Skip to main content
For families who want their stories to last. learn about the founding circle.

Trust Centre

The honest version.

What we store, who can read it, and what you can take with you. Unverified promises stay marked as unverified.
No training on entries
Export coverage stated below
Requests: 30-day target

Questions about your data? Write to hello@confinity.com.

How a memory is kept

Three places. One of them we can read.

The dashed box is the part that matters. Everything inside it is text our application can open. That's the honest shape of this product today. We'd rather draw it than bury it.
Where a memory sits, and who can read itLocal drafts, server copies and exports have different coverage. Text autosave may sync to our servers; server entry text is readable by our application. Export options cover supported data. Complete independent export and restore of every cloud original is not yet qualified. Check included files and reopen your copy before relying on it.Readable by our serversOn your deviceLocal drafts; synced text may leaveOn our serversStored as text. The table below says whyExport a supported copyCheck coverage and reopen the filesFull independent restore · not yet qualified

Encryption posture

What's encrypted, what isn't, and what that means.

This table used to say AES-256 on five of its six rows. We read the code. It wasn't true. So the rows now say what the code says instead. Encryption our hosting provider applies underneath is a separate question, and it has a separate answer. We'll publish that one when it's confirmed.

  • Entry bodies & voice memos

    Readable by our servers
    At rest: No encryption added by ConfinityIn transit: TLS

    We built field-level encryption for entry text and then refused to turn it on. Only one of the two write paths encrypts, and six read paths would hand you ciphertext where your own words should be: the sync pull, the entry page, the export, the digest email, the assistant's retrieval, the search index. Half an encrypted archive is worse than none. So the flag stops the app from starting. Until all of it is wired, your entries sit in the database as text our servers can read. That is the honest version.

  • Memorial body (photos, stories, contributor names)

    Readable by our servers
    At rest: No encryption added by ConfinityIn transit: TLS

    Moderation, exports and legacy transfer all need server-side access, so our application can read these. We don't keep an audit log of administrative reads. Not yet. When there's one to describe, it'll be described here.

  • Profile fields (display name, handle, pronouns, avatar)

    Readable by our servers
    At rest: No encryption added by ConfinityIn transit: TLS

    These are the fields we print on your public profile. They have to be plain text to the thing doing the printing. There's no way around that one.

  • Email address & sign-in secrets

    Readable by our servers
    At rest: Tokens hashed before write, single-use, short-livedIn transit: TLS

    We don't store passwords. There aren't any. A magic-link token is hashed before it reaches the database, then burned the moment it's used. The row left behind can't be replayed.

  • Payment details (if you subscribe)

    We never see it
    At rest: Held by Stripe. We store an id.In transit: TLS, tokenised at Stripe

    The card number never reaches our database. Neither does the CVC. Neither does the expiry. What we keep is a Stripe customer id and a subscription id, and that's the whole of it.

  • Backups & disaster-recovery copies

    Readable by our servers
    At rest: Configured at the hosting providerIn transit: TLS

    Backup schedules, retention and restore drills need operational verification. Settings offers exports of supported data; local copies and server exports have different coverage. Check included files and reopen a copy. Complete independent export and restore of every cloud original is not yet qualified.

Model posture

Your memory isn't training fuel.

Writing help is optional. We do not use your entries to train models, but that does not mean a provider never retains a request. The AI safety page states the recorded processing and retention posture for this deployment. Network voice transcription is not enabled.
Processing and retention
Google Cloud (Vertex AI) DPA
Deepgram DPA
Sub-processors

The companies that help us run Confinity.

This is the published vendor register, including entries under re-verification. A public DPA link is not proof of a signed agreement or an active data flow. Contract verification, review dates and required notices are separate checks.

  • AWS

    Under re-verification
    Under re-verification. This register names AWS for application compute, managed Postgres and object storage; the deployment configuration in cloudbuild.yaml provisions a different stack. Only a person with access to the running deployment can settle which is correct, so the field is held open rather than guessed at. The one AWS use this codebase does implement is inbound-email bounce and complaint handling over SES and SNS (src/app/api/ambient-capture/bounce/route.ts).AWS DPA (opens in a new tab)

  • Cloudflare

    United States (global edge)
    DNS, edge cache, WAF, image delivery, rate limitingCloudflare DPA (opens in a new tab)

  • Stripe

    Ireland (EEA)
    Subscription billing, payment method storageStripe DPA (opens in a new tab)

  • Resend

    United States (EU data residency)
    Transactional email (magic-link, receipts, weekly digest)Resend DPA (opens in a new tab)

  • Google Cloud (Vertex AI)

    Ireland (contracting) / European Union (processing, EU multi-region)
    Composer assist on explicit request (Gemini via Vertex AI), in Confinity's own Google Cloud project; no training on inputsGoogle Cloud (Vertex AI) DPA (opens in a new tab)

  • Deepgram

    United States
    Legacy voice-to-text adapter, currently disabled. No qualified active network transcription relay.Deepgram DPA (opens in a new tab)

  • Sentry

    Germany (EU data centre)
    Error aggregation with server-side PII redactionSentry DPA (opens in a new tab)

  • PostHog

    Germany (EU data centre)
    Product analytics (event counts, no entry content)PostHog DPA (opens in a new tab)
Data residency

One line on this page is under re-verification.

