---
title: Privacy Policy
description: 'How You.one handles your information, uses AI providers, and manages saved records.'
intro: 'How You.one handles your information, uses AI providers, and manages saved records.'
---
Last updated: October 24, 2026. Version: privacy.2026-10-24.1.

[Download this version](/legal/versions/privacy.2026-10-24.1.md). Change notes are below; available earlier versions are linked at the end of this document.

## What changed in this version

- Stated that this policy also covers people who communicate with users or Ava without an account, such as call participants.
- Explained the opening audio buffer on calls, what recording refusal changes, and why live AI processing and factual notes are separate from keeping a recording or full transcript.
- Identified the Telnyx and SpaceXAI calling route under test, its unverified protections, and the limits of the October 24 evidence review.
- Clarified the session-replay rule and the limits of current configuration verification. No new provider route, recording permission, or paid feature is approved by this update.

The bullets below summarize the unpublished accumulation since the last published Privacy Policy (October 1, 2026).

- Added the business mailing address and made route-verification and California opt-out language consistent throughout.

- Distinguished the no-training rule from incomplete route verification, named the privacy contact, and clarified pricing-version and connected-data records.

- Clarified public analytics without a separate consent prompt, dated evidence, referral disclosures, connected-data limits, and applicable privacy choices.
- Explained records of manual funding, optional automatic refills, payment limits, separately confirmed purchases above the limit, usage settlement, refunds, disputes, and referrals.
- Distinguished financial-record retention from saved product content and account deletion.
- Explained shared Boards and artifacts, Calendar and two-way sync, and the information involved in available email, phone, and text features.
- The September 24 provider table stays a historical checkpoint. The October 24 Telnyx/SpaceXAI note adds test evidence only. It does not certify a Production route, deletion, or no-training coverage, and it does not change billing.2026-10-21.7 or the no-training rule.

## What this page covers

Segeren Studio LLC, a Wyoming limited liability company, operates You.one and is responsible for this Privacy Policy. Our records show an administrative dissolution after a missed Wyoming annual report; we plan to reinstate the company. In this policy, "we" and "us" refer to Segeren Studio LLC. Joshua Segeren, founder, is the person responsible for the protection of personal information. Business mailing address: 701 Tillery Street Unit 12, 3121, Austin, TX 78702, United States. Contact him at [joshua@you.one](mailto:joshua@you.one) or through the [privacy request](/privacy-request) form.

This policy also covers personal information we receive about people who communicate with users or Ava, even if they do not have a You.one account. You do not need an account to use our [privacy request](/privacy-request) form or email [joshua@you.one](mailto:joshua@you.one) to ask about access, correction, deletion, or applicable opt-out rights. We may need enough detail to locate your records; the retention limits and legal exceptions in this policy still apply.

You.one is built to help regular people make progress in real life. This page explains what information the product uses and where it can go, including dated checkpoints and the limits of those checks.

This Privacy Policy describes our disclosed data practices; a dated checkpoint is not a new certification of every live route. You.one keeps your record so Ava can remember and help. AI providers that receive customer content must be barred from training on it. Incomplete verification of that protection on particular routes is identified below; the rule is not a claim that every route has been verified. Zero Data Retention at a provider does not mean You.one stores nothing. We update this policy when our practices materially change and summarize the changes near the top.

## Account age

You.one accounts are currently for people who are at least 18 and have reached the age of majority where they live. People who do not meet this rule should not create an account. If we learn that an ineligible person created an account, we may restrict it and review or delete the information associated with it, subject to legal and security retention needs. A parent or guardian can contact us through the [privacy request](/privacy-request) page.

## What you share with You.one

When you use You.one, you may share what you type, tap, or submit. That can include the situation you want help with, answers you choose, freeform notes, feedback, your name, or your saved location.

If you put something into You.one, assume it may be processed to run the experience.

## Boards, Calendar, and shared content

Your saved product content can include conversations with Ava, Boards, Cards, documents and other artifacts, calendar events, activity, decisions, and the approvals or standing grants you give Ava. We keep content and relevant versions, permissions, action records, and synchronization state to provide the features you use and explain what happened.

Where collaboration is available, the material you choose to share becomes available to the audience authorized for it, such as a partner, family member, teammate, guest, or client. A Board invitation does not itself share your entire account, private conversations with Ava, or unrelated connected-service content. A private calendar item does not become shared solely because it relates to a shared Card; sharing still requires the relevant permission. People who receive content may copy or download it. Removing access or deleting your copy cannot necessarily recall copies already received by someone else.

