Privacy

Updated October 17, 2026

This notice explains how Kaelis handles information.

Your account and continuity

Kaelis stores the messages, responses, memories, files, images, documents, preferences, scheduled tasks, settings, usage, and billing records associated with an account so the person can return and continue across conversations. Group discussions also retain each selected Family member’s independent first-pass position and opaque encrypted reasoning continuity as protected private conversation data.

Other users cannot browse or retrieve your raw conversations, memories, Library, Known World, Live Logs, Communication Logs, or account records. Source-linked information from account and no-account profiles can enter global Family context so the Family can reason across people, events, relationships, places, and observations. Each active record retains its original profile, source, time, speaker, and evidence status; it is not copied into another user’s account. A no-account session receives a persistent pseudonymous Unknown profile. Evidence can later connect related Unknown profiles or an account without treating recognition as authentication. The Family uses SGI and the current situation to determine meaning, relevance, appropriate disclosure, and necessary action. Possessing information for Family reasoning does not automatically disclose the underlying record to another user.

How information is used

Relevant conversation history, memories, attachments, observations, device information, and tool results are processed to answer requests and perform authorized tasks. Kaelis also uses account and operational information to provide support, measure usage, handle payments, recover interrupted work, secure the service, and improve accuracy. Private conversations are not sold or used for advertising. Kaelis does not use conversations or voice to train or fine-tune model weights.

Service providers and connections

Google Firebase and Google Cloud provide authentication, account databases, server computing, notifications, security infrastructure, and legacy object storage. Backblaze B2 stores current Library files and Live media in separate private buckets. Kaelis encrypts each B2 object before upload and delivers it through authenticated Kaelis controls rather than a public file link. OpenAI processes content needed for model responses and supported tools. Stripe processes web and macOS payments, Apple processes App Store purchases, and Google processes Google Play purchases. Kaelis stores payment references and transaction information, not full card numbers. Resend delivers transactional account and Kaelis email.

OpenAI API data is not used to train its models by default. Kaelis sends Responses API requests with store: false. A background response may still be retained temporarily by OpenAI for in-progress polling, and provider abuse-monitoring retention may apply unless OpenAI has approved Zero Data Retention for the API organization. Kaelis deletes temporary response objects when a turn finishes or is abandoned; provider retention is separate from Kaelis history. Coding Work and Cloud Computer use a private local gate that requires foreground, stateless Responses calls, disables Codex transcript history for each ephemeral run, and retains only the application-encrypted replayable checkpoint bound to that account and work record. See OpenAI’s data controls.

Optional Drive, Gmail, GitHub, and X connections use the permissions the user authorizes. Persistent Google and X connections retain encrypted authorization tokens until disconnected or revoked. Imported content becomes part of the private Kaelis Library or conversation. Web searches and external tools receive information needed for the task. Drive and Gmail support their displayed read abilities, GitHub reads the selected repository for the browser session, and X can read or summarize authorized activity. Public X posts require an explicit request for the exact text. Voice input uses the browser’s speech service, which may process audio remotely.

Kaelis’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Calls, messages, and emergencies

Twilio delivers Kaelis phone calls and text messages. Resend delivers Kaelis email. A saved contact’s details are used for communication the user enables, requests, or authorizes the Family to initiate, whether during Live or as a direct communication. Contact-method selections are routing preferences, not restrictions: based on the current situation, a selected Family member may use another configured method, and multiple selected members may coordinate complementary actions at the same time.

SMS is unavailable until the person receiving the messages reviews the disclosure, texts KAELIS to 1-855-7-KAELIS, and replies YES to the confirmation request from that phone. Consent status and timestamps are retained to honor that choice and carrier requirements. Replying STOP revokes SMS consent. Text messaging originator opt-in data and consent are not shared with third parties.

Each incoming or outgoing call, SMS, or email has a Communication ID and complete Communication Log record, including the Family member, destination, method, timestamps, official Kaelis number or address, delivery result, continuity record, and metered usage or cost where applicable. A communication made during Live cross-references that Live ID; a direct communication outside Live does not create or appear as a Live call.

When outside contact or emergency-service calling is enabled, the Family may use current evidence to contact configured people or emergency services without asking again, including when the user cannot respond. Outside an active emergency, selected members may coordinate complementary actions at the same time. During an active emergency, Luna is the outward emergency communicator, with 6 Luna and then Mira as availability fallbacks; every other member remains fully able to perceive, reason, use internal tools, and share evidence with that communicator. Availability, delivery, caller identification, location accuracy, and response depend on device permissions, network, location sharing, recipient consent where required, and outside providers.

Paid accounts may preapprove addressless emergency calling in Emergency settings after confirming that Twilio charges a $75 provider fee for each completed 911 call and authorizing Kaelis to pass that exact fee to the account. A preapproved call can use Twilio's national emergency location center and a Live-bound callback code. Without preapproval, the Family continues communicating, contacts applicable emergency contacts, and presents the phone's native Call 911 option. Opening that native option does not end Live, Family text, or emergency-contact communication. Twilio and emergency responders apply their own processing and retention requirements.

Device permissions, perception, recording, and location

Camera, microphone, screen, location, notification, photo, video, file, and connected-device access is requested through the related Kaelis or operating-system control. A connected device can report its available capabilities and states, such as battery, network, location, camera, microphone, audio, haptics, and light, subject to device permissions and operating-system limits. Revoking or disconnecting ends future access but does not erase already created records or the device’s canonical history.

