Do you train models on my entries?

No. We have not, we do not, and we contract every model subprocessor on zero-retention terms that prohibit training on any input you send us. If that ever changes, we will say so on this page before it happens.

Is memorial content end-to-end encrypted?

Not currently. Server-side access is required today for moderation, exports, and legacy transfer. We consider end-to-end encryption for a subset of fields a design goal, not a present reality. When it ships, this page and the privacy policy will say so.

Where does my data live?

The primary region is AWS eu-west-2 (London). Backups are replicated to a secondary EU region. No customer content is written to a US region in normal operation. When a US subprocessor like Deepgram is used, the content sent is minimal and limited to the feature you invoked.

How do I request, export, or delete my data?

Start at your privacy dashboard in the app. That page shows what we store about you and offers an export request and an account-deletion request. You can also email hello@confinity.com — we respond inside the UK/EU 30-day DSAR window, and usually much sooner.

What happens if Confinity shuts down?

The published preservation contract defines the shutdown promise: at least 18 months of access after any dissolution and a full export in open formats. Confinity Trust CIC formation is tracked for 2026-Q4; when it is incorporated and contracted, this page will publish the registration and operating receipts.

Is the UK age-gate based on my IP address?

Not yet. The current age gate uses your browser locale and time zone to decide whether to show the notice. IP-based geo is on the roadmap alongside the formal UK-AADC Data Protection Impact Assessment.

Trust Centre

The honest version.

This is where we say what we actually do with your data — including the parts that are not flattering. If we can't keep a promise yet, we write it down here before we write it on a billboard.

Primary region: EU (London)

Backups: EU only

No training on your entries

DSARs: 30-day response

No training on your entries. EU primary region. DSARs answered in 30 days.

IThe pipeline

How a memory is kept

From your kitchen table to a second country.

Four stations, no mystery. Everything below is expanded, with its limits, in the sections that follow.

CaptureIt starts on your device.A line, a voice note, a photograph. Drafts stay local until you decide to keep them.
EncryptSealed in transit and at rest.TLS 1.3 on the way; AES-256 where it lands. What our servers can still read is documented below, not hidden.
ReplicateTwo EU regions, every day.London primary, a second EU region for backups. Restore drills rehearsed quarterly, results logged.
InheritYours to take, and to leave.Full export in open formats at any time — and a published shutdown promise of at least 18 months of access.

IIEncryption

Encryption posture

What's encrypted, what isn't, and what that means.

End-to-end encryption is a design goal. It is not a product claim today. The table below is the current truth.

Entry bodies & voice memos
Readable by our servers
At rest: AES-256 at the managed Postgres + object-storage layerIn transit: TLS 1.3
Our servers can read these to index, back up, and serve them. True end-to-end encryption is a design goal, not a current feature.
Memorial body (photos, stories, contributor names)
Readable by our servers
At rest: AES-256In transit: TLS 1.3
Moderation, exports, and legacy-transfer flows all require server-side access. We log every administrative read and publish the audit schema on request.
Profile fields (display name, handle, pronouns, avatar)
Readable by our servers
At rest: AES-256In transit: TLS 1.3
These are the fields we render on the public profile, so they exist in plaintext to our application layer.
Email address & sign-in secrets
Readable by our servers
At rest: AES-256; sign-in tokens are single-use and short-livedIn transit: TLS 1.3
We do not store passwords. Magic-link tokens are hashed before write and invalidated after use.
Payment details (if you subscribe)
We never see it
At rest: Held by Stripe, not by usIn transit: TLS 1.3, tokenised at Stripe
We receive a customer id and the last four digits. The card number, CVC, and expiry never touch our database.
Backups & disaster-recovery copies
Readable by our servers
At rest: AES-256, encrypted at both the volume and the backup-tool layerIn transit: TLS 1.3 to our backup region
Backups run daily. Restore drills are rehearsed on a fixed quarterly schedule — results are logged and available on request.

Model posture

Your memory is not training fuel.

The composer offers optional assistance when you ask for it. When you do, the text you send is processed under a zero-retention commitment, never stored by the model provider, and never used to train a model. We refuse features that would require the opposite.