## What we may store in your browser

Some product state is stored locally in your browser so You.one can feel continuous, even though parts of the experience may also be sent to our backend or service providers when needed.

- your name and saved home location
- appearance and product preferences
- where you left off, saved answers, and screens you can return to
- session or visit IDs that help keep a visit together
- your confirmation that you meet the account age requirement

## What may go to our systems and service providers

Our last recorded route checks, on September 23–24, found customer AI routes restricted while we verified their processing paths. That is dated evidence, not a verification of current hosted routing. At that checkpoint, a supported route was limited to sending prompts, answers, and recent context through our Production SpaceXAI account with Zero Data Retention (ZDR) then enabled. The table records those checks. It distinguishes routes then held from a call already authorized before the hold that, at that checkpoint, could still finish through another service whose ZDR coverage was not verified. Current hosted routing has not been rechecked. If a route cannot serve a feature, that feature may be unavailable. Our rule prohibits silently sending customer content to a different AI provider, account, or route without verified equivalent protection; this is not a claim that every live route was reverified on October 24.

Some public pages currently use Google Analytics, which can set analytics cookies and send client or session identifiers, page views, and related device or campaign information to Google before you reach a beta invitation. Public analytics currently starts without a separate consent prompt. Accepting the beta Terms does not control it or supply any separate analytics consent required by law. We have not verified this flow against every jurisdiction’s prior-consent requirements. We also use or may enable other telemetry and diagnostic tools, including Vercel Analytics or hosting logs, PostHog, and Sentry, to understand quality, reliability, and whether the product is helping. Depending on the tool and route, that can include IP addresses, cookies or session IDs, pages viewed, buttons pressed, forms submitted, campaign and referral information, device and rough geography data, conversion events, error data, screen or route metadata, and in some cases transcript snapshots or request details used for debugging.

Our rule is to keep session replay off until its safeguards are verified. The Production project settings we checked on October 24 did not list PostHog capture configuration. That absence alone does not establish whether replay is off in every serving build, route, or other service. We have not completed that check. If replay is enabled, it can capture screens and text outside masked inputs; the staff-access and connected-data limits below still apply.

## Communications and misuse review

We use your contact details for account, invitation, security, welcome, and beta follow-up messages. A message that promotes an offer or referral reward must meet applicable consent and unsubscribe requirements; accepting the Terms is not permission to disregard those requirements.

The [Terms of Service](/terms) explain permitted and prohibited communications. Cold sales outreach, spam, prank calls, impersonation, harassment, and attempts to evade restrictions are prohibited. These rules apply to channels as they become available; this policy does not announce new communication features.

To investigate and respond to a complaint or other suspected misuse, authorized staff may review relevant available account and communication records, including the requested task, recipient details, timing, contact attempts, outcomes, complaints, and call recordings or transcripts where they were lawfully collected. These records can include information about people you contact, such as their number and any refusal they give. Where we keep a refusal or opt-out record to prevent unwanted contact, it includes the scope expressed by the recipient. A review may consider several contacts together and relevant links between suspected abusive accounts, subject to access restrictions. Staff must not use this review to expose one person’s private content to another. This is part of the service-operation and safety review described below, subject to the narrower connected-service access rules. It is not permission to record a call without required notice or consent, to train a model, or to collect unrelated information. Our rules do not guarantee that every misuse will be detected or prevented. These records follow the retention and request limits in this policy.

## Email, phone, text, and communication identities

When a communication feature is available and you choose to use it, we may store your assigned email addresses or phone number, the separate identity used by Ava, sender and recipient details, message bodies and attachments, call audio or transcripts where lawfully collected, text or multimedia messages, and delivery, timing, consent, refusal, and action records. This can include information supplied by someone replying to you or Ava. We use these records to deliver and organize the communication, connect it to the relevant work, provide authorized context to Ava, and handle support, security, and misuse.

Delivery and telephony providers may receive the addresses, numbers, content, media, and service records needed for their role. Their transport, billing, security, and legally required records are distinct from AI inference and are not made zero-retention by an AI provider’s ZDR setting. The provider and route disclosures in this policy must describe the service actually offered; mentioning a channel or an optional dedicated number does not announce its availability or approve a new provider route.

We record the authorization and payment settings for an optional dedicated number when you choose that offer. Buying a number or authorizing Ava to contact someone does not establish that person’s permission to receive messages or be recorded. Recording and transcription remain subject to required participant notice and consent. Once a message or file is delivered outside You.one, the recipient’s and their provider’s copies may remain even if you delete your You.one copy.

