---
title: Privacy Policy
description: 'How You.one handles your information, uses AI providers, and manages saved records.'
intro: 'How You.one handles your information, uses AI providers, and manages saved records.'
---
Last updated: October 21, 2026. Version: privacy.2026-10-21.3.

[Download this version](/legal/versions/privacy.2026-10-21.3.md). Change notes are below; available earlier versions are linked at the end of this document.

## What changed in this version

- Clarified dated evidence, referral disclosures, connected-data limits, and applicable privacy choices.
- Explained records of manual funding, optional automatic refills, payment limits, separately confirmed purchases above the limit, usage settlement, refunds, disputes, and referrals.
- Distinguished financial-record retention from saved product content and account deletion.
- Explained shared Boards and artifacts, Calendar and two-way sync, and the information involved in available email, phone, and text features.
- Kept provider-route disclosures at their stated evidence checkpoint; this billing update does not certify a new AI route or change our no-training commitment.

## What this page covers

Segeren Studio LLC, a Wyoming limited liability company, operates You.one and is responsible for this Privacy Policy. Our records show an administrative dissolution after a missed Wyoming annual report; we plan to reinstate the company. In this policy, "we" and "us" refer to Segeren Studio LLC.

You.one is built to help regular people make progress in real life. This page explains what information the product uses and where it can go, including dated checkpoints and the limits of those checks.

This Privacy Policy describes our disclosed data practices; a dated checkpoint is not a new certification of every live route. You.one keeps your record so Ava can remember and help. AI providers that receive customer content must be barred from training on it. Zero Data Retention at a provider does not mean You.one stores nothing. We update this policy when our practices materially change and summarize the changes near the top.

## Account age

You.one accounts are currently for people who are at least 18 and have reached the age of majority where they live. People who do not meet this rule should not create an account. If we learn that an ineligible person created an account, we may restrict it and review or delete the information associated with it, subject to legal and security retention needs. A parent or guardian can contact us through the [privacy request](/privacy-request) page.

## What you share with You.one

When you use You.one, you may share what you type, tap, or submit. That can include the situation you want help with, answers you choose, freeform notes, feedback, your name, or your saved location.

If you put something into You.one, assume it may be processed to run the experience.

## Boards, Calendar, and shared content

Your saved product content can include conversations with Ava, Boards, Cards, documents and other artifacts, calendar events, activity, decisions, and the approvals or standing grants you give Ava. We keep content and relevant versions, permissions, action records, and synchronization state to provide the features you use and explain what happened.

Where collaboration is available, the material you choose to share becomes available to the audience authorized for it, such as a partner, family member, teammate, guest, or client. A Board invitation does not itself share your entire account, private conversations with Ava, or unrelated connected-service content. A private calendar item does not become shared solely because it relates to a shared Card; sharing still requires the relevant permission. People who receive content may copy or download it. Removing access or deleting your copy cannot necessarily recall copies already received by someone else.

## What we may store in your browser

Some product state is stored locally in your browser so You.one can feel continuous, even though parts of the experience may also be sent to our backend or service providers when needed.

- your name and saved home location
- appearance and product preferences
- where you left off, saved answers, and screens you can return to
- session or visit IDs that help keep a visit together
- your confirmation that you meet the account age requirement

## What may go to our systems and service providers

Our last recorded route checks, on September 23–24, found customer AI routes restricted while we verified their processing paths. That is dated evidence, not a new verification of every live route. For a supported route, prompts, answers, and recent context needed for the feature may be sent through our Production SpaceXAI account with Zero Data Retention (ZDR) enabled. The table below describes those checks and distinguishes held routes from a separately authorized call that may finish through another service whose ZDR coverage is not yet verified. If a route cannot serve a feature, that feature may be unavailable; we do not silently send customer content to a different AI provider without verified equivalent protection.