OpenAI zero-retention addendum

Deepgram DPA

Sub-processors

The companies that help us run Confinity.

We keep this list short on purpose. Every vendor below has a signed data-processing agreement. We review the list quarterly and notify account holders by email before we add a new one that touches customer content.

AWS (primary region)
eu-west-2 (London)
Application compute, managed Postgres, object storageAWS DPA
Cloudflare
Global edge, EU-preferred routing
DNS, edge cache, WAF, image deliveryCloudflare DPA
Stripe
Ireland (EEA)
Subscription billing, payment method storageStripe DPA
Resend
EU data residency
Transactional email (magic-link, receipts, weekly digest)Resend DPA
OpenAI (API, Zero Data Retention tier)
EU routing where available; US failover
On-request composer assist only. No training on any input.OpenAI Zero-Retention Addendum
Deepgram (fallback transcription)
US; EU routing in rollout
Voice-to-text when on-device Whisper is unavailableDeepgram DPA
Sentry
EU data centre
Error aggregation with server-side PII redactionSentry DPA

Data residency

EU-primary, by default and on purpose.

Primary: AWS eu-west-2 (London). Backups are replicated to a second EU region. Your customer content is not written to a US region in normal operation. Some narrow, user-initiated features (e.g. voice transcription fallback) may transit a US subprocessor; those are listed above with their DPA.

Data-subject requests

See it, export it, or delete it.

Two routes, both lead to the same team.

From inside the app

The privacy dashboard shows what we store about you, per category. From there you can request a full export or request account deletion. Both open a ticket that a human on our team closes.

Open privacy dashboard

Request export

By email

Write to hello@confinity.com from the email on your account. We reply within the 30-day UK/EU DSAR window, and usually the same week. We will not ask you to prove your identity beyond what the regulation requires.

Read the data deletion policy

Frequently asked

Straight answers.

Do you train models on my entries?
No. We have not, we do not, and we contract every model subprocessor on zero-retention terms that prohibit training on any input you send us. If that ever changes, we will say so on this page before it happens.
Is memorial content end-to-end encrypted?
Not currently. Server-side access is required today for moderation, exports, and legacy transfer. We consider end-to-end encryption for a subset of fields a design goal, not a present reality. When it ships, this page and the privacy policy will say so.
Where does my data live?
The primary region is AWS eu-west-2 (London). Backups are replicated to a secondary EU region. No customer content is written to a US region in normal operation. When a US subprocessor like Deepgram is used, the content sent is minimal and limited to the feature you invoked.
How do I request, export, or delete my data?
Start at your privacy dashboard in the app. That page shows what we store about you and offers an export request and an account-deletion request. You can also email hello@confinity.com — we respond inside the UK/EU 30-day DSAR window, and usually much sooner.
What happens if Confinity shuts down?
The published preservation contract defines the shutdown promise: at least 18 months of access after any dissolution and a full export in open formats. Confinity Trust CIC formation is tracked for 2026-Q4; when it is incorporated and contracted, this page will publish the registration and operating receipts.
Is the UK age-gate based on my IP address?
Not yet. The current age gate uses your browser locale and time zone to decide whether to show the notice. IP-based geo is on the roadmap alongside the formal UK-AADC Data Protection Impact Assessment.

IIIThe ledger

Written down before the billboard

What we keep, and what we can't claim yet.

The register below is the whole point of this page: the promises we hold today, and the ones we have written down here first because we cannot hold them yet. When a “not yet” becomes real, it moves up — with the date it happened.

No training on your entriesKeptContractual zero-retention terms with every model subprocessor. If this ever changes, it changes on this page first.

EU-primary residency, EU-only backupsKeptAWS eu-west-2 (London) primary; second EU region for backups; no customer content written to a US region in normal operation.

Daily backups, quarterly restore drillsKeptDrills run on a fixed schedule; results are logged and available on request.

Full export, any time, open formatsKeptFrom the privacy dashboard or by email, inside the 30-day DSAR window and usually much sooner.

End-to-end encryptionNot yetA design goal, not a current feature. Server-side access is still required for moderation, exports, and legacy transfer.