## Recording choices on calls

We are testing a calling route; this description does not announce its customer availability or establish that all of its privacy checks are complete. This section describes the Telnyx and SpaceXAI route under test, rather than the earlier Twilio route recorded at the September 24 checkpoint. The flow uses a short opening audio buffer before a participant answers the recording question, so the answer itself can be captured. A pending carrier recording may also exist during that opening. This is a record-then-keep-or-discard design, not a promise that no audio is processed or recorded before a yes.

If the participant agrees, the flow is designed to keep the call recording and full transcript, along with relevant notes and action records, associated with the account of the user who placed the call. The access, sharing, staff-review, and retention limits in this policy apply. If the participant refuses or later withdraws recording permission, the flow is designed to stop retaining the recording and full transcript, discard buffered audio, and stop and request deletion of pending provider recordings and saved audio copies. On the last controlled synthetic Development call checked after a refusal, we found no saved audio, full transcript, or available download at the time of that readback. This does not prove that temporary copies never existed earlier in the call, establish a deletion deadline, or verify hosted-route deletion, restoration from backups, or removal from every provider log or backup. Parts of what was said can still appear in our operational logs and diagnostics or in provider records, as described elsewhere in this policy; we have not verified removal from all of them.

Refusing a saved recording does not itself end the call or stop the live AI processing needed to continue it. Useful factual notes attributed to the call and a record of the recording choice may remain. Those notes can identify participants and contain personal information or statements from the call. Refusal is not a promise that no temporary transcription occurs; the exact timing and retention of every intermediate processing copy remain unverified. A participant who does not want to continue speaking with an AI can hang up at any time. A participant, including someone without an account, can also ask to withdraw recording permission or make another privacy request through our [privacy request](/privacy-request) form. Permission from a You.one user is separate from the participant's choices and any notice or consent the law requires, including for the opening buffer. Silence or an unclear answer does not establish consent; the evidence reviewed for this update does not verify every unanswered or interrupted-call outcome. One participant’s answer does not establish every participant’s consent. Any required prior or all-party consent, including applicable timing, content, and language requirements, still applies to the opening buffer, pending carrier recording, transcription, and live AI processing. Later stopping, discarding, or deleting a recording does not supply consent that was missing when capture or processing began or make that earlier capture lawful. This policy neither supplies that consent nor represents that a provider or regulator has approved the flow.

## Staff review, operational logs, and replay

Joshua Segeren and the people he appoints may review content you put directly into You.one to support you, debug problems, keep the service working, address safety issues, and evaluate and improve the product during beta and V1. This review is authorized through the Terms you accept, subject to any additional consent required by law. Our review policy requires a record of who deliberately reviewed your content, why, and when, with access limited to the purpose of the review. Current access records include the actor and time, but a reason is not yet captured consistently. We are improving those records; this policy does not represent that every current review has a complete reason record. Reviewers must keep your content confidential and use it only for the authorized purpose. This is not permission to train or fine-tune a model.

A user's acceptance of the Terms does not supply consent from someone else, such as a call participant. We review a participant's information only to deliver and support the requested communication and for security, misuse, and legal purposes, consistent with their recording choice. General staff-review authorization does not replace any separate consent required for that person's information or authorize keeping their refused recording or full transcript for product evaluation.

Ordinary customer content may remain in operational logs and diagnostics. We try to redact hard secrets, including passwords, payment-card numbers, tokens, and API keys. We do not promise that every secret is successfully removed or that logs are content-free. Do not put hard secrets in ordinary product fields.

This general authorization does not permit staff to read individual messages, files, or other content obtained from a connected Google account for general product research. Google data has the narrower access rules described below. Those rules follow copied and derived Google content, including when it appears in conversations, saved Memory, transcripts, call notes, logs, diagnostics, or session replay. General staff-review authorization does not override them. If session replay is enabled, authorized staff may review it for the disclosed purposes subject to those limits.

We have not completed verification of session-replay configuration and safeguards on every route. If enabled, it can capture screens, screenshots, and text outside masked fields. Do not enter passwords, one-time login codes, payment details, or other secrets into ordinary product fields. We will enable beta replay only after verifying sensitive-field masking and exercising its deletion process. We will disclose its verified retention periods before enabling it. Replay kept for an approved support or safety case and technical diagnostics have separate retention needs. We are still verifying and reducing retention across our systems and providers; this version does not promise a fixed deletion period for those records. Our policy is to keep beta replay off until those safeguards are verified.

You can use our [privacy request](/privacy-request) form to ask for a copy or deletion of the information connected to you. You can disconnect an optional service separately. Disconnecting a service does not automatically erase saved conversations or Memory from it; you can ask us to correct or forget saved Memory or to delete your account.

