Privacy

This page says what test holds about you, who else sees it, where it is kept, and what happens to it when you delete something or close your account. It describes what the software actually does today.

What test is, and who runs it

test is provided by Compiler 2026, Inc, and on this page “we” means that company. It is a chat app in which each person has an AI assistant of their own. The assistant reads what is said in the conversations that person is part of — except a group created with no assistants in it, and whatever arrives while it is stopped for lack of money — remembers it for that person, and answers them. Each person's memory is their own: no other person's assistant reads it, and two people's memories are held in separate databases that do not meet.

Nobody can join a host without being invited. A host may also run as an alpha, which changes two things stated in their own sections below — what the software records about its own running, and what we can look at.

What we hold

From signing in. You sign in through Google. We never see or hold your Google password. What Google hands us and we keep is a stable account identifier for you at Google, your email address together with whether Google says it is verified, and the display name on your Google account, which becomes your name here until you change it. The email is kept so that a second sign-in method added later joins your existing account rather than making a second one.

Where that is kept. Signing in happens at our own sign-in service, accounts.compiler2026.com, which keeps what is listed above together with which host your account is on and your invitation, described below. It also keeps, for each conversation you are in other than the one between you and your own assistant, who is in it, who added each of them and, for a group, its name; who has asked to be in contact with whom, and who has blocked whom; and your name, your timezone and your assistant's name, which it gives to any host that asks for you by your id and sends, whenever one of them changes, to every host that shares a conversation or a contact with you, which keeps them. A message or file sent to somebody on another host waits there on its way, locked with a key that only that host holds, beside who sent it, in which conversation, to whom and when; it is deleted once that host has taken it in, or, if that host has not taken it in within thirty days, deleted unread, and neither the sender nor the recipient is told. Everything but those locked files is copied once a day to a backup that nobody, ourselves included, can alter or delete for thirty days, and that is erased within five weeks.

Your timezone, as reported by the device you signed up on or as you have since set it in Settings. It is what makes times in your conversations read correctly for you.

Your invitation — that your email address was invited onto the host you use, the name of whoever invited it, and when you accepted.

What you write. Every message you send, and every message sent to a conversation you are in. A message is stored once per member, in that member's own database, and stays as sent — a message cannot be edited. A member whose account is on another host gets their copy through our sign-in service, locked with a key that only their host holds.

What your assistant remembers. Your assistant writes down, in your own database, what it understands from what was said in your conversations — in short present-tense sentences, each one carrying a way back to the message it came from. Nothing you say is copied into anybody else's memory.

Money. Your balance, and one line for each time your assistant ran a step, recording what that step cost, what you were charged and when. Payment itself happens on the payment processor's own pages: we never see or hold your card number. What we keep from a payment is the processor's own reference for it and the amount.

Notifications, if you turn them on: the address your browser gives us to deliver a notification to that browser, and which device it belongs to. Turning notifications off removes it.

Your open sessions — a list of the devices signed in to your account, so you can see them and sign any of them out.

Files

A file or picture you send into a conversation is stored as it is, with no expiry, and whoever is in the conversation it was sent into can download it. A file sent to somebody whose account is on another host is locked under a key made for that file alone, and on its way our sign-in service holds only the locked bytes. The software never reads what is inside a file, and no assistant, and no model we use, is shown its contents. A picture is opened in two places and no others: to make the small preview a conversation shows, and for your profile picture, which is cropped square, made smaller and stripped of its location and camera details. When you delete a message that carried a file, the file leaves your own history. Its bytes stay stored for as long as anybody else's history still holds the same file; once nobody's does, they are cleared at the next daily clean-up, though never before they are two weeks old.

What the assistant sends to a model vendor

This is the part of the system that sends your words outside our own server, and it is the most important paragraph on this page. Your assistant is a language model run by OpenAI. To read a message, to remember something from it, or to answer you, the software sends that material to OpenAI's API over the network — the message itself, the parts of your own memory the assistant is working from, and the conversation around it. OpenAI processes it in order to answer and returns the result to us. There is one such vendor and no other.

