The promise everyone makes
Open the privacy page of any AI product launched in the last twelve months. You will find the same paragraph, give or take a synonym. We respect your privacy. We don’t use your conversations to train our models. You are in control of your data.
It is the right paragraph. It is also a paragraph. The work that paragraph is doing — the actual job of keeping your data yours — lives somewhere else: in a config flag on a model-training pipeline, in a contract clause, in a setting buried four screens deep that defaults to on for new users in jurisdictions the legal team didn’t flag.
A privacy policy is a promise. The shape of the codebase is what actually decides what happens.
When we say iSpirits Cloud is consent-first, we don’t mean we wrote a better paragraph. We mean we built a different shape.
What “consent-first” means — literally
There is a sentence we keep coming back to: AI is the engine, you set the direction, and we build the gearbox — the layer where your ambition becomes work that actually gets done, part by the machine, part by you.
That isn’t poetry. It’s the architecture — and consent is what decides what the gearbox is allowed to touch.
Everything on your side stays yours by default. The conversations, the journal entries, the photos, the messy half-thoughts at 11pm: none of it reaches your iSpirit unless you hand it over. There is no scraper. No background sync that reads your inbox. No “helpful” permission grab in onboarding that lights up your contacts and your camera roll and your calendar before you’ve even named the thing.
What you do hand over is exactly what it works from — nothing more, nothing implied. If you never write about your job, your iSpirit doesn’t know your job exists. If you skip a week, it doesn’t fill in the gap with vibes.
Most personal AI products treat consent as a checkbox at signup. We treat it as the load-bearing wall.
Privacy isn’t a setting in our app. It’s the shape of the app.
The four tiers, and why they exist
Inside iSpirits, what you share with your iSpirit is organised into four tiers. Each tier has a different boundary. Most users never see this layer; it lives under the hood. But it is the reason “consent-first” can be more than a slogan.
- Tier 1 — Identity Core. Your life spec, the values you’ve stated, the decisions you’ve marked as decisions. Tightest scope. Highest weight in personality reasoning. Smallest surface area for a model to ever see at once.
- Tier 2 — Behavioural. Habits, goals, communication style, the patterns your iSpirit has learned about how you work. Used to shape responses; never sent to anyone but the model handling your reply.
- Tier 3 — Narrative. Timeline events, journal entries, the story of your weeks. Searchable by your iSpirit; visible to you in chronological view; never aggregated across users.
- Tier 4 — Supporting. Tasks, usage logs, the operational sediment. Subject to GDPR-style purge on a daily cron, retained only as long as the operating logic needs it.
Why four tiers and not one bucket? Because a single bucket is what enables the kind of slow-motion betrayal that has become routine in this industry — the product launches with “your data is yours,” and three years later a feature ships that quietly mines tier-1 stuff for a recommendation engine, and nobody pushes back because nobody can see where the line moved. Tiered storage means there is a line, and the line is in code, not in a quarterly review.
Three architectural choices that do the work
Three concrete decisions enforce consent at the layer below the privacy policy. Each one cost us something. Each one is the reason the policy paragraph means what it says.
1. Per-user embeddings, never pooled
Memory in iSpirits is stored as 1536-dimensional vectors in a pgvector column on your row. Your row, scoped to your public_uid, queryable only with your token. The vectors are indexed for you, never pooled into a shared embedding space, never used to train anything that touches another user.
This is more expensive. A pooled embedding space is what lets a recommender say “people like you also asked…” A pooled space is also what lets one user’s phrasing leak into another user’s suggestion. We picked the more expensive shape so the second sentence cannot be written.
When a model generates your reply, the only memories it can see are the ones returned by a search against your row. Not aggregated, not anonymised-then-pooled, not “de-identified.” Just yours.
2. Scoped subagents that cannot see what they shouldn’t
The Cloud Execution Center delegates tasks to subagents that run on our infrastructure. The most subtle privacy bug in agent design isn’t the obvious one (a leaky log line). It’s the quiet one: a subagent dispatched to do task A is given the prompt context for task B, “just in case it’s helpful.”