## Other service providers

If you create or use an account-backed experience, authentication and account data may go through Clerk. If you search for or confirm a location, those requests may go through Google Maps. If you use our contact or privacy-request form, SendGrid delivers your message to our You.one mailbox and a founder backup Gmail mailbox. The separate feedback form sends a report through SendGrid to configured feedback recipients and may also store a copy in Vercel Blob or Trello when enabled. We handle these messages and reports manually and retain them as needed to process and document them, subject to applicable law and deletion requests. Public forms use IP addresses to limit abuse. If you previously left an optional tip, its payment record may remain with Stripe or Venmo. That earlier tip is not authorization for paid-service funding. The paid funding practices below apply only when you choose and activate that offer.

At the September 24 checkpoint, new beta calls were held; an earlier authorized call request could still finish. This is the last recorded status, not a new verification of live call availability. For that earlier call, the checkpoint recorded that Twilio could process the phone numbers and both parties' audio and was configured to record the connected conference from its start; that our separately operated Calls media service could process the audio and send it to SpaceXAI through a separate credential whose account coverage had not been verified; and that You.one might keep the recording, transcript, call status, and provider receipts. This is not the Telnyx/SpaceXAI route under test, and it was not reverified on October 24. Session-replay controls do not cover call recordings; we are still verifying retention and deletion for calls and their providers. You can request deletion through our [privacy request](/privacy-request) form. The primary SpaceXAI account's Zero Data Retention setting does not establish protection for Twilio or for the separate Calls transcription route. Their route-specific no-training, retention, and deletion checks remain incomplete in that checkpoint record; we do not claim verified ZDR for them. Participants must receive any notice or consent process the applicable law requires; the recording description here does not waive their rights. This checkpoint does not establish that required notice or consent timing has been implemented on every route.



**Calling-route evidence reviewed October 24:** Controlled test calls in our development environment, using test participants, have used Telnyx for the phone-network connection and carrier recording, and SpaceXAI for the AI conversation and separate after-call speech transcription. Telnyx-managed AI was not selected for that test route. We have not independently verified whether that route is currently available to customers in Production. Exact account-level no-training and retention coverage, all downstream processing, and provider backup and call-record deletion remain unverified. Transport and call metadata are separate from AI audio retention. We are seeking the applicable written assurances and settings; a successful call or a public provider policy is not that confirmation. We have not confirmed whether Telnyx’s terms for our account allow it to use call recordings or call data to train or improve models.

Our policy prohibits selling personal information or sharing it for cross-context behavioral advertising. Public analytics nevertheless sends the information described above to Google without a separate consent prompt. We have not verified how every applicable jurisdiction classifies that flow, including under sale, sharing, or prior-consent rules; accepting the Terms does not supply any separate consent those rules require. Google Signals and ads personalization are not part of the default analytics setup described here. Before adding a new sale or advertising-sharing practice, we update this policy and obtain any consent the law requires.

## Payments, usage, and referrals

When you choose paid enrollment, we use account and invitation identifiers, contact details, your country and confirmed billing timezone, the versions of the Terms/Billing section and Privacy Policy you accepted, the pricing-terms version presented for chargeable work, acceptance timestamps, and payment authorizations to establish and administer that enrollment. We record your funding mode, automatic-payment limit, refill terms, selected method, confirmed one-off purchases including any above-limit warning, and later consent changes or revocations. These records distinguish a one-off purchase from permission for future automatic charges.

Stripe processes the card and supported wallet payments offered through the payment screen. You submit payment credentials through its payment interface; You.one receives information needed to reconcile the payment, such as processor and transaction identifiers, status, amount, currency, billing details, and limited payment-method information. Using a wallet does not authorize access to your other accounts. We name and explain another payment processor before offering it; a stored method is not permission to switch processors or start automatic funding.

We keep financial records for funding, reservations, usage estimates and final retail charges, the related work category and operation, pending measurement, carryover, promotional value, outstanding usage, refunds, disputes, corrections, and receipt/report delivery. We use these records to account for funds, apply your payment settings, stop work when funding is insufficient, investigate billing problems and fraud, and meet legal duties. Financial records can identify when and what kind of work occurred; they are not anonymous merely because they omit the full conversation.

A billing investigation may require a limited review of the work associated with a disputed charge by Joshua or appointed staff, under the staff-review rules above. We keep dispute review records tied to your account and limit internal summaries to the relevant references and explanation. Narrower rules for connected-service data, including Google content and its copies or derivations, continue to apply. A billing dispute is not blanket consent for staff to read that content. We do not use payment or billing evidence to train or fine-tune models.

