Privacy Policy

This policy says plainly what we hold, what we can see, and what we will never do. Where there is an uncomfortable architectural truth, we would rather write it down than imply something we cannot deliver.

1. What we store

• Account: your email, your name, and a bcrypt hash of your password (never the password itself).
• Content you create: Lines, entries, outlines, structured versions, chat messages and uploaded files — stored so you can come back to them. Storage is the whole point.
• Usage: how much AI work you have used, and when, so we can meter credits and price the product honestly.
• Errors: when something breaks we record the error and its context so we can fix it.
• Payments: Stripe holds your card details. We store only a reference to your Stripe customer, your plan, and your invoice history.
• Cookies: one session cookie so you are not asked to log in repeatedly. No analytics cookies, no advertising cookies, no third-party trackers.

2. What we can and cannot see

ComChannels runs AI over your content on a server. That means our systems must be able to read your content in cleartext at the moment you ask your personal ComChannels agent to do something with it. No product that runs AI on your text server-side can honestly claim it is cryptographically incapable of reading that text, and we will not make that claim.

What we offer instead is a layered trust model — checkable guarantees rather than an impossible promise:

• Encrypted in transit over TLS.
• Strict per-user isolation: every content query is scoped to the account that owns it, and no endpoint serves another user's private content. This is enforced by automated tests that run on every build, not by convention.
• No training on your content, ever, except the per-Channel opt-in described in section 4.
• A short list of processors: Stripe for payments, and our LLM provider for inference. No data brokers, no ad networks, nobody who pays us for access to you.
• Honestly: backend engineers with database access can technically read stored rows. This is unavoidable for on-call debugging and disaster recovery. We keep that group as small as possible and treat reading customer content without operational need as a firing matter rather than a policy footnote.

For content that must be impossible for anyone here to read, the honest answer today is that ComChannels is not that product. "Vault Channels" — client-side encryption under a key only you hold — is an idea we are considering, and it does not exist today; nothing in the product currently offers it. It would also be incompatible with the agent and with publishing, which is the trade it asks you to make. We mention it so the boundary is clear, not as a commitment.

3. What privacy cannot mean in a browser

Your own content, rendered in your own logged-in browser, is present in that browser. Right-click → Inspect will show it. Hiding it from you would mean hiding it from you. What we do protect is that no other user's content is ever sent to your browser, and that logging out clears the drafts cached locally on your device — which matters on a shared computer.

4. AI and your content

When you invoke your personal ComChannels agent, the relevant content is sent to our LLM provider to produce a response, and the response comes back to your account. We do not keep a training corpus, we do not run a model of our own, and we do not send your content to any model-training endpoint. Our provider's terms prohibit training on data sent through their API.

The only way any of your content becomes eligible for AI training is if you turn on "Allow AI training" for a specific published Channel. That opt-in covers only that Channel's published versions. Personal Channels, Private Channels, Lines, drafts, chat messages and uploaded files are never eligible, and there is no setting that makes them eligible.

The context we assemble for your agent is built only from your own content. One user's material is never fed into another user's agent, including material they have paid to read.

5. Who else touches your data

• Stripe — payments and payouts. Stripe sees your card and, if you sell Channels, your identity and bank details for its own compliance. We do not see your card number.
• Our LLM provider — receives the content needed to answer a specific request, and is contractually barred from training on it.
• Nobody else. We do not sell, rent or trade your data, and we have no advertising business that would tempt us to.

6. How long we keep things

Your content stays for as long as your account is open, because that is what you are paying us to do. When you ask us to close your account we delete your content within 30 days, and it clears our backups as those backups rotate out within 90 days.

7. Your rights

You can ask us for a copy of your data, a correction to it, or its deletion, and you can object to how we handle it. Email privacy@comchannels.sh from your account address. We respond within 30 days. These requests are handled by a person today rather than a button in the product; the right is real either way.

8. Security

TLS in transit. Passwords hashed with bcrypt. Session tokens in HTTP-only cookies. Uploaded files served through expiring signed URLs. Every content endpoint requires authentication — there is no anonymous read path into private data.

9. Children

ComChannels is not intended for people under 16, and we do not knowingly collect their data.

10. Where your data lives

Our servers and processors may be located in countries other than yours, so using ComChannels involves transferring your data across borders. We aim to meet GDPR and CCPA standards wherever you are; for a jurisdiction-specific request, email privacy@comchannels.sh.

11. Changes

If we change this policy in a way that affects you, we will tell you by email and in-app before it takes effect — not quietly, and not by updating a date.

12. Contact

Privacy questions and data requests: privacy@comchannels.sh.