explicit Article 9 consent for research processing of free text that may contain special-category data.
• 📊If both consents are current: automated aggregate analysis only — statistics and pool-level de-identified patterns. No staff browsing of individual chats. Used to improve the live product; not training data.
• 📰We may publish research summaries from non-identifiable aggregated insights (blog articles, reports) — e.g. how Seth helps people reflect and grow. Never direct quotes, never individual stories, never identification of a user.
• 🚫Research and model training are completely separate. We never use your messages or Seth's replies to train any AI model — including our own. Any future Seth voice model is built from synthetic data we generate using open-source models.
• ✋You can withdraw both consents anytime in Settings. Exclusion is immediate and does not affect the core service. Previously produced non-identifying aggregate results cannot be linked back to you.

Legal basis for optional research: consent (GDPR Art. 6(1)(a)) plus separate explicit consent under Art. 9(2)(a) for research processing of free text that may contain special-category data. This does not determine the Article 9 basis for the core service; counsel review remains open. Details in Terms §5a.

In short: Research is off by default for everyone and starts only with two current consents — never model training and never individual chat browsing by staff.

5.1. Error Monitoring (Sentry)

We use Sentry (Functional Software, Inc.) for error monitoring and application stability. When an error occurs in the application, Sentry may automatically collect:

• 🖥️Technical information — browser type, operating system, device type, screen size.
• 🌐IP address — handled according to the configured processor settings and used only for security/error context, not advertising tracking.
• 🐛Error details — stack traces, page URL where the error occurred, error messages.
• 🎬Session replay data — anonymized recordings of user interactions (all text and inputs are masked by default) to help reproduce and fix bugs.

What Sentry does NOT collect:

• ✕Conversation content or messages
• ✕Personal data (email, name) — we configure Sentry with sendDefaultPii: false
• ✕Payment information
• ✕Journal entries

This data is used solely for application stability and incident response. Sentry publishes SOC 2 and ISO 27001 assurance materials and acts as a data processor under our instructions. Error-event and IP retention follow the currently configured Sentry plan and processor settings; the exact periods and supporting evidence are maintained in the internal retention and processor registers and remain under review.

For more information, see Sentry's Privacy Policy

5.2. Operational Runtime Logs

For debugging, performance monitoring, and incident response, our backend (Railway) and frontend (Vercel) infrastructure write operational logs. These logs are designed to be PII-minimized by default:

• 🔢User identifiers (UUIDs) are truncated to an 8-character prefix (e.g. "75ace6c5…") — enough to correlate events within a single session burst, but not enough to reverse-link an account without database access.
• 🔐Conversation content, fact text, journal entries, learning insights, and message snippets are NEVER logged verbatim. When a log line would otherwise embed user content, we replace it with a length tag and SHA-256 hash prefix (e.g. "[len=78 hash=a3f8b2c1]") — collision-resistant for cross-line debugging, but cryptographically opaque to a log reader.
• ⏱️Railway backend logs are retained for 30 days and then automatically purged.
• 🛡️Browser and authenticated application access is restricted by Row Level Security. Privileged operational credentials can bypass those policies and are limited to necessary server-side administration and incident response.

What runtime logs do NOT contain:

• ✕Verbatim conversation messages, in any direction
• ✕Verbatim journal entries or fact claims
• ✕Email addresses, full names, or other directly identifying personal data
• ✕Payment credentials (handled by Stripe or NOWPayments)

In short: runtime logs preserve enough technical signal to debug a bug ("which user, in which conversation, hit which code path"), without preserving enough content signal to reconstruct what was said. This is our implementation of GDPR Article 32 ("pseudonymization appropriate to the risk").