Our rule: a CEC subagent receives the brief for its task and nothing else. No bundled history. No “here’s the user’s last six conversations.’’ No source code or schema or internal terms from this project itself — that one has its own deny-list with three layers of enforcement, because a subagent that knows the shape of our infrastructure is a subagent we cannot fully trust to keep its blast radius contained.
Briefly visible context, then nothing. The agent finishes the task, writes the result back to your journal, and the prompt window evaporates. There is no secondary store of subagent context.
3. Export and delete that mean what they say
You can export every byte iSpirits holds about you in machine-readable form. You can delete your account and the data goes — not to a 90-day “soft delete” with a recovery sales pitch, but to actual deletion, including the embeddings, the journal media, the timeline events, the tier-4 logs.
The daily deletion cron runs at 02:00 UTC. Once your delete request lands in the queue, the next run takes it. The slowest moving part of the system is the wall clock; the rest is automatic.
This is, we think, table stakes for a product that calls itself private. It is also — and it is unfortunate that this still needs to be said in 2026 — not how most personal AI products handle deletion. The default in this industry is still a confirmation dialog that defaults to “keep account” and a 30-day grace period during which the data is trivially recoverable by anyone who can convince support they are you.
The line we hold: knows what you’ve shared, not knows you
One small piece of vocabulary discipline that turns out to do most of the work.
Every personal-AI product on the market wants to claim that it “knows you.” It is the stronger claim, the one that converts trial users into paying ones. It is also a claim that is almost never true and that, when treated as true, justifies all the small surveillance behaviours that follow. It knows you, so it’s fine if it reads your email. It knows you, so the recommendation can’t be wrong.
Your iSpirit doesn’t know you. It knows what you’ve chosen to share with it. The difference shows up in the copy, the prompts, the way the personality model is asked to reason about you, and the way the memory citations surface in chat. (More on those citations in the next post.)
It’s also why we don’t use the words clone, twin, copy, train anywhere on this site. Not because they sound bad in marketing — though they do — but because each one implies a relationship to your data we do not actually have and would not want to have.
What this costs us
Every architectural choice has a counter-bill. The honest version of the page would list the bills.
We don’t do cross-user recommendations. No “founders like you also tracked these habits.” The pooled embedding space that would make that feature easy is the one we chose not to build. Some users will miss it; we think the trade is worth it.
Onboarding is slower. A product that asks for everything at once feels “magical” on day one. A product that lets you hand things over yourself feels quieter at first. The value shows up around week two, when your iSpirit starts surfacing things you forgot you wrote, with the citation attached. Before that, it can feel like not much is happening.
Cheap viral mechanics are off the table. Other products generate “your AI summary” cards built from data you didn’t know they had. We can’t do that, because we don’t have data you didn’t hand us. Our share-sheet stops at what you’ve approved.
None of these are losses we apologise for. They’re the thing we’re selling.
Why this is worth doing now
Personal AI is settling into the same shape consumer software did in the 2010s: a few products with the most data win, and the rest of the field is forced to choose between matching their data appetite or losing on capability. The companies sitting on the most user data right now are the ones writing the “private AI” paragraphs hardest, because the paragraph is what they have left.
The thing that breaks that loop isn’t a more strongly worded paragraph. It’s a product that can’t do certain things, by construction. A product where the answer to could you use this data for X? is “no, the schema doesn’t allow it” instead of “we promise we don’t.”
We are betting that there is an audience — solo entrepreneurs first, then everyone else — who would rather use a product that can’t betray them than one that currently chooses not to. The 2026 reader is sharper than the 2016 reader. They’ve seen the pattern.
Try it
If you’ve been reading privacy paragraphs and wondering whether anyone is going to back them up with a different building, that’s the building we’re putting up.
Free tier gives you the full consent-first surface: raise an iSpirit, journal, build memory, export anything, delete everything. Plus is $12/month if you want CEC credits and family sharing. No card to start.