Some public pages currently use Google Analytics, which can set analytics cookies and send client or session identifiers, page views, and related device or campaign information to Google before you reach a beta invitation. Accepting the beta Terms does not control this public analytics. Where applicable law requires prior consent for non-essential analytics, we must obtain it before that processing; accepting these Terms does not override that requirement. We also use or may enable other telemetry and diagnostic tools, including Vercel Analytics or hosting logs, PostHog, and Sentry, to understand quality, reliability, and whether the product is helping. Depending on the tool and route, that can include IP addresses, cookies or session IDs, pages viewed, buttons pressed, forms submitted, campaign and referral information, device and rough geography data, conversion events, error data, screen or route metadata, and in some cases transcript snapshots or request details used for debugging.

Session replay is currently off while we verify its safeguards. If enabled later, we plan to mask public form inputs, but replay could still contain other things you type or see on screen.

## Communications and misuse review

We use your contact details for account, invitation, security, welcome, and beta follow-up messages. A message that promotes an offer or referral reward must meet applicable consent and unsubscribe requirements; accepting the Terms is not permission to disregard those requirements.

The [Terms of Service](/terms) explain permitted and prohibited communications. Cold sales outreach, spam, prank calls, impersonation, harassment, and attempts to evade restrictions are prohibited. These rules apply to channels as they become available; this policy does not announce new communication features.

To investigate and respond to a complaint or other suspected misuse, authorized staff may review relevant available account and communication records, including the requested task, recipient details, timing, contact attempts, outcomes, complaints, and call recordings or transcripts where they were lawfully collected. These records can include information about people you contact, such as their number and any refusal they give. Where we keep a refusal or opt-out record to prevent unwanted contact, it includes the scope expressed by the recipient. A review may consider several contacts together and relevant links between suspected abusive accounts, subject to access restrictions. Staff must not use this review to expose one person’s private content to another. This is part of the service-operation and safety review described below, subject to the narrower connected-service access rules. It is not permission to record a call without required notice or consent, to train a model, or to collect unrelated information. Our rules do not guarantee that every misuse will be detected or prevented. These records follow the retention and request limits in this policy.

## Email, phone, text, and communication identities

When a communication feature is available and you choose to use it, we may store your assigned email addresses or phone number, the separate identity used by Ava, sender and recipient details, message bodies and attachments, call audio or transcripts where lawfully collected, text or multimedia messages, and delivery, timing, consent, refusal, and action records. This can include information supplied by someone replying to you or Ava. We use these records to deliver and organize the communication, connect it to the relevant work, provide authorized context to Ava, and handle support, security, and misuse.

Delivery and telephony providers may receive the addresses, numbers, content, media, and service records needed for their role. Their transport, billing, security, and legally required records are distinct from AI inference and are not made zero-retention by an AI provider’s ZDR setting. The provider and route disclosures in this policy must describe the service actually offered; mentioning a channel or an optional dedicated number does not announce its availability or approve a new provider route.

We record the authorization and payment settings for an optional dedicated number when you choose that offer. Buying a number or authorizing Ava to contact someone does not establish that person’s permission to receive messages or be recorded. Recording and transcription remain subject to required participant notice and consent. Once a message or file is delivered outside You.one, the recipient’s and their provider’s copies may remain even if you delete your You.one copy.

## Staff review, operational logs, and replay

Joshua Segeren and the people he appoints may review content you put directly into You.one to support you, debug problems, keep the service working, address safety issues, and evaluate and improve the product during beta and V1. This review is authorized through the Terms you accept, subject to any additional consent required by law. Our review policy requires a record of who deliberately reviewed your content, why, and when, with access limited to the purpose of the review. Current access records include the actor and time, but a reason is not yet captured consistently. We are improving those records; this policy does not represent that every current review has a complete reason record. Reviewers must keep your content confidential and use it only for the authorized purpose. This is not permission to train or fine-tune a model.

Ordinary customer content may remain in operational logs and diagnostics. We try to redact hard secrets, including passwords, payment-card numbers, tokens, and API keys. We do not promise that every secret is successfully removed or that logs are content-free. Do not put hard secrets in ordinary product fields.

