01
No raw transcript archive
The session database is not designed to store word-for-word plaintext conversations.
See how your data is handled
01Raw text is temporary
Your original message is used while that request is being processed, then removed from the runtime flow.
02No readable transcript
Your raw conversation is not written to the database as a word-for-word plaintext record.
03Session context is encrypted
The small amount of session context that needs to persist is stored as encrypted ciphertext.
04Continuity stays limited
The system keeps no more than three recent sanitized context summaries.
Raw text
Your message has to be processed. It does not have to become an archive.
When you send a message, the original text has to remain in memory briefly so The Companion can understand the request that is currently being handled. In the current architecture, raw text is request-scoped. It is used during the early stages of processing and released after the semantic context needed for the response has been formed.
Continuity is therefore not built by keeping a word-for-word plaintext transcript of your conversation in the database.
Processing is not the same as storing.The Companion has to process a message in order to respond. The privacy boundary is about what is kept, for how long, and in what form.
Meaning without unnecessary identifiers
The goal is to keep the meaning, not every identifying detail.
Before semantic context is used further, the system removes certain identifiers it can recognize. The aim is to preserve the relationships between facts, time, negation, uncertainty, and emotions you actually expressed while reducing identifying information that is not needed.
You write
“My name is Dimas. My email is dimas@example.com. I've applied for jobs again and again and still haven't been called back. I'm starting to feel ashamed.”
After sanitization
“My name is [name redacted]. My email is [email redacted]. I've applied for jobs again and again and still haven't been called back. I'm starting to feel ashamed.”
Current sanitization can recognize certain patterns, including authentication secrets, email addresses, links, device identities, account numbers, phone numbers, some address patterns, and some name patterns. It is not a guarantee that every piece of sensitive information will always be recognized.
Continuity
So you don't have to start over every time.
To keep a conversation coherent, The Companion may retain up to three recent sanitized context summaries.
Those summaries are not stored as a readable transcript. Before a session checkpoint is persisted, it is encrypted with AES-GCM. The database stores the nonce, ciphertext, and only the session metadata needed to operate the service.
Session state is temporary. Production settings cap its lifetime at 24 hours, and expired records are removed through a purge process.
Language-model processing
When a language model is needed, only a limited payload is sent.
A language-model provider is part of how some responses are generated. That is part of the privacy boundary, so it should be stated plainly.
1Original message
Used temporarily inside the request that is currently running.
2Sanitized context
The current-turn meaning after sanitization and de-identification.
3Provider payload
The sanitized context, response instructions, and, when needed, up to three earlier sanitized context summaries.
The primary synthesis payload does not use the original raw input or a plaintext transcript. The current implementation also sends requests with store: false. That is a request-level instruction. Provider-side processing and retention remain governed by the provider's applicable terms.
Less by design
Privacy also means not collecting what the service does not need.
The Companion is not designed to know as much as possible about someone. Its architecture is intended to carry only enough context for the conversation to continue.
02
No advertising profile
Private conversations are not designed to build advertising profiles or to be traded as a source of revenue.
03
No permanent psychological profile
The Companion is not designed to turn conversations into a permanent psychological profile about a user.
Operations
Service logs are for running the service, not replaying your conversations.
Operational observability is designed to carry information such as route, status, latency, body size, authentication or rate-limit outcomes, and build version. It is not designed to carry fields containing message content or conversation responses.
The website and API use HTTPS, the domain uses DNSSEC, and the public website, application, and API surfaces are separated. No system can promise zero risk. Technical safeguards still need to be paired with limits on data and access.
What not to share
Keep passwords, codes, and other authentication secrets out of the conversation.
Do not enter passwords, PINs, OTP codes, full card numbers, API keys, access tokens, or other authentication secrets into The Companion. Sanitization can reduce exposure to certain categories of information, but it is not a reason to send information the conversation does not need.
Sensitive payment information will be handled through a payment provider when payment features are available, rather than requested inside The Companion's conversation space.
The boundary
Privacy does not mean nothing is processed. It means the service should take no more than it needs.
Messages have to be processed for the service to respond. Some sanitized meaning may be kept temporarily so a conversation can retain continuity. Your raw words are not turned into a permanent plaintext transcript.
You should be able to inspect that boundary, not simply take our word for it.Technical notes behind this explanation
Raw text lifecycle: raw input is marked non-serializable at runtime and cleared after TC-03 forms safe context. Runtime includes lifecycle checks to detect raw text that remains.
Continuity: TC-09 limits RecentNarratives to three semantic narratives.
Persistence: the session checkpoint is serialized, encrypted with AES-GCM, then stored in tc_active_sessions as a nonce and ciphertext.
Retention: production configuration accepts a session TTL between 1 and 24 hours and rejects values above 24 hours.
Provider boundary: the synthesis payload uses sanitized_narrative and optional prior_session_context, not the original raw input.
Other boundaries
Privacy is only one part of the relationship.
Safety explains when conversation is no longer enough. Terms and Payments explain the relationship around the service itself.