Who else is involved

• Google — sign-in only. Google learns that you signed in to this app.
• OpenAI — the model, described above.
• Stripe — payment. Your card details are entered on Stripe's own pages and are Stripe's to hold, not ours.
• Amazon Web Services — the server this service runs on, and the disk it is stored on.
• Cloudflare — the network in front of the server. Traffic between your device and us passes through it.
• Your browser's push service — if you turn notifications on, the notification is delivered by the service your browser uses, which on an iPhone is Apple's. What is handed to it is the conversation's name and the line that was said, or the conversation's name alone if you have turned message previews off.
• Sentry — where this software reports its own faults, so that a crash reaches us instead of only you. What is sent is the shape of the fault and none of your words: the kind of error, the file and line in our own code where it happened, the version of the software, and one random number that lets us find the same fault in our own logs. The text of the error is blanked before it leaves, nothing your assistant read or wrote is attached, no page of yours is recorded or replayed, and nothing that identifies you or your conversations goes with it — not your account, not a conversation's address. Two tests of ours check this: one puts a marked sentence into a fault and confirms the mark does not leave, the other confirms that of the three internal numbers we stamp our own logs with, only the one naming nobody crosses.
• Programs connected as bots — on a host that offers bots, a person can make one, hand its key to a program of their choosing, and place it in a conversation they are in. The program can then read that conversation, including what was said there before it was placed, its files and the names of the people in it, and write in it. Whoever runs the program decides what it does with what it reads.

There is nobody else. There is no advertising, no analytics, no profiling of you, and apart from a program somebody has placed in a conversation as a bot, no third party receives anything for any purpose of its own. We do not sell anything about you and there is nothing in this system built to.

Where it is kept

On servers we run ourselves, in Oregon, in the United States, with your own account held in its own database file on the host you use. The whole disk is copied to a backup once a day and the most recent seven of those copies are kept.

What we can see

On a host that runs as an alpha, we can look directly at what is in the system, including conversations, in order to understand and fix problems — you are shown a screen saying exactly this before you use the app, and it is readable again at any time in Settings. In the alpha the software also records what its assistant asked the model and what came back, held inside your own account's storage, which is what makes a problem diagnosable after it happens. That recording is a property of the alpha build and not of the product.

The crisis referral count

When an assistant gives somebody a crisis line, one row is written recording the moment it happened and nothing else — no name, no account, no conversation, no words. It is not possible to work out from those records who was referred. This is explained in full in the crisis protocol.

How long it is kept, and leaving

Deleting a message. Deleting a message takes its words out of your own history — that message and the exchange it set off — together with the index that made those words searchable. Words deleted this way cannot be read back afterwards by anybody, your assistant included. In the alpha, the record of what your assistant asked the model and what came back may hold copies of those words, so the whole of that record under your account is cleared at the same time. What your assistant had already written down from that message is not deleted with it: it stays, still marked with when and in which conversation it was written down, but the way back from it no longer opens the words that were deleted. To have your assistant stop remembering something, tell it so: it confirms with you how far that reaches, then withdraws what it holds about the matter and stops using it, and the earlier versions of what was withdrawn stay stored in your account. Only closing your account erases everything your assistant has written down. Deleting is one-sided — it removes your copy, and the copy held by anybody else in that conversation stays theirs, exactly as it does when you delete a message from your own phone.

Deleting your account. Settings has a control that closes your account, except for the owner of the host, whose account cannot be closed. Your account on the host stops existing immediately and your whole store leaves the live system at once; the underlying bytes are erased within thirty days. At our sign-in service you, and any bot you placed, leave every conversation, your contacts and blocks are removed, and your name, timezone and assistant's name are deleted there; what it keeps from your signing in, which host it lets you into and your invitation stay there, and your account's old id is kept so that it is never given to anybody else. Other hosts that shared a conversation or a contact with you keep the name, timezone and assistant's name they last had for you. Because backups are taken daily and the newest seven are kept, a copy can remain in a backup for up to a further seven days before it ages out; what our sign-in service removes can remain in its own backup for up to five weeks. Messages you sent to other people remain in those people's own accounts, which is what it means for their copy to be theirs.

Being removed from a host. The administrators of the host you use can remove you from it, unless you are its owner. You are then signed out on every device and can no longer sign in to that host. Nothing is erased by this: your account and everything in it stay on the host as they were, nobody can open them, and the administrators can see that the host still holds your account. If you are invited again under the same email address, the account you come back to is the one you left. Once you have been removed, an administrator can ask for your account to be erased. That does not happen at once: there are seven days in which the administrator can take the request back, and inviting you again takes it back too. After those seven days your account is erased at the host's next daily clean-up, in the same way as when you close it yourself.

Anything you have not deleted is kept for as long as your account exists. There is no automatic expiry, apart from a message or file on its way to somebody on another host: if that host has not taken it in within thirty days, our sign-in service deletes it unread, and the sender's own copy stays.

Adults only

Accounts are for adults. Nobody under 18 may hold one, and you confirm this when you create an account.

Contact

Write to privacy@compiler2026.com with any question about what is on this page, about what is held about you, or to ask for it to be removed.

Changes to this page

When the behaviour described here changes, this page is changed with it and the date below moves. The date says when what is written here was last true.

test · last true on 22 September 2026