# Privacy and data

## What runs locally

- Voice transcription (fully offline on macOS)
- AI processing when you choose the Apple on-device LLM or llama.cpp
- Reading and writing save data

Save data is stored locally, **encrypted with AES-256-GCM**. Character images and data live in encrypted containers too, and are only ever decrypted in memory.

## What leaves your machine

- **If you configure an OpenAI-compatible API**: whatever is passed to the AI is sent to the endpoint you specify
- **If you enable Deep Context**: the active app name, window title, and selected text are used as hints for the AI. Turn it off and none of that is collected
- **AI tagging and summarizing for bookmarks**: page contents are passed to the AI
- **RSS reader**: connects out to fetch feeds
- **Cloud sync**: everything under "What gets synced" above
- With the Claude integration (MCP) enabled: condition, mood and similar state, plus the body of any memo you asked it to read or write, are passed to Claude. The contents, image data and full path of a file opened in the previewer are not

**The AI runs locally by default.** Cloud integrations are opt-in and only enabled when you explicitly turn them on.

**Consultation conversations are not saved.** They're cleared from memory when the session ends.

## Where data is stored

- **macOS**: `~/Library/Application Support/AICoach/`
- **Windows**: `%LOCALAPPDATA%\AICoach\`

Cloud-side data is stored in the Tokyo region (`asia-northeast1`), and can't be read or written by anyone outside your own account.

## Erasing your records

You can erase everything. Every life you raised, every lineage, the whole Encyclopedia — all lost, back to the first empty margins. **This can't be undone.**

## Sharing with third parties

**We don't sell it. We don't hand it over.** Your raising records, your memos and your transcriptions are
never sold, lent or otherwise given to a third party. There is no collection for advertising and no
third-party tracker embedded anywhere.

The only things that leave your machine are the routes listed under "What leaves your machine" above —
each one something you turned on yourself.

| Who | What for | Your choice |
|---|---|---|
| The OpenAI-compatible endpoint you configured | AI processing | Only when you enable it explicitly |
| Google Firebase (Tokyo region) | Cloud sync | Only when you sign in |
| Stripe | Payment for an egg | Only when you buy one |
| Claude (MCP integration) | The action you asked for | Only when you enable the integration |

Except where we are required to disclose by law.

## How long things are kept

| What | How long |
|---|---|
| Save data (raising, lineage, encyclopedia) | Stays on your machine until you erase it |
| Memos | Stay until you erase them. Deleting moves the file to your OS trash |
| Consultation conversations | **Not stored.** They leave memory when the session ends |
| Voice input audio | **Not stored.** Discarded once it becomes text |
| The Claude integration's activity display | Clears itself after 15 minutes at most |
| Cloud sync data | For as long as the account exists. Closing it deletes the data |

Uninstalling the app does not erase the folders above. To clear everything, run "Erase your records" or
delete those folders yourself.

## Contact

For questions about privacy and how data is handled, use the contact form on the site or write to
contact.aicoach@gmail.com.

## Safety and privacy

- Claude only receives the **bare minimum** — condition, mood, and the like
- Personal data, credentials, API keys, and your save data as a whole are never handed over
- Clipboard, calendar, RSS, and transcription contents are never sent automatically
- Character artwork and assets never leave the app
- The ID that refers to a character is a pseudonym. It can't be matched against another machine or another installation. You can also set it to change on every launch
- Anything that changes state always goes through your confirmation
- You can switch the integration off at any time in settings

**That said, whatever you show Claude becomes subject to Claude's processing.** That stays true even for an integration that runs entirely on your machine. Please use it on the assumption that what you don't want to share, you don't share.

## Service-side privacy policy

This page covers what happens on your own device. How account, payment and analytics data are handled on the service side is documented separately in the [Privacy Policy](/#privacy) on the top page.