Privacy Policy

Last updated: October 24, 2026

Anjo is a personal intelligence that grows with you. We collect and use data so Anjo can respond, build an understanding over time, and show you patterns grounded in what you choose to share. This policy explains exactly what we collect, why, and what control you have over it.

What we collect

• Account data. Username, email address, hashed password. We never store your plain-text password.
• Conversation data. The messages you send are processed in real-time to generate a response. Your conversation history is stored encrypted on our servers to provide continuity across sessions; you can delete it at any time using the "forget me" or "delete account" features. We also store personality embeddings and conversation summaries derived from your messages to give Anjo long-term memory.
• Usage data. Monthly API usage, subscription status, and limited product events such as onboarding, feature usage, and subscription state, used to enforce tier limits, operate the service, and debug launch health.
• Personality profile. Anjo builds a profile of your personality traits, emotional patterns, and recurring themes from your conversations. This is used to personalise responses and deepen memory over time. You can erase this at any time using the "