Privacy Policy

2.4. Private Mode

Seth offers a Private Mode for conversations that require extra privacy. When Private Mode is enabled:

• 🚫Messages are NOT saved to any database — they exist only in your browser's memory.
• 🔌The ElizaOS messaging pipeline is bypassed — your message goes directly to the AI model via OpenRouter ZDR (Zero Data Retention). Seth's own personality context (identity and reflections) may still be read read-only so his voice stays consistent; that context is about Seth, not about your private turn, and nothing from your private conversation is written back.
• 🧠Nothing from your private conversation is stored as memory, chat history, or a recoverable transcript.
• 👁️Optional Senses (daypart, approximate place, camera glance, desktop window glance) do not run in Private Mode — even if they are enabled in Settings. They apply only to normal chat.
• 🗑️When you close the tab, switch to normal mode, or refresh the page — the conversation is gone forever. There is no recovery.
• 📊No conversation content or history is persisted. Minimal operational metadata may still be logged (for example request timing, model, content length, errors, credit use, and security events), never the private message text.

In short: Private Mode = zero content persistence. There is no recoverable transcript or memory after you leave.

2.5. Voice Input (Speech-to-Text)

Seth offers two separate voice features:

• 🎤Dictation in the composer uses your browser's built-in speech recognition service (for example Google Speech Services in Chrome/Edge or Apple speech services in Safari). Seth receives only the text you choose to send.
• 🗣️Live voice conversation sends microphone audio directly from your browser to Deepgram's EU endpoint for real-time transcription. Model-improvement use is disabled; audio is retained only for processing.
• 🔊Seth's reply text is sent to ElevenLabs for premium voice: automatically in live Call mode, and when you tap play on a message.
• 🚫Evigilans does not record or persist raw microphone audio in its own databases.

In short: dictation is handled by your browser provider; live voice uses Deepgram EU. Seth stores conversation text according to the selected chat mode, not a reusable audio recording.

2.6. Voluntary Product Research (Opt-in)

Evigilans s.r.o. runs voluntary product research to improve Seth and share aggregated or de-identified findings about how AI companions support personal growth. Individual source text remains linked to your account before aggregation. No staff member reads your individual conversations; analysis and article drafts are produced by automated pipelines. Your chat content is never used to train or fine-tune any AI model.

• 🔒Default for every user, including beta accounts: OFF. Old profile flags alone are insufficient and no previous preference is grandfathered.
• ✅Participation requires two separate current consents in the same language: voluntary research consent and explicit Article 9 consent for research processing of free text that may contain special-category data.
• 📊If both consents are current: automated aggregate analysis only — statistics and pool-level de-identified patterns. No staff browsing of individual chats. Used to improve the live product; not training data.
• 📰We may publish research summaries from non-identifiable aggregated insights (blog articles, reports) — e.g. how Seth helps people reflect and grow. Never direct quotes, never individual stories, never identification of a user.
• 🚫Research and model training are completely separate. We never use your messages or Seth's replies to train any AI model — including our own. Any future Seth voice model is built from synthetic data we generate using open-source models.
• ✋You can withdraw both consents anytime in Settings. Exclusion is immediate and does not affect the core service. Previously produced non-identifying aggregate results cannot be linked back to you.

Legal basis for optional research: consent (GDPR Art. 6(1)(a)) plus separate explicit consent under Art. 9(2)(a) for research processing of free text that may contain special-category data. Core-service Art. 9 basis is described in §2.1 and is separate from research. Details in Terms §5a.

In short: Research is off by default for everyone and starts only with two current consents — never model training and never individual chat browsing by staff.

2.7. Access via MCP and Agent API keys

You may create keys in Settings so a client you connect can talk to Seth. There are two doors:

• 🔑MCP talks as you — the same companion as on the website. Messages are stored in a dedicated window. If thread read is on, that client can pull the last lines of that window, including what you typed on the site.
• 🤖Agent API talks as a separate agent identity under your credits, not as your human thread.
• ⚠️The key itself is enough to use that door. We do not ask for a second login factor on each call. Keep it off shared machines and out of git.
• 🌐When you connect a third-party client, that client receives what you send through it and Seth's replies. Evigilans does not control that client's logging, retention, or training. Those clients are not our processors.
• 📄MCP and Agent API use the same conversation legal bases as the website, including the core-service Article 9 consent where free text may include special-category data. They are not Private Mode.

In short: a key is a password to Seth. Your client sees the traffic. We do not run that client.

5.1. Error Monitoring (Sentry)

We use Sentry (Functional Software, Inc.) for error monitoring and application stability. When an error occurs in the application, Sentry may automatically collect:

• 🖥️Technical information — browser type, operating system, device type, screen size.
• 🌐IP address — handled according to the configured processor settings and used only for security/error context, not advertising tracking.
• 🐛Error details — stack traces, page URL where the error occurred, error messages.
• 🎬Session replay data — anonymized recordings of user interactions (all text and inputs are masked by default) to help reproduce and fix bugs.

What Sentry does NOT collect:

• ✕Conversation content or messages
• ✕Personal data (email, name) — we configure Sentry with sendDefaultPii: false
• ✕Payment information
• ✕Journal entries
• ✕Shared desk content

This data is used solely for application stability and incident response. Sentry publishes SOC 2 and ISO 27001 assurance materials and acts as a data processor under our instructions. Error-event and IP retention follow the currently configured Sentry plan and processor settings; the exact periods and supporting evidence are maintained in the internal retention and processor registers and remain under review.

For more information, see Sentry's Privacy Policy

5.2. Operational Runtime Logs

For debugging, performance monitoring, and incident response, our backend (Railway) and frontend (Vercel) infrastructure write operational logs. These logs are designed to be PII-minimized by default:

• 🔢User identifiers (UUIDs) are truncated to an 8-character prefix (e.g. "75ace6c5…") — enough to correlate events within a single session burst, but not enough to reverse-link an account without database access.
• 🔐Conversation content, fact text, journal entries, learning insights, and message snippets are NEVER logged verbatim. When a log line would otherwise embed user content, we replace it with a length tag and SHA-256 hash prefix (e.g. "[len=78 hash=a3f8b2c1]") — collision-resistant for cross-line debugging, but cryptographically opaque to a log reader.
• ⏱️Railway backend logs are retained for 30 days and then automatically purged.
• 🛡️Browser and authenticated application access is restricted by Row Level Security. Privileged operational credentials can bypass those policies and are limited to necessary server-side administration and incident response.

What runtime logs do NOT contain:

• ✕Verbatim conversation messages, in any direction
• ✕Verbatim journal entries or fact claims
• ✕Email addresses, full names, or other directly identifying personal data
• ✕Payment credentials (handled by Stripe)

In short: runtime logs preserve enough technical signal to debug a bug ("which user, in which conversation, hit which code path"), without preserving enough content signal to reconstruct what was said. This is our implementation of GDPR Article 32 ("pseudonymization appropriate to the risk").