Referral records link a referrer and the referred person's eligible signup or activation so we can attribute a referral, prevent duplicate rewards, and handle reversals. A referral does not share account access, work, payment-method details, balances, receipts, or the referred person's spending with the referrer. Before a referred person pays, we disclose that reward status can reveal to the referrer that a qualifying activation occurred. Grouped invitations do not create shared accounts or permissions.

We send funding receipts, payment-authentication or failure messages, account-stop notices, Monthly Reports, refund/dispute updates, and material contract notices by the channels disclosed for your account. These service messages are distinct from optional promotional messages and do not enroll you in unrelated marketing.

Account deletion does not necessarily erase the financial records needed to complete a payment or refund, document your authorization, resolve a dispute, prevent fraud, or meet accounting, tax, or unclaimed-property obligations. We restrict retained records to those purposes and retain them only as long as needed or legally required; unrelated saved content follows the separate deletion process. We do not keep all conversations merely because a financial record must remain. You can request access or correction through our [privacy request](/privacy-request) form. We explain an applicable retention exception when responding to a deletion request and preserve legally required request deadlines.

## Your data, memory, and model training

The content you put in You.one remains yours. We use it as this policy describes; sharing it with Ava does not make it training material. You.one does not train AI models on customer content. Our rule prohibits our AI providers from training on that content. Verification of that protection is incomplete across the routes identified in this policy, including text, image, and voice routes still under review; the separate Calls transcription route and Twilio; and the Telnyx/SpaceXAI calling route under test. The calling services are described in **Other service providers**. Earlier account-level SpaceXAI ZDR evidence does not verify the conversation credential or separate transcription route used in the Telnyx/SpaceXAI tests. The rule alone does not establish verified protection for a particular route.

Remembering context is different from training a model. You.one stores conversations, files, and saved context so you can return to your work. Relevant context may be sent to an AI provider when Ava needs it to respond. That does not change the underlying model or teach it your information for use with other people.

**Example:** If you ask Ava to help plan a move, You.one may save your conversation and use your budget and moving date in a later response. Keeping those details for your own continuity is not model training.

## What AI providers receive and keep

We are working to verify every API that sends or processes customer content, for every data type used on that route. The review covers the actual account and credential, model, endpoint, tools, and any onward processing. A text check does not verify voice, images, files, or Calls. Our aim is to complete those checks for V1. If an available feature has an incomplete check, this policy must identify the feature, what is verified, and what remains unverified. A provider’s account setting alone does not establish complete coverage. We do not silently move customer content to another provider or route whose protections have not been verified.

AI providers process the information needed to generate a response. This may include your request, relevant conversation history, and selected content from files or connected services. AI processing can also support background features, not just messages you send directly to Ava.

**Evidence review: October 24, 2026; last recorded live-provider checkpoint: September 24, 2026.** The October 24 review covered engineering evidence, including newer controlled call tests and written voice/SIP guidance. It did not reverify current hosted routing or qualify proposed changes involving OpenAI, Groq, Anthropic, Google AI, email delivery, or AI checks used to suggest names or email addresses. Our no-training rule and prohibition on silently moving customer content to an unverified alternative still apply. This review does not confirm that every current live route meets those protections. The table below records the September 24 checks; it is not a current inventory of live routes.

**Processing-status checkpoint: September 24, 2026.** Availability statements in this table describe the last recorded checks. Incomplete checks are disclosed as incomplete; account-level ZDR does not verify every feature.

| Use case | AI provider | What You.one does | What we can verify about the provider |
| --- | --- | --- | --- |
| Text and chat | SpaceXAI | At the checkpoint, customer AI requests were held while we verified each route before activation. When a supported text route opens, it may send the request and context needed through our Production SpaceXAI account. Saved chats stay in You.one. | At the checkpoint, account-level ZDR was active. For supported requests, SpaceXAI's terms say request and response content is processed transiently and deleted by the earlier of response delivery or one hour after the request completes. We are still verifying every text route. |
| Text and chat | OpenAI, Groq, Anthropic | At the checkpoint, customer content was not sent to these providers while equivalent ZDR remained unverified. Current hosted routing has not been rechecked for this update. | We have no account-level ZDR proof for these providers. OpenAI's standard API abuse logs may retain content for up to 30 days; no-training alone is not ZDR. |
| Speech and voice | SpaceXAI | At the checkpoint, Board voice typing was unavailable and Calls were not released for beta; a call already authorized before the hold could still finish through a separate service. At that checkpoint, You.one might keep that call’s recording and transcript. This row is not the October 24 Telnyx/SpaceXAI test and is not a current inventory. | At the checkpoint, our primary Production account had ZDR enabled, but we had not verified ZDR coverage for every voice route or the separate Calls service account. |
| Speech and voice | OpenAI, Groq | At the checkpoint, customer audio and transcripts were not sent to these providers while equivalent ZDR remained unverified. Current hosted routing has not been rechecked for this update. | We have no account-level ZDR proof for these voice routes. |
| Images | SpaceXAI | At the checkpoint, customer image analysis and generation were unavailable pending route verification. If enabled later, compatible requests may send image inputs through the verified account. Any generated media we keep will be stored by You.one. | At the checkpoint, the account had ZDR enabled. Under ZDR, provider-stored image outputs and file IDs are unavailable; compatible generated images must be returned inline, such as base64. We are still verifying every image route. |
| Images | OpenAI | At the checkpoint, customer images were not sent to OpenAI while equivalent ZDR remained unverified. Current hosted routing has not been rechecked for this update. | We have no account-level ZDR proof for OpenAI image routes. |

