Privacy & trust

Your memories are not a growth hack.

Clear boundaries, no dark patterns, and receipts for the claims that matter.

Confinity Studio

Audited

TodayPeopleSpacesYearbook

ReceiptsTrust posture

No feed

Zero trainingprovider commitments recorded

Export pathJSON + files · no lock-in

Data trustformation tracked in public

IThree foundations

Private by default.

Every entry starts private. Sharing is a deliberate act with a named audience - a space, a person, or a legacy heir - never a feed.

Your memory is not training fuel.

We will never train on your private entries. Any assistance runs only when you ask, stays on your text for that request alone, and keeps nothing after.

Preservation is the first feature.

If we ever wind down, you get a full, plain-format export - not a ransom note. The Trust Centre tracks the preservation contract and Confinity Trust CIC formation openly.

'The Trust Centre is the single source of truth. Marketing follows.'— Confinity doctrine §2.4

IIAll claims, on one page

What we encrypt, and what we can read: See the tableThe honest table is in the Trust Centre. Some surfaces are end-to-end encrypted today; others (like public memorials) are server-readable by design.
Zero training on your content: LiveWe don't train models on your writing, your photos, your voice, or your family's archive. Ever.
No ads, no tracking pixels: LiveNo third-party trackers. No ads. No audience segments sold anywhere. PostHog first-party analytics only, with opt-out.
Request an export any time: Queue live; delivery worker gatedThe session-scoped export queue is live. Delivery depends on the configured fulfillment worker, and fallback responses say when durability is local-only.
Confinity Trust CIC formation: Planned · Target 2026-Q4A planned legal structure is tracked as part of the preservation promise. Until incorporation is complete, the published preservation contract and Trust Centre receipts define what happens if Confinity is acquired or wound down.
Right to be forgotten: LiveDelete your own contributions on your own schedule. If someone else holds a memory about you, we anonymise your role in it.
Private Mode — fully on-device: Q2 2027An opt-in setting where inference runs on your device with no network calls. Roadmapped for Q2 2027.
Nothing is shared by default: LiveEvery entry is private until you explicitly invite someone. Remembrance pages are the one exception — they are public by intent.
Open formats, no lock-in: LiveYour writing exports as Markdown + JSON. Media exports in original formats. Yearbook exports as PDF. You can leave any time.
Where your data lives: LiveEU-region storage by default for EU customers; US-region for US customers. Listed primary + failover regions in the Trust Centre.
Warrant canary: Published quarterlyWe publish a quarterly canary. If it stops appearing, something has changed.
Transparency report: First report at launchEvery six months: law-enforcement requests received, surface type, and outcome. Historical reports permanent.