Privacy Policy

Last updated October 15, 2026

This Privacy Policy describes how Confidant AI Inc ("Confidant", "we", "us", "our") collects, uses, and discloses information about you when you access or use our messaging assistant, our websites, and related services (collectively, the "Services").

The Services are architected so that the substance of your interactions is processed within a session that runs in confidential computing hardware and is encrypted with keys we cannot access. This Policy describes both what is held within that session and the limited categories of information that are necessarily processed outside it.

We do not look at your Inputs, Outputs, or the contents of your session unless you give us explicit authorization to do so, for example so that we can investigate a problem you report to us.

Changes to this Privacy Policy

We may revise this Privacy Policy from time to time. If we make material changes, we will post the revised Policy with an updated revision date and, where required by applicable law or where the change materially affects how we process your information, provide notice through the Services. Your continued use of the Services following the posting of a revised Policy constitutes your acceptance of it.

Collection and use of information

We collect a limited set of information from a limited set of sources, and we use it to provide, secure, and improve the Services; to verify eligibility and control access to a service that admits users by invitation or from a waitlist; to complete the tasks you direct the Services to perform on your behalf, which may include engaging third parties on your behalf; to communicate with you; to comply with applicable legal obligations; and to protect our rights and the rights of our users. We do not sell your information or share it for cross-context behavioral advertising, and we do not disclose your information to registered data brokers or to third parties who resell information to others.

Information you directly provide us

• Your mobile telephone number. You provide your number to verify eligibility and to establish your account. We use it to send one-time verification codes, to sign you in to our website, to identify your account, and to route your messages to your session. Our directory looks up your account by a keyed cryptographic hash of the number. During our beta, we also keep an encrypted copy of the number so that we can tell you when a waitlist spot opens and contact you about your account; only authorized personnel can decrypt it, and only for those purposes. Auth0 holds your number as your login identity, as described below.
• Inputs to the Services. The messages, voice notes, images, instructions, documents, credentials, payment details, addresses, and other materials that you submit to the assistant ("Inputs"), and the responses, instructions, and materials the assistant generates from them ("Outputs"). Inputs and Outputs are processed and stored within your session, as described below. Voice notes are transcribed within your session. Credentials and payment details you enter through the one-time secure links the assistant sends you are encrypted on receipt so that only your session can read them, and are stored in an encrypted vault within it.
• Correspondence. Information you provide when you contact us, such as your email address and the contents of your message.

Information collected through your use of the Services

• Message metadata. The messaging platform through which you reach the Services, WhatsApp or iMessage, transmits your number and message content to us so that we can route them. We record the fact of delivery and operational identifiers, and we do not log message content or your number.
• Account and invitation records. An opaque account identifier, the account that invited you, the number of invitations issued and used, whether your account is active or on the waitlist, the messaging channels you have connected, and, for iMessage, which of our numbers you were assigned to text. Records of an in-progress registration, which include the keyed hash described above, expire automatically within fifteen minutes.
• Task and action data. Information the assistant obtains or produces in the course of carrying out a task you directed, including information from websites and services it accesses on your behalf. This information is processed and stored within your session.
• Usage records. Records of how the Services operate for your account, such as message counts, task durations, model usage, and errors, keyed to your opaque account identifier. They never include message content, your number, or an email address.

Information held within your session

Your conversation history, the assistant's memory of your preferences, and the record of work performed for you are stored in per-user encrypted storage. The encryption keys for that storage are released only to a session that presents a hardware attestation demonstrating that it is running our published software. Neither we nor the operator of the underlying infrastructure can read that storage from outside such a session, and we do not access it from within a session unless you explicitly authorize us to.

Information we do not collect

We do not require your name, your email address, or a password in order to create an account. This website uses essential cookies to remember your login, with Auth0 providing phone authentication. We do not use analytics, advertising, or cross-site tracking technologies on it. We do not knowingly collect information from anyone under 18 years of age.