This table concerns AI-provider retention of request and response content, not the conversations and files You.one saves for you. Account-level ZDR does not prove that every model, endpoint, tool, or input type uses a supported request. No-training and zero-retention are different protections.

**SpaceXAI:** We enabled Zero Data Retention for our Production SpaceXAI account on September 22, 2026 and verified that setting on the account our live service used at that time. This does not reverify current hosted routing or the separate Telnyx/SpaceXAI test credentials. Under its ZDR terms, supported request and response content is processed transiently and deleted by the earlier of response delivery or one hour after the inference request completes. This replaces the ordinary 30-day retention period for that content. Non-content account, billing, and operational records are separate.

ZDR applies to supported requests through that account. We are verifying which You.one features and input types use those requests. Features that require SpaceXAI to keep content are restricted or unavailable.

Our SpaceXAI setting does not apply to OpenAI or any other provider. Each route and data type needs its own protection and verification record; the table identifies the restrictions and incomplete checks recorded at that checkpoint. Some features may be unavailable while that work is open. An available feature with incomplete verification must have its specific processing and retention limits disclosed here; that disclosure does not itself establish ZDR. We do not describe all data processing in You.one as zero-retention: You.one and our operational service providers still keep the records needed to run the product.

You can read [SpaceXAI’s Enterprise Terms, section 3.4](https://x.ai/legal/terms-of-service-enterprise), [xAI's API security documentation](https://docs.x.ai/developers/faq/security), and [OpenAI's data controls](https://developers.openai.com/api/docs/guides/your-data).

## What stays with You.one

Provider deletion does not delete your saved information in You.one. We keep customer records in storage we control, including through our hosting and storage providers, so you can continue your conversations and work over time. Those providers still process data to operate the service; ZDR at an AI provider does not mean no company ever stores your information.

**Example:** When you ask Ava about an uploaded document, the relevant content may be processed to answer your question. Your saved document and conversation can remain in You.one after the AI provider deletes its processing copy.

Temporary conversation caching can make replies faster and reduce repeated processing. It is separate from both model training and your long-term saved history. We review the actual provider feature and its retention behavior before treating a cache as compatible with our privacy commitments.

The access, diagnostics, and deletion limits elsewhere in this policy still apply. A no-training commitment does not mean that support staff can never access content or that every operational record disappears immediately.

## Google account connection

Connecting Google is optional and depends on the feature being available. When you choose **Connect Google**, You.one may request access to the Google products shown in the consent screen, including Gmail, Drive, Calendar, Contacts, and Tasks. You can grant only some requested access; You.one treats that as a valid partial connection and shows which products are connected, declined, unavailable, still syncing, or need attention.

The connection lets Ava stay oriented to the email, files, meetings, contacts, and changes you authorize so you do not have to explain the same context repeatedly. It does not give Ava unlimited authority. Reading connected content does not by itself authorize Ava to send a message, make a call, buy, publish, permanently delete provider content, or take another consequential external action.

For Gmail, You.one stores account-scoped mailbox metadata across the authorized mailbox, including message and thread identifiers, dates, sender and recipient headers, subject, labels, snippets, attachment metadata, provider state, and deletion records.

For recent messages, it may also store normalized message bodies and raw message copies, depending on the connection's sync mode, for up to the most recent 24 months. The full normalized and raw copies are encrypted by You.one before private file storage. Searchable message text is stored separately in our account-scoped database; it is not the encrypted private-file copy described above. Older message bodies and attachment content are retrieved and cached when you or Ava need them for an authorized feature.