This general authorization does not permit staff to read individual messages, files, or other content obtained from a connected Google account for general product research. Google data has the narrower access rules described below. Those rules follow copied and derived Google content, including when it appears in conversations, saved Memory, transcripts, logs, diagnostics, or session replay. General staff-review authorization does not override them. If session replay is enabled, authorized staff may review it for the disclosed purposes subject to those limits.

Session replay is a planned beta feature. If enabled, it can capture screens, screenshots, and text outside masked fields. Do not enter passwords, one-time login codes, payment details, or other secrets into ordinary product fields. We will enable beta replay only after verifying sensitive-field masking and exercising its deletion process. We will disclose its verified retention periods before enabling it. Replay kept for an approved support or safety case and technical diagnostics have separate retention needs. We are still verifying and reducing retention across our systems and providers; this version does not promise a fixed deletion period for those records. Until those replay safeguards are verified, beta replay stays off.

You can use our [privacy request](/privacy-request) form to ask for a copy or deletion of the information connected to you. You can disconnect an optional service separately. Disconnecting a service does not automatically erase saved conversations or Memory from it; you can ask us to correct or forget saved Memory or to delete your account.

## Other service providers

If you create or use an account-backed experience, authentication and account data may go through Clerk. If you search for or confirm a location, those requests may go through Google Maps. If you use our contact or privacy-request form, SendGrid delivers your message to our You.one mailbox and a founder backup Gmail mailbox. The separate feedback form sends a report through SendGrid to configured feedback recipients and may also store a copy in Vercel Blob or Trello when enabled. We handle these messages and reports manually and retain them as needed to process and document them, subject to applicable law and deletion requests. Public forms use IP addresses to limit abuse. If you previously left an optional tip, its payment record may remain with Stripe or Venmo. That earlier tip is not authorization for paid-service funding. The paid funding practices below apply only when you choose and activate that offer.

At the September 24 checkpoint, new beta calls were held; an earlier authorized call request could still finish. This is the last recorded status, not a new verification of live call availability. For that call, Twilio can process the phone numbers and both parties' audio and is configured to record the connected conference from its start. Our separately operated Calls media service can process the audio and send it to SpaceXAI for live transcription through a separate credential whose account coverage has not been verified. You.one may keep the recording, transcript, call status, and provider receipts for your account. Session-replay controls do not cover call recordings; we are still verifying retention and deletion for calls and their providers. You can request deletion through our [privacy request](/privacy-request) form. The primary SpaceXAI account's Zero Data Retention setting does not establish protection for Twilio or for the separate Calls transcription route. Their route-specific no-training, retention, and deletion checks remain incomplete in that checkpoint record; we do not claim verified ZDR for them. Participants must receive any notice or consent process the applicable law requires; the recording description here does not waive their rights.

We do not sell personal information or share it for cross-context behavioral advertising. Before starting either practice, we will update this policy and obtain any consent the law requires. Google Signals and ads personalization are not part of the default You.one analytics setup.

## Payments, usage, and referrals

When you choose paid enrollment, we use account and invitation identifiers, contact details, your country and confirmed calendar timezone, the versions of the Terms/Billing section and Privacy Policy you accepted, acceptance timestamps, and payment authorizations to establish and administer that enrollment. We record your funding mode, automatic-payment limit, refill terms, selected method, confirmed one-off purchases including any above-limit warning, and later consent changes or revocations. These records distinguish a one-off purchase from permission for future automatic charges.

Stripe processes the card and supported wallet payments offered through the payment screen. You submit payment credentials through its payment interface; You.one receives information needed to reconcile the payment, such as processor and transaction identifiers, status, amount, currency, billing details, and limited payment-method information. Using a wallet does not authorize access to your other accounts. We name and explain another payment processor before offering it; a stored method is not permission to switch processors or start automatic funding.

We keep financial records for funding, reservations, usage estimates and final retail charges, the related work category and operation, pending measurement, carryover, promotional value, outstanding usage, refunds, disputes, corrections, and receipt/report delivery. We use these records to account for funds, apply your payment settings, stop work when funding is insufficient, investigate billing problems and fraud, and meet legal duties. Financial records can identify when and what kind of work occurred; they are not anonymous merely because they omit the full conversation.

