Skip to main content
← Back to Fidant.AI

Legal

Privacy Policy

Effective August 25, 2026 · Русская версия

Fidant.AI ("we," "us," or "the Service") is an AI assistant with persistent memory for executives, available as a web application and as native iOS and Android apps. Fidant.AI is a product of Liberty.space Corp, a Delaware (USA) stock corporation — the controller of the data described in this policy (company details in Section 15). This Privacy Policy explains what data we collect, why, how we use and store it, and the choices you have. By using Fidant.AI, you agree to the practices described here.

00Trust Architecture

Before the legal detail, a plain summary of how we think about your data:

We do not describe Fidant as "zero-knowledge" or promise we can "never see anything." As detailed in Sections 06 and 07, your memory is stored on our servers in plaintext to operate the product, and our servers process plaintext to generate responses.

01Information We Collect

Account Information

You can sign in with Google or with Apple (Sign in with Apple). From Google we receive your name, email address, and profile picture. From Apple we receive your name and email address on first sign-in only; if you choose Apple's Hide My Email, we receive and store a private-relay address (@privaterelay.appleid.com) instead of your real email. We store a Google or Apple identity subject to recognize you on return, and — if you connect Google Calendar — an encrypted refresh token so we can keep reading the events you authorized. When you sign in or connect Google, we also process short-lived security records to complete the flow (for example, a browser-binding token and, briefly, your email and provider identifier); these are transient and expire within minutes. We do not collect or store your Google or Apple password.

Google Calendar Data

If you grant Calendar access, we use the calendar.events.readonly scope to read event fields (title, start/end time, location, description, attendees, your response status). We use this to generate briefings, prepare pre-meeting context, and surface follow-ups. To power meeting preparation, attendee names, email addresses, event summaries, and times are extracted and stored server-side in our database (associated with the people and companies in your memory). We never write to, modify, create, or delete calendar events. We do not use Calendar data to train AI models, and we share it only with the AI provider generating your response.

Conversation Data

Your conversations and the structured memory extracted from them are stored in our database, and you read and change them through the Fidant.AI interface. A conversation left inactive for a long time may be moved into our object storage as a snapshot, which carries the same message content; internal memory-maintenance jobs also write working copies of memory text there and keep them for inspection. Both are covered by account deletion (Section 08).

Voice Input

If you use voice input in chat, audio is sent to OpenAI's Whisper API for transcription, processed in real time, and not stored by us. Separately, if you record or upload a meeting, the audio is stored on our object storage, transcribed via OpenAI Whisper, and the transcript is retained in our database and analyzed to produce meeting summaries (see Meetings below). On mobile, spoken AI replies may be synthesized via OpenAI's text-to-speech.

Meetings

When you use meeting features, raw meeting audio is stored on our object storage, transcribed (OpenAI Whisper), and the transcript, speaker labels, and participants are stored in our database and analyzed by our AI provider to produce summaries. You can delete meetings; recordings are subject to retention limits.

Uploaded Documents & Files

You may upload or import documents (PDF, DOCX, XLSX, RTF, TXT, MD, CSV, JSON; up to 10 files of 10 MB each) via onboarding, smart import, chat attachments, or document import. Extracted text is processed by our AI providers and stored as memory in our database; some extracted text is held on our object storage.

Wearable & Health Data

You may optionally connect Whoop, Oura, or import Apple Health data. For Whoop/Oura we store OAuth access and refresh tokens, encrypted at rest (AES-256-GCM), and retrieve health metrics (recovery, sleep, heart rate, HRV, SpO2, workouts, body measurements). Structured health and clinical facts (including lab results and biomarkers) are stored in our database, and raw lab-report text you upload is stored on our object storage. This is sensitive health data; we treat it accordingly.

Messaging Integrations

If you connect Telegram, we store your Telegram chat ID and settings and process the message text, voice, documents, and photos you send through your AI providers (see Section 17). If you use your Fidant email address, forwarded email bodies and attachments are stored on our object storage and parsed into memory (see Section 17).