The deployment configuration and published register disagree about primary storage. Archive residency remains unverified until the running storage paths and their processing boundaries are checked. Writing help has a separate recorded processing posture on the AI safety page. Network voice transcription is not enabled.
Data-subject requests

See it, export it, or delete it.

Use the app or write to us. Check the response before treating a request as complete.

From inside the app

The privacy dashboard lists what we hold about you, category by category. From there you can request an export or account deletion. A submitted request is not confirmation that delivery or deletion is complete.
Open privacy dashboard
Request export

By email

Write to hello@confinity.com from the address on your account. Our response target is 30 days; a target is not a delivery receipt. We may need to verify identity before releasing or deleting account data.
Read the data deletion policy
Frequently asked

Straight answers. Including the awkward ones.

  • Do you train models on my entries?

    We do not use your entries to train models. Provider retention is a separate question: the AI safety page states the recorded data-handling posture for this deployment. Read it before choosing writing help. Network voice transcription is not enabled.

  • Is memorial content end-to-end encrypted?

    No. Moderation, exports and legacy transfer all need server-side access today, so our servers can read it. End-to-end encryption on a subset of fields is a thing we want and don't yet have. When it ships, this page and the privacy policy say so on the day.

  • Where does my data live?

    The deployment configuration and published register disagree about primary storage. We are not publishing an archive residency guarantee until the running storage paths and their processing boundaries are verified. Writing help has a separate recorded processing posture on the AI safety page. Network voice transcription is not enabled.

  • How do I request, export, or delete my data?

    Start at the privacy dashboard in the app, or email hello@confinity.com from your account address. Our response target is 30 days. A submitted request is not confirmation that export delivery or account deletion is complete; check the response and the included data.

  • What happens if Confinity shuts down?

    Settings offers export options for supported data. Check the included files and whether they reopen before relying on a copy: complete independent export and restore of every cloud original is not yet qualified. We cannot promise a shutdown access period. The proposed Confinity Trust arrangement has no verified incorporation and continuity contract on this page.

  • Is the UK age-gate based on my IP address?

    Not yet. It reads your browser locale and time zone, then decides whether to show the notice. IP-based geolocation ships alongside the formal UK-AADC impact assessment.

Written down before the billboard

What we keep, and what we can't claim yet.

This register is the whole point of the page. It holds the promises we keep today, alongside the ones written down here first precisely because we can’t keep them yet. That second half is harder to publish. It’s also the half worth reading. When a “not yet” becomes real, it moves up, carrying the date it happened.
No training on your entriesKeptWe do not use entries to train models. Provider retention is distinct; see the recorded deployment posture on the AI safety page.
Complete independent export and restoreNot yetSettings offers supported export options. Complete delivery and independent reopening of every cloud original still need qualification. Check included files before relying on a copy.
A residency statement we can evidenceNot yetThe line that stood here named a provider and a region our own deployment configuration contradicts. It's down until it's confirmed, and it comes back with a date.
A published backup and restore scheduleNot yetBackup cadence and restore drills are set in the hosting provider's console. We can't publish them from here yet.
Encryption we apply ourselves, at restNot yetField encryption is written and tested. It refuses to switch on, because the read paths aren't wired. Your entries stay stored as text until they are.
End-to-end encryptionNot yetSomething we want. Moderation, exports and legacy transfer all still need server-side access.
Preservation contract backed by Confinity Trust CICNot yetFormation tracked for 2026-Q4. Registration and operating receipts will be published here when they exist.
Paid bug bountyNot yetCoordinated disclosure with safe-harbour terms runs today; payments start when the programme can be properly staffed.
IP-based age gateNot yetThe current gate uses locale and time zone. IP-based geo ships alongside the formal UK-AADC DPIA.
Reviewed in the open

Independent review needs independent findings.

The knowledge-partners page describes proposed collaborations. This page does not provide a completed independent ethics, security or legal review. A partner name is not an endorsement or a substitute for dated findings.
Meet the knowledge partners
More in the Trust Centre

Eight topics, with their detail and limits.

Read the relevant policy, register or roadmap. A roadmap is not a binding delivery promise, and a public template is not a signed contract.

Want the shorter version?

The Trust page is the one-screen version. The binding documents sit below it. Start wherever you like.
Trust summary
Privacy policy
Terms of service
Data deletion
Ask a human