A billing investigation may require a limited review of the work associated with a disputed charge by Joshua or appointed staff, under the staff-review rules above. We keep dispute review records tied to your account and limit internal summaries to the relevant references and explanation. Narrower rules for connected-service data, including Google content and its copies or derivations, continue to apply. A billing dispute is not blanket consent for staff to read that content. We do not use payment or billing evidence to train or fine-tune models.

Referral records link a referrer and the referred person's eligible signup or activation so we can attribute a referral, prevent duplicate rewards, and handle reversals. A referral does not share account access, work, payment-method details, balances, receipts, or the referred person's spending with the referrer. Before a referred person pays, we disclose that reward status can reveal to the referrer that a qualifying activation occurred. Grouped invitations do not create shared accounts or permissions.

We send funding receipts, payment-authentication or failure messages, account-stop notices, Monthly Reports, refund/dispute updates, and material contract notices by the channels disclosed for your account. These service messages are distinct from optional promotional messages and do not enroll you in unrelated marketing.

Account deletion does not necessarily erase the financial records needed to complete a payment or refund, document your authorization, resolve a dispute, prevent fraud, or meet accounting, tax, or unclaimed-property obligations. We restrict retained records to those purposes and retain them only as long as needed or legally required; unrelated saved content follows the separate deletion process. We do not keep all conversations merely because a financial record must remain. You can request access or correction through our [privacy request](/privacy-request) form. We explain an applicable retention exception when responding to a deletion request and preserve legally required request deadlines.

## Your data, memory, and model training

The content you put in You.one remains yours. We use it as this policy describes; sharing it with Ava does not make it training material. You.one does not train AI models on customer content, and we do not permit our AI providers to train on it.

Remembering context is different from training a model. You.one stores conversations, files, and saved context so you can return to your work. Relevant context may be sent to an AI provider when Ava needs it to respond. That does not change the underlying model or teach it your information for use with other people.

**Example:** If you ask Ava to help plan a move, You.one may save your conversation and use your budget and moving date in a later response. Keeping those details for your own continuity is not model training.

## What AI providers receive and keep

We are working to verify every API that sends or processes customer content, for every data type used on that route. The review covers the actual account and credential, model, endpoint, tools, and any onward processing. A text check does not verify voice, images, files, or Calls. Our aim is to complete those checks for V1. If an available feature has an incomplete check, this policy must identify the feature, what is verified, and what remains unverified. A provider’s account setting alone does not establish complete coverage. We do not silently move customer content to another provider or route whose protections have not been verified.

AI providers process the information needed to generate a response. This may include your request, relevant conversation history, and selected content from files or connected services. AI processing can also support background features, not just messages you send directly to Ava.

**Processing-status checkpoint: September 24, 2026.** Availability statements in this table describe the last recorded checks. Incomplete checks are disclosed as incomplete; account-level ZDR does not verify every feature.

| Use case | AI provider | What You.one does | What we can verify about the provider |
| --- | --- | --- | --- |
| Text and chat | SpaceXAI | At the checkpoint, customer AI requests were held while we verified each route before activation. When a supported text route opens, it may send the request and context needed through our Production SpaceXAI account. Saved chats stay in You.one. | Account-level ZDR is active. For supported requests, SpaceXAI's terms say request and response content is processed transiently and deleted by the earlier of response delivery or one hour after the request completes. We are still verifying every text route. |
| Text and chat | OpenAI, Groq, Anthropic | Does not send customer content to these providers while equivalent ZDR remains unverified. | We have no account-level ZDR proof for these providers. OpenAI's standard API abuse logs may retain content for up to 30 days; no-training alone is not ZDR. |
| Speech and voice | SpaceXAI | At the checkpoint, Board voice typing was unavailable and Calls were not released for beta; a call already authorized before the hold could still finish through a separate service. You.one may keep its recording and transcript. | Our primary Production account has ZDR enabled, but we have not verified ZDR coverage for every voice route or the separate Calls service account. |
| Speech and voice | OpenAI, Groq | Does not send customer audio or transcripts to these providers while equivalent ZDR remains unverified. | We have no account-level ZDR proof for these voice routes. |
| Images | SpaceXAI | At the checkpoint, customer image analysis and generation were unavailable pending route verification. If enabled later, compatible requests may send image inputs through the verified account. Any generated media we keep will be stored by You.one. | The account has ZDR enabled. Under ZDR, provider-stored image outputs and file IDs are unavailable; compatible generated images must be returned inline, such as base64. We are still verifying every image route. |
| Images | OpenAI | Does not send customer images to OpenAI while equivalent ZDR remains unverified. | We have no account-level ZDR proof for OpenAI image routes. |