For Drive and other connected Google products, You.one stores the provider identifiers, metadata, change history, and content needed for synchronization, search, retrieval, and the features you use. Google remains the canonical source for Google files and records; native You.one events and artifacts have their own You.one records. Where you authorize available two-way synchronization, supported changes can also be sent back to Google, including creating or updating events or documents and other changes within the approved scope. We retain the change and synchronization records needed to reconcile those copies. Connection scopes alone do not authorize Ava to send, publish, or delete content; your direct action or applicable grant must cover that step. Synchronization can be delayed or fail, so copies may temporarily differ.

Connection credentials and tokens are encrypted in a private credential vault and are kept separate from mirrored source content. Our credential-handling paths are designed to keep passwords, one-time codes, cookies, OAuth tokens, and authorization headers out of the Board, Activity, search documents, model context, and ordinary application logs. We try to redact hard secrets; a secret entered into an ordinary product field may still appear in a log.

Source synchronization, parsing, and indexing are separate from Ava’s use of connected context. When an Ava feature needs connected content, only relevant authorized evidence is retrieved for that interaction or background task. You.one may send that selected evidence to approved AI service providers to provide the feature for you. Our rules prohibit selling Google user data, using it for advertising, or using it to train generalized models across users. The route-verification limits described in this policy also apply to connected Google content.

You.one's use and transfer of information received from Google APIs follows the [Google API Services User Data Policy](https://developers.google.com/terms/api-services-user-data-policy), including its Limited Use requirements. Staff may not read individual Google content for general beta research, including its copies or derivations in other records. A person may view specific Google content only after your affirmative agreement to that specific review or when necessary for security or legal compliance. These narrower limits follow Google content and its copies or derivations in logs, Memory, transcripts, and replay; general staff-review authorization does not expand them. Aggregated and anonymized Google-derived data may be used for internal operations where Google's policy permits it.

## How we use data

- run the guided experience
- remember your settings and resume progress
- improve quality, safety, speed, and reliability
- learn where people get stuck and what actually helps
- process feedback and any payment, refund, or dispute you authorize or request
- synchronize and retrieve content from services you choose to connect
- help Ava understand authorized context and provide features for you

The goal is to be practical, clear, and helpful, not to collect data for its own sake.

These purposes remain within the Terms authorization and any additional consent required by law. They do not override the narrower limits on connected Google data described above. Public analytics is separate from beta participation.

## Privacy controls today

Privacy controls are manual today. Through our [privacy request](/privacy-request) form, you can ask to access or export your information, correct it, forget saved Memory, delete connected-source copies, or delete your account. You can also disconnect an optional service. We may need enough detail to identify your records and verify the request.

Deleting source copies and forgetting saved Memory are separate requests; disconnecting a service does not automatically do both. Our deletion process is intended to reach relevant derived search indexes and caches and prevent deleted information from returning through a restore or reconnect. Backups, provider records, security records, and information we must keep by law have separate limits. We explain applicable exceptions when handling your request. We are verifying this process and do not yet promise fixed completion or backup-expiry periods.

Where applicable law gives you a right to withdraw consent for an optional use, you may do so through the privacy request form without closing your account. If a use is necessary for a feature you choose to keep using, withdrawing that consent can limit that feature. We honor applicable rights to appeal a privacy-request decision and to exercise privacy rights without unlawful discrimination.

These operational limits do not extend a response deadline or remove a right that applicable privacy law gives you. We must handle your request within any legally required timeframe, including any permitted extension and its required notice.

## For California residents

If you are in California, you can ask us to tell you what we have connected to you, correct it, delete what we control, or opt out of any sale or sharing for cross-context behavioral advertising, including if the public-analytics flow described above is treated as a sale or sharing under applicable law.

For now, send a [privacy request](/privacy-request). These requests are handled manually for now, with possible provider retention limits.

## For Canada residents

You can ask to access or correct personal information we control through the same [privacy request](/privacy-request) form. We handle requests manually under the law that applies where you live. Our named service providers may process your information in the United States or other countries where they operate; that information may be subject to the laws of those places. You may complain to the privacy regulator responsible where you live, including the Office of the Privacy Commissioner of Canada or Québec’s Commission d’accès à l’information. Making a complaint does not waive your rights.

## Your choices and cautions

You can clear local You.one data by clearing this site's browser storage and cookies. You can also choose not to submit feedback or payment details.

You can ask us to review, correct, or delete information connected to you by sending a [privacy request](/privacy-request). Because this is manual today, include the email, account, browser/session details, or other context we can use to find the relevant records.