Server-Side Data

We store the following on our servers: account records (name, email, profile picture); your Google refresh token (encrypted); the content of your memory (facts, decisions, commitments, observations, and related structured records); structured health, financial, identity-document, and relationship data derived from your inputs; meeting transcripts; uploaded documents and extracted claims; calendar-derived attendee and event data; object-storage blobs (inbound email and attachments, meeting audio, raw lab-report text, documents you import and files attached to chats, snapshots of archived conversations, and working copies written by memory-maintenance jobs); usage event logs (message counts, model selection, feature interactions) with metadata; billing reference (managed by Stripe); wearable device tokens (encrypted); and the per-account key used to encrypt those tokens. Structured identifiers such as passport, account, or card numbers are stored only as a masked last-4 plus a one-way hash, never in full.

Usage & Device Data

We automatically collect standard telemetry: IP address, browser type, device and mobile-session metadata (platform, app version and build, OS version, device model, last-seen), and interaction patterns, to maintain service quality and diagnose issues (see Section 11).

02How We Use Your Data

We use the information we collect to:

03Google API Services User Data Policy

Fidant.AI's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. The Google user data we receive today is your sign-in identity and, if you connect it, Google Calendar event data (calendar.events.readonly).

04Data Sharing with AI Providers & Service Providers

AI model providers. To generate responses, we send your messages and relevant context (messages, recent history, your memory, and — where relevant — authorized Calendar events) to the AI provider you select:

Internal-operation AI providers. Some internal operations (Section 02) run on models you do not directly select:

We access all providers via their APIs (not consumer products) and send only the data necessary for each operation. Anthropic, OpenAI, and Google do not use API-submitted data to train their models under their standard API terms; for Xiaomi (MiMo) and DeepSeek, see Section 18.

What not to keep in memory. Memory differs from an ordinary conversation in that it comes back. A conversation is sent to a provider once; what is saved to memory is added to the context of later requests too — so it is sent again each time it is relevant to an answer. It also reaches our backups, and a member of our team may read it while handling a support request from you.

So do not keep passwords, access keys, crypto-wallet recovery phrases or payment card numbers here. Password managers exist for that, and they are built so the contents never leave your device in readable form.

We filter some of this out on the way in, but that check cannot be complete: a private key is indistinguishable from any other long string of characters by its shape alone. Do not rely on it.

Other service providers. We also share limited data with:

05Shared Conversations

You may optionally share a conversation by generating a unique link. A snapshot of the conversation is then stored on our servers and is accessible to anyone with the link; it displays your name and the conversation content. You can revoke a shared link at any time, which immediately removes public access.

06Encryption

We encrypt the provider credentials we hold on your behalf — your Google refresh token and the Whoop and Oura tokens — at rest with AES-256-GCM under a per-account key generated and held on our servers. This is not something you switch on: those credentials are always encrypted. All data in transit is protected by TLS 1.2+.

Your memory itself is not encrypted at rest. It is stored in our database in plaintext, because the product has to read it to answer you. We do not offer an option that changes this.

07Data Storage & Security

Your memory is stored in our PostgreSQL database, running on managed cloud infrastructure we rent. Larger content blobs — inbound email and attachments, meeting audio, and raw lab-report text — are stored in our S3-compatible object storage. Server-side data is encrypted in transit (TLS 1.2+); tokens and sensitive identifiers are encrypted or masked at rest as described in Section 01. Access to production systems is restricted to authorized personnel. While no system is impervious, we implement industry-standard safeguards and continuously review our posture.

08Data Retention

Your memory is under your control: you can view, edit, or delete any item at any time through the Fidant.AI interface.

Server-side account data is retained while your account is active. Upon account deletion, we delete your server-side records — database content (memory, health, financial, identity, meeting, and relationship data), object-storage blobs (inbound email and attachments, meeting audio, raw lab-report text), wearable and identity tokens, encryption keys, and shared-conversation snapshots. We cancel your subscription and delete your Stripe customer record, and we request deletion of your analytics profile from PostHog. Database records are deleted immediately as part of an atomic operation; propagation across all stores completes within 30 days.