This table concerns AI-provider retention of request and response content, not the conversations and files You.one saves for you. Account-level ZDR does not prove that every model, endpoint, tool, or input type uses a supported request. No-training and zero-retention are different protections.

**SpaceXAI:** We enabled Zero Data Retention for our Production SpaceXAI account on September 22, 2026 and verified it using the account used by our live service. Under its ZDR terms, supported request and response content is processed transiently and deleted by the earlier of response delivery or one hour after the inference request completes. This replaces the ordinary 30-day retention period for that content. Non-content account, billing, and operational records are separate.

ZDR applies to supported requests through that account. We are verifying which You.one features and input types use those requests. Features that require SpaceXAI to keep content are restricted or unavailable.

Our SpaceXAI setting does not apply to OpenAI or any other provider. Each route and data type needs its own protection and verification record; the table identifies the restrictions and incomplete checks recorded at that checkpoint. Some features may be unavailable while that work is open. An available feature with incomplete verification must have its specific processing and retention limits disclosed here; that disclosure does not itself establish ZDR. We do not describe all data processing in You.one as zero-retention: You.one and our operational service providers still keep the records needed to run the product.

You can read [SpaceXAI’s Enterprise Terms, section 3.4](https://x.ai/legal/terms-of-service-enterprise), [xAI's API security documentation](https://docs.x.ai/developers/faq/security), and [OpenAI's data controls](https://developers.openai.com/api/docs/guides/your-data).

## What stays with You.one

Provider deletion does not delete your saved information in You.one. We keep customer records in storage we control, including through our hosting and storage providers, so you can continue your conversations and work over time. Those providers still process data to operate the service; ZDR at an AI provider does not mean no company ever stores your information.

**Example:** When you ask Ava about an uploaded document, the relevant content may be processed to answer your question. Your saved document and conversation can remain in You.one after the AI provider deletes its processing copy.

Temporary conversation caching can make replies faster and reduce repeated processing. It is separate from both model training and your long-term saved history. We review the actual provider feature and its retention behavior before treating a cache as compatible with our privacy commitments.

The access, diagnostics, and deletion limits elsewhere in this policy still apply. A no-training commitment does not mean that support staff can never access content or that every operational record disappears immediately.

## Google account connection

Connecting Google is optional and depends on the feature being available. When you choose **Connect Google**, You.one may request access to the Google products shown in the consent screen, including Gmail, Drive, Calendar, Contacts, and Tasks. You can grant only some requested access; You.one treats that as a valid partial connection and shows which products are connected, declined, unavailable, still syncing, or need attention.

The connection lets Ava stay oriented to the email, files, meetings, contacts, and changes you authorize so you do not have to explain the same context repeatedly. It does not give Ava unlimited authority. Reading connected content does not by itself authorize Ava to send a message, make a call, buy, publish, permanently delete provider content, or take another consequential external action.

For Gmail, You.one stores account-scoped mailbox metadata across the authorized mailbox, including message and thread identifiers, dates, sender and recipient headers, subject, labels, snippets, attachment metadata, provider state, and deletion records.

For recent messages, it may also store normalized message bodies and raw message copies, depending on the connection's sync mode, for up to the most recent 24 months. The full normalized and raw copies are encrypted by You.one before private file storage. Searchable message text is stored separately in our account-scoped database; it is not the encrypted private-file copy described above. Older message bodies and attachment content are retrieved and cached when you or Ava need them for an authorized feature.

