Privacy Policy

Last updated: 2026-09-08

Indie Instinct is a personal AI assistant that acts on your behalf across messaging channels, your Google Workspace account, and an isolated browser it controls for you. This policy explains what data we collect to do that, how it is stored, and how you can remove it.

Data we collect

  • Your phone number, used to verify your identity and to link your messaging accounts (WhatsApp, Telegram, iMessage, RCS, SMS) to your workspace.
  • Messages you send the assistant and the tasks it runs on your behalf, including task progress, results, and approval decisions.
  • If you connect Google Workspace, encrypted OAuth tokens and the Gmail, Calendar, and Contacts data needed to complete the actions you request.
  • If the assistant uses a browser on your behalf, session artifacts (such as screenshots you asked it to capture) and, only while you have taken manual control of that browser, a live view of the page — the assistant cannot see or record that session while you are in control.
  • Credentials you explicitly store in your vault for the assistant to use during checkout or sign-in flows. These are encrypted and are never exposed to the assistant, to us, or in logs — only the browser page you approved can receive them at the moment of use.

How we use it

We use this data solely to operate the assistant you requested: understanding your messages, running tasks, remembering context you've asked it to keep, and returning results to the channel you contacted us from. We do not sell your data or use it for advertising.

Who we share it with

Your messages and task content are processed by Amazon Bedrock to generate the assistant's responses. Messages you send through a given channel are delivered through that channel's provider (Meta WhatsApp Cloud API, Telegram, or Linq for iMessage/RCS/SMS). Connected Google Workspace actions go through Google's APIs with your direct OAuth consent. We do not share your data with any other third party.

Storage and security

Data is stored in an encrypted database and object storage under our control, with encryption keys managed by AWS KMS. Vault credentials use envelope encryption and are never readable by the assistant, application logs, or automated browser inspection. Browser automation runs in an isolated container with no access to your device.

Data retention and deletion

We retain your data for as long as your account is active. You can delete your account and all associated data at any time — see our Data Deletion instructions for how.

Children's privacy

Indie Instinct is not directed at children and we do not knowingly collect data from anyone under 13.

Changes to this policy

If this policy changes materially, we will update the date above.

Contact

Questions about this policy or your data can be sent to privacy@indie-instinct.example.