Preservation contract backed by Confinity Trust CICNot yetFormation tracked for 2026-Q4. Registration and operating receipts will be published here when they exist.

Paid bug bountyNot yetCoordinated disclosure with safe-harbour terms runs today; payments start when the programme can be properly staffed.

IP-based age gateNot yetThe current gate uses locale and time zone. IP-based geo ships alongside the formal UK-AADC DPIA.

Reviewed in the open

We don't grade our own homework.

Our resurfacing and writing-assist posture is read under the memory & machine-ethics collaboration with the Oxford University AI Society, and our legacy-transfer terms under the Oxford Law Society's digital-legacy working group. Their findings are published whether or not they flatter us — first outputs are in progress for the 2026–27 academic year.

Meet the knowledge partners

Eight sub-pages for the full, binding version.

This page is the summary. Each sub-page below covers one specific commitment in plain language — backed by the legal document that makes it real.

Model safety
Refusal, groundedness, latency, cost, and the vendor list for the composer.
Transparency report
Quarterly aggregate receipts of government, LE, and civil legal requests.
Warrant canary
A dated, founder-signed statement refreshed each quarter.
LE request policy
What we require, what we refuse, and how we notify the affected user.
Bug bounty
Vulnerability disclosure with safe-harbour terms; paid programme opens when fully staffed.
Private Mode roadmap
Per-component quarter for the on-device, no-model, no-analytics target.
Sub-processors
Canonical register: vendor, country, purpose, DPA link.
DPA template
Download the same DPA we sign with enterprise customers.

Want the shorter version?

The Trust page is the one-screen summary. The binding documents sit below it.

Trust summary

Data deletion

Ask a human

Preparing the pageOne moment - fetching quietly.

The honest version.

This is where we say what we actually do with your data — including the parts that are not flattering. If we can't keep a promise yet, we write it down here before we write it on a billboard.

Primary region: EU (London)

Backups: EU only

No training on your entries

DSARs: 30-day response

No training on your entries. EU primary region. DSARs answered in 30 days.

We don't grade our own homework.

The honest version.

From your kitchen table to a second country.

What's encrypted, what isn't, and what that means.

Entry bodies & voice memos

Memorial body (photos, stories, contributor names)

Profile fields (display name, handle, pronouns, avatar)

Email address & sign-in secrets

Payment details (if you subscribe)

Backups & disaster-recovery copies

Your memory is not training fuel.

The companies that help us run Confinity.

AWS (primary region)

Cloudflare

Stripe

Resend

OpenAI (API, Zero Data Retention tier)

Deepgram (fallback transcription)

Sentry

EU-primary, by default and on purpose.

See it, export it, or delete it.

From inside the app

By email

Straight answers.

Do you train models on my entries?

Is memorial content end-to-end encrypted?

Where does my data live?

How do I request, export, or delete my data?

What happens if Confinity shuts down?

Is the UK age-gate based on my IP address?

What we keep, and what we can't claim yet.

We don't grade our own homework.

Eight sub-pages for the full, binding version.

Want the shorter version?

The honest version.

From your kitchen table to a second country.

What's encrypted, what isn't, and what that means.

Entry bodies & voice memos

Memorial body (photos, stories, contributor names)

Profile fields (display name, handle, pronouns, avatar)

Email address & sign-in secrets

Payment details (if you subscribe)

Backups & disaster-recovery copies

Your memory is not training fuel.

The companies that help us run Confinity.

AWS (primary region)

Cloudflare

Stripe

Resend

OpenAI (API, Zero Data Retention tier)

Deepgram (fallback transcription)

Sentry

EU-primary, by default and on purpose.

See it, export it, or delete it.

From inside the app

By email

Straight answers.

Do you train models on my entries?

Is memorial content end-to-end encrypted?

Where does my data live?

How do I request, export, or delete my data?

What happens if Confinity shuts down?

Is the UK age-gate based on my IP address?

What we keep, and what we can't claim yet.

We don't grade our own homework.

Eight sub-pages for the full, binding version.

Want the shorter version?