You can disconnect Google at any time. Disconnecting revokes the connection and stops new synchronization. Source-copy deletion is a separate retention choice: to delete connected-source copies, request deletion through the privacy request form. Disconnecting does not automatically erase excerpts already saved in a You.one conversation or saved Memory from connected content; you can request their deletion or Memory forgetting separately. Disconnecting You.one never deletes the original email, file, calendar, contact, task, or other content from Google.

If something is highly sensitive, share as little as possible. You.one is an AI-powered product. It can be useful, but it can also be wrong. It is not an emergency or crisis service. Ava is not a licensed or certified professional; her advice, recommendations, and analysis on professional subjects are tentative, as explained in the [Terms](/terms).

If you have a privacy question, send a [privacy request](/privacy-request). For other feedback, [contact us](/contact).

## Changes to this policy

Each version has its date, version identifier, and a summary of changes near the top. We update this policy when our data practices materially change. We explain what changed in plain language, with examples where they help, and give notice by email or in the product when a change materially affects your rights or how we use your information. Except where law or an existing agreement requires advance notice or new consent, an update may take effect when we give that notice; we do not promise a fixed advance-notice period. A notice cannot retroactively authorize a use that was not permitted when information was collected. We will ask for a new affirmative choice when applicable law requires one; continuing to use You.one alone does not authorize a new use that requires separate consent.

**Archive of earlier update notes.** Present-tense words in those notes describe the note’s date, not October 24, 2026 status.

**[October 21, 2026 — privacy.2026-10-21.6](/legal/versions/privacy.2026-10-21.6.md) (earlier publication candidate):** Business address and route-verification clarifications. Preserved in full; this history does not claim publication.

**[October 21, 2026 — privacy.2026-10-21.5](/legal/versions/privacy.2026-10-21.5.md) (earlier publication candidate):** Clarified no-training verification, analytics classification, privacy responsibility, and billing records. Preserved in full; this history does not claim publication.

**[October 21, 2026 — privacy.2026-10-21.4](/legal/versions/privacy.2026-10-21.4.md) (earlier publication candidate):** Actual public-analytics consent gap and dated provider evidence. Preserved in full; this history does not claim publication.

**[October 21, 2026 — privacy.2026-10-21.3](/legal/versions/privacy.2026-10-21.3.md) (earlier publication candidate):** Clarified privacy choices, referrals, and dated processing evidence. Preserved in full; this history does not claim publication.

**[October 21, 2026 — privacy.2026-10-21.2](/legal/versions/privacy.2026-10-21.2.md) (earlier publication candidate):** Expanded communication, shared-content, and synchronization disclosures. Preserved in full; this history does not claim publication.

**[October 21, 2026 — privacy.2026-10-21.1](/legal/versions/privacy.2026-10-21.1.md) (earlier publication candidate):** R3 funding, usage and financial-record disclosures. Preserved in full; this history does not claim publication.

**October 10, 2026 — privacy.2026-10-10.2 (earlier publication candidate):** Provider checkpoints, no-training and ZDR distinctions, staff review and logging, Google data limits, manual privacy controls, and communication misuse review. The source remains preserved; this history does not claim publication.

**[October 1, 2026 — privacy.2026-10-01.3](/legal/versions/privacy.2026-10-01.3.md):** Previous published Privacy Policy, preserved in full.

**September 25, 2026:** Clarified that public analytics can run before a beta invitation; distinguished replay limits from call-record retention; and described the separate searchable Gmail text copy.

**September 25, 2026:** Clarified Twilio's role and the audio and records from an earlier call request that may finish during the current beta hold.

**September 25, 2026:** Clarified that public Google Analytics is active, separated other service providers from beta research, and aligned material-change notice with the Terms.

**September 25, 2026:** Clarified how recent Gmail body copies and searchable text are stored.

**September 24, 2026:** Named Segeren Studio LLC as the operator of You.one and the party responsible for this policy.

**September 24, 2026:** Clarified that customer AI text and image routes are currently held while their provider privacy checks are completed.

**September 24, 2026:** Clarified Google-data staff access, current diagnostic-retention uncertainty, Canadian requests, and the separate Calls service exception.

**September 23, 2026:** Added a provider comparison table that makes the unverified OpenAI and other-provider retention limits explicit, clarified the beta voice hold, explained why session replay is off pending safeguards, and distinguished the contact/privacy-request and feedback delivery routes.

**September 22, 2026:** Added our verified xAI ZDR activation, explained why remembering your context is not model training, and distinguished provider deletion from the records You.one keeps for you. This update does not claim ZDR for every provider.