Disclosure of your information

We may disclose your information to the following categories of third parties, subject to this Privacy Policy. We have zero data retention agreements with every provider listed below that processes the content of your messages or your Inputs on our behalf, with one exception: Meta, which operates WhatsApp.

• Messaging platforms. You can reach the assistant over WhatsApp, iMessage, or both. Messages over WhatsApp are transmitted through the WhatsApp Business platform, which is operated by Meta Platforms, Inc. and is not end-to-end encrypted between you and us. Meta processes message content and your number under its own terms and privacy policy, and we do not have a zero data retention agreement with Meta. Messages over iMessage are carried by Apple's iMessage service to Linq, which operates the lines that send and receive iMessages on our behalf. Linq handles your messages and your number to deliver them, under a zero data retention agreement with us, so it does not keep your messages after delivering them.
• Authentication providers. Auth0, a service of Okta, Inc., holds your number as your login identity and signs you in to our website. Twilio Inc. transmits one-time verification codes and receives your number for that purpose.
• AI model providers. The assistant generates Outputs by transmitting Inputs and task context to a third-party model provider. That provider is currently Fireworks AI, Inc., under terms that prohibit training on the data we transmit and under a zero data retention agreement. We will update this Policy if that provider changes.
• Third parties with whom the Services interact on your behalf. When you direct the assistant to complete a task, it discloses to the relevant merchant, service, or recipient the information that the task requires, such as a delivery address, a reservation name, or the contents of a message you asked it to send. If you connect a Link wallet, operated by Stripe, Inc., the assistant obtains a one-time payment credential from Link for a purchase you approve. Those parties process that information under their own policies.
• Infrastructure and security vendors. Microsoft Corporation provides the cloud infrastructure on which the Services run, in the United States, including the confidential computing hardware in which sessions execute and the storage that holds your encrypted session data. Cloudflare, Inc. serves our websites and provides the bot-detection challenge presented on the sign-up page; it does not process message content or your telephone number.
• Legal and safety. Third parties to whom disclosure is required by law or legal process, or where we believe in good faith that disclosure is necessary to protect the rights, property, or safety of Confidant, our users, or the public. Where we are permitted to notify you, we will.
• Corporate transactions. A successor or acquirer in connection with a merger, financing, reorganization, or sale of assets, subject to this Policy.

Third-party websites and services

The Services access third-party websites and services at your direction, and our website may link to third parties. We do not control those parties and are not responsible for their privacy practices. Their terms and policies govern the information they receive.

Data retention

We retain session storage for the life of your account. Registration records expire automatically within fifteen minutes. Account and invitation records are retained until you delete your account, except that invitation counts attributable to the account that invited you are retained as records of that account. Operational logs and usage records are retained for up to 90 days for security and reliability purposes.

Deletion and your choices

You may delete your account at any time by contacting us at hello@trustlesslabs.ai. On deletion we remove your session storage and the account records described above, including the encrypted copy and the keyed hash of your number, such that the number is no longer associated with an account. We cannot delete information held by Meta for messages sent over WhatsApp, or information you directed us to provide to a third party; those requests must be made to those parties directly.

Your rights

Depending on your jurisdiction, you may have the right to request access to, correction of, or deletion of personal information we hold about you, to request a copy in a portable form, and not to be discriminated against for exercising these rights. To exercise a right, contact us using the details below. We will verify your request through your account. Because of the architecture described above, the information available to us in response to such a request is limited to the categories listed in this Policy.

Data security

We employ technical and organizational measures designed to protect information, including hardware-based confidential computing for sessions, encryption of session storage under keys released only against attestation of our published software, encryption of data in transit, and least-privilege access controls. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Where a breach affects you and notification is required, we will notify you as required by applicable law.

Children's privacy

The Services are intended for individuals 18 years of age and older. We do not knowingly collect personal information from children. If you believe a child has provided us with information, contact us and we will delete it.

How to contact us

Confidant AI Inc. Questions about this Privacy Policy or our privacy practices may be directed to hello@trustlesslabs.ai.