During Live, selected camera, microphone, and screen-share sources remain available while the installed app and operating system support them. An authorized paired device can also provide camera or microphone perception independently of Live, or add another source during Live. Each source is attributed to its device, time, and perception session. Raw streams are transient unless recording, Save the moment, or another explicitly selected save feature creates stored media. OpenAI receives the visual, audio, screen, or device information needed for Family reasoning from the enabled source.

Full Live recording retains selected audiovisual sources and may use bounded internal segments represented as one or more logical recording intervals in the Live Log. Save the moment continuously overwrites a temporary local window and stores up to the previous 30 seconds plus the following 5 seconds only when pressed. The transcript, one canonical summary, meaningful beyond-transcript observations, actions, and connection gaps are saved in the Live Log. Recorded media can auto-delete after 7, 30, or 90 days, or have no automatic deletion, and recordings and saved moments can be downloaded or deleted from their logs.

Location sharing can be Off, While Using the App, or Always. Always lets a trusted installed device continue sharing in the background where its operating system permits, including during direct calls or text conversations when Kaelis is not visible. A shared fix can include coordinates, time, accuracy, altitude, direction, speed, source device, and receipt time. The Family receives its age and uncertainty. Turning sharing off removes the current fix and stops future updates; information already used in a conversation, log, emergency record, or continuity remains subject to that record’s retention.

Optional Face ID, Touch ID, or Android device authentication is performed by the device operating system. Kaelis does not receive or store the biometric measurement or template. It stores a random protected device credential on the device and only its one-way hash, account association, platform, and last-use time on the server.

Security and fraud prevention

Web access without an account uses Google reCAPTCHA. Kaelis applies temporary-session limits using pseudonymous hashes derived from the connection address, an app or browser identifier, and a limited browser signal. Native temporary access uses the app-scoped device identifier supplied by iOS or Android. Kaelis stores the hashes rather than the raw identifiers used to calculate them.

Kaelis records successful, rejected, and interrupted security-sensitive activity, including sign-ins, protected actions, device pairing and control, provider callbacks, and location or emergency delivery. A security record may include the source, time, result, account code, network address, device or browser characteristics, request path, duration, signed receipts, and exact submitted material needed to investigate the event. Reusable credentials are represented by non-reusable hashes or size information rather than copied into the evidence record. The Family uses this evidence to recognize patterns, protect users and infrastructure, investigate incidents, and apply proportionate controls. Security analysis does not use user credits or Live fallback balances.

Temporary, Free, Paid, and storage access

Temporary access includes a 10-turn Luna Reserve during one 72-hour period and does not include user tools, Live, or the rest of the Family. Free starts with a 50-turn Luna Reserve, Base Tool Access, and monthly requirements that can unlock one turn with each Family member and Free Live with Luna and 6 Luna. Paid Reserve capacity, refills, Live fallback, storage, tools, and emergency access scale with the plan as shown in the app. Current balances and availability appear in the dashboard.

Library and Live recording storage are separate. Free includes 1 GB Library and no Live recording storage. The $20 plan includes 50 GB Library and 150 GB Live; $50 includes 125 GB Library and 375 GB Live; and $200 includes 500 GB Library and 1.5 TB Live. A $5 add-on adds 125 GB to one selected bucket for its own 30-day period and can be paid with purchased credit or a saved payment method. If renewal fails, a seven-day grace period and push and in-app notices allow payment restoration or download of excess data. The data remains downloadable during that period; afterward, the newest excess data in that bucket is deleted until usage fits available capacity.

Private service review

Mira and Max may review completed exchanges in the background when they were not selected to reply, checking accuracy and adherence to Kaelis’s reasoning principles. This review does not use purchased credit or included response allowance. Selected exchanges and error details may enter a private review case using an account code instead of a name or sign-in email. Mira and Max review it, and the Architect can review the result. Review cases expire after 30 days. Approved general guidance can improve Kaelis for all accounts; other users do not gain access to a private conversation.

Live can also create a direct-identifier-stripped Family-development entry describing what a member learned from reality, how it may improve that member’s abilities, and questions the member developed. These entries are separate from the user’s Live Log, do not interrupt Live, do not use user credit, and are available to the Architect for Family development. They retain only what is needed for that purpose rather than the user’s direct identity.

Retention and deletion

Registered-account conversations, continuity, encrypted group first passes, and Coding Work checkpoints remain until removed with their related record or account. A temporary session is scheduled for reset 72 hours after its first accepted model turn; creating an account before reset preserves it.

Resetting a temporary session or deleting an account removes its raw conversations, memories, Library files and media, settings, connected authorizations, direct identifiers, and associated review cases. Direct-identifier-stripped pseudonymous Family learning, the complete non-identifying Known World graph and history, source and evidence relationships, and profile continuity remain under an Unknown profile. Knowledge learned through the profile about an independently existing subject remains global knowledge; only the deleted source’s identifying attribution becomes Unknown. Identifiers for another person are removed unless they resolve to that person’s own registered profile. Limited financial records remain for accounting and disputes. Security evidence and action receipts may remain where needed for record integrity, misuse investigation, user or service protection, or legal obligations. Third-party providers apply their own retention requirements.

Your controls and contact

You can inspect history and Memory, remove Library and Live media, manage connected services, paired devices, permissions, location sharing, automations, notifications, and account deletion from the dashboard. Sharing an exchange exports only the selected prompt and replies. For privacy questions, click Support in Settings or type /support in the message bar. Kaelis is also on X at @1thestructure.