Account deletion is available on the web and in the mobile apps (which also clear tokens stored on your device).

09Your Rights & Choices

Depending on your jurisdiction, you may have rights including Access, Correction, Deletion, Portability, and Withdrawal of consent (revoke Calendar access via your Google Account). On portability, be exact about what the product gives you today: the account export you can run yourself contains your profile and subscription details and which integrations are connected, plus a note saying where your memory and conversations are stored — but not the memory and conversation content itself. A machine-readable export of that content is being built; until it ships, ask us and we will assemble it for you. Every memory record we hold about you is visible and editable in the product; for the rest of what Section 01 lists — usage logs, device and session metadata — ask us and we will provide it. To exercise any right, contact us at hello@fidant.ai; we respond within 30 days.

10Revoking Access

Revoke Fidant.AI's access to your Google Account at any time at myaccount.google.com/permissions. This immediately stops our access to every Google permission you have given Fidant.AI; your calendar itself remains untouched. You can disconnect Whoop, Oura, or Telegram from your settings at any time, which deletes the stored tokens or connection from our servers.

11Analytics, Cookies & Tracking

We use PostHog for product analytics and error monitoring. On the web, PostHog automatically captures page views, clicks and interactions, and errors; it sets a first-party cookie, links analytics to your account identifier, and receives your IP address and device metadata. We use this to improve the product and diagnose issues — not for advertising — and we do not participate in cross-site advertising networks or use an advertising identifier. We also keep first-party usage logs on our servers.

Cookies we use: the authentication session cookie (essential), the PostHog analytics cookie (non-essential), and short-lived security cookies during mobile sign-in (essential). We are implementing a consent mechanism for users in the EU/UK; until it ships, you can disable analytics cookies via your browser controls.

12Children's Privacy

Fidant.AI is not directed at individuals under 18. We do not knowingly collect personal data from minors and will delete it promptly if discovered.

13International Data Transfers

Fidant.AI operates globally. Our service providers Anthropic, OpenAI, Google, PostHog, Stripe, and Postmark are based primarily in the United States; your data may be processed there. The internal-operation AI providers Xiaomi (MiMo) and DeepSeek are companies based in the People's Republic of China, and data routed to them (Section 04) may be processed on their infrastructure. If you connect Telegram, message content is processed via Telegram's international infrastructure. We ensure appropriate safeguards are in place regardless of where data is processed.

14Changes to This Policy

We may update this policy from time to time. For material changes we will notify you by email or through the Service before they take effect.

15Contact & Company Details

Questions, concerns, or requests: hello@fidant.ai.

16Mobile Applications

Our iOS and Android apps let you sign in with Apple or Google. After sign-in, the app holds Fidant-issued access tokens in the device's secure storage (iOS Keychain / Android Keystore); we never store your Google or Apple provider tokens on your device. Optional biometric checks (e.g. Face ID) are performed entirely on-device — no biometric data is collected or transmitted. The apps request microphone access for voice input, and camera and photo-library access only when you choose to attach an image to a chat message; attached images are uploaded and processed like other uploaded files (see Section 01). We collect per-session device metadata (platform, app version/build, OS version, device model). You can delete your account from within the app.

17Messaging & Email Integrations

Telegram. If you connect Telegram, message text, voice notes, documents, and photos you send are received via Telegram's API and processed by our AI providers (transcription, classification, summarization, and — for images — visual analysis). Extracted information is stored as memory.

Email. We provide a personal forwarding address. Email you forward — sender, recipient, subject, body, and attachments — is stored on our object storage and in our database and parsed into memory. Transactional email we send you (recipient address and content) is delivered via Postmark.

18Note on "no training"

We access all AI providers via their APIs, not consumer products. Anthropic, OpenAI, and Google do not use API-submitted data to train their models under their standard API terms. Xiaomi (MiMo) and DeepSeek, which process the internal operations described in Section 04, publish their own API data-use terms, and we cannot extend the same no-training assurance to data routed to them — review their policies for detail. We limit what we send to each provider to the data necessary for the specific operation.

© 2026 Fidant.AI. All rights reserved.