For Drive and other connected Google products, You.one stores the provider identifiers, metadata, change history, and content needed for synchronization, search, retrieval, and the features you use. Google remains the canonical source for Google files and records; native You.one events and artifacts have their own You.one records. Where you authorize available two-way synchronization, supported changes can also be sent back to Google, including creating or updating events or documents and other changes within the approved scope. We retain the change and synchronization records needed to reconcile those copies. Connection scopes alone do not authorize Ava to send, publish, or delete content; your direct action or applicable grant must cover that step. Synchronization can be delayed or fail, so copies may temporarily differ.

Connection credentials and tokens are encrypted in a private credential vault and are kept separate from mirrored source content. Our credential-handling paths are designed to keep passwords, one-time codes, cookies, OAuth tokens, and authorization headers out of the Board, Activity, search documents, model context, and ordinary application logs. We try to redact hard secrets; a secret entered into an ordinary product field may still appear in a log.

Source synchronization, parsing, and indexing are separate from Ava’s use of connected context. When an Ava feature needs connected content, only relevant authorized evidence is retrieved for that interaction or background task. You.one may send that selected evidence to approved AI service providers to provide the feature for you. Google user data is not sold, used for advertising, or used to train generalized models across users.

You.one's use and transfer of information received from Google APIs follows the [Google API Services User Data Policy](https://developers.google.com/terms/api-services-user-data-policy), including its Limited Use requirements. Staff may not read individual Google content for general beta research, including its copies or derivations in other records. A person may view specific Google content only after your affirmative agreement to that specific review or when necessary for security or legal compliance. These narrower limits follow Google content and its copies or derivations in logs, Memory, transcripts, and replay; general staff-review authorization does not expand them. Aggregated Google-derived data may be used for internal operations where Google's policy permits it.

## How we use data

- run the guided experience
- remember your settings and resume progress
- improve quality, safety, speed, and reliability
- learn where people get stuck and what actually helps
- process feedback and any payment, refund, or dispute you authorize or request
- synchronize and retrieve content from services you choose to connect
- help Ava understand authorized context and provide features for you

The goal is to be practical, clear, and helpful, not to collect data for its own sake.

These purposes remain within the Terms authorization and any additional consent required by law. They do not override the narrower limits on connected Google data described above. Public analytics is separate from beta participation.

## Privacy controls today

Privacy controls are manual today. Through our [privacy request](/privacy-request) form, you can ask to access or export your information, correct it, forget saved Memory, delete connected-source copies, or delete your account. You can also disconnect an optional service. We may need enough detail to identify your records and verify the request.

Deleting source copies and forgetting saved Memory are separate requests; disconnecting a service does not automatically do both. Our deletion process is intended to reach relevant derived search indexes and caches and prevent deleted information from returning through a restore or reconnect. Backups, provider records, security records, and information we must keep by law have separate limits. We explain applicable exceptions when handling your request. We are verifying this process and do not yet promise fixed completion or backup-expiry periods.

Where applicable law gives you a right to withdraw consent for an optional use, you may do so through the privacy request form without closing your account. If a use is necessary for a feature you choose to keep using, withdrawing that consent can limit that feature. We honor applicable rights to appeal a privacy-request decision and to exercise privacy rights without unlawful discrimination.

These operational limits do not extend a response deadline or remove a right that applicable privacy law gives you. We must handle your request within any legally required timeframe, including any permitted extension and its required notice.

## For California residents

If you are in California, you can ask us to tell you what we have connected to you, correct it, delete what we control, or stop any sale or targeted-advertising share if that ever applies.

For now, send a [privacy request](/privacy-request). These requests are handled manually for now, with possible provider retention limits.

## For Canada residents

You can ask to access or correct personal information we control through the same [privacy request](/privacy-request) form. We handle requests manually under the law that applies where you live. Our named service providers may process your information in the United States or other countries where they operate; that information may be subject to the laws of those places. You may complain to the privacy regulator responsible where you live, including the Office of the Privacy Commissioner of Canada or Québec’s Commission d’accès à l’information. Making a complaint does not waive your rights.

## Your choices and cautions

You can clear local You.one data by clearing this site's browser storage and cookies. You can also choose not to submit feedback or payment details.

You can ask us to review, correct, or delete information connected to you by sending a [privacy request](/privacy-request). Because this is manual today, include the email, account, browser/session details, or other context we can use to find the relevant records.

You can disconnect Google at any time. Disconnecting revokes the connection and stops new synchronization. Source-copy deletion is a separate retention choice: to delete connected-source copies, request deletion through the privacy request form. Disconnecting does not automatically erase excerpts already saved in a You.one conversation or saved Memory from connected content; you can request their deletion or Memory forgetting separately. Disconnecting You.one never deletes the original email, file, calendar, contact, task, or other content from Google.

If something is highly sensitive, share as little as possible. You.one is an AI-powered product. It can be useful, but it can also be wrong. It is not an emergency or crisis service. Ava is not a licensed or certified professional; her advice, recommendations, and analysis on professional subjects are tentative, as explained in the [Terms](/terms).

If you have a privacy question, send a [privacy request](/privacy-request). For other feedback, [contact us](/contact).

## Changes to this policy

Each version has its date, version identifier, and a summary of changes near the top. We update this policy when our data practices materially change. We explain what changed in plain language, with examples where they help, and give notice by email or in the product when a change materially affects your rights or how we use your information. Except where law or an existing agreement requires advance notice or new consent, an update may take effect when we give that notice; we do not promise a fixed advance-notice period. A notice cannot retroactively authorize a use that was not permitted when information was collected. We will ask for a new affirmative choice when applicable law requires one; continuing to use You.one alone does not authorize a new use that requires separate consent.

**[October 21, 2026 — privacy.2026-10-21.2](/legal/versions/privacy.2026-10-21.2.md) (earlier publication candidate):** Expanded communication, shared-content, and synchronization disclosures. Preserved in full; this history does not claim publication.

**[October 21, 2026 — privacy.2026-10-21.1](/legal/versions/privacy.2026-10-21.1.md) (earlier publication candidate):** R3 funding, usage and financial-record disclosures. Preserved in full; this history does not claim publication.

**October 10, 2026 — privacy.2026-10-10.2 (earlier publication candidate):** Provider checkpoints, no-training and ZDR distinctions, staff review and logging, Google data limits, manual privacy controls, and communication misuse review. The source remains preserved; this history does not claim publication.

**[October 1, 2026 — privacy.2026-10-01.3](/legal/versions/privacy.2026-10-01.3.md):** Previous published Privacy Policy, preserved in full.

**September 25, 2026:** Clarified that public analytics can run before a beta invitation; distinguished replay limits from call-record retention; and described the separate searchable Gmail text copy.

**September 25, 2026:** Clarified Twilio's role and the audio and records from an earlier call request that may finish during the current beta hold.

**September 25, 2026:** Clarified that public Google Analytics is active, separated other service providers from beta research, and aligned material-change notice with the Terms.

**September 25, 2026:** Clarified how recent Gmail body copies and searchable text are stored.

**September 24, 2026:** Named Segeren Studio LLC as the operator of You.one and the party responsible for this policy.

**September 24, 2026:** Clarified that customer AI text and image routes are currently held while their provider privacy checks are completed.

**September 24, 2026:** Clarified Google-data staff access, current diagnostic-retention uncertainty, Canadian requests, and the separate Calls service exception.

**September 23, 2026:** Added a provider comparison table that makes the unverified OpenAI and other-provider retention limits explicit, clarified the beta voice hold, explained why session replay is off pending safeguards, and distinguished the contact/privacy-request and feedback delivery routes.

**September 22, 2026:** Added our verified xAI ZDR activation, explained why remembering your context is not model training, and distinguished provider deletion from the records You.one keeps for you. This update does not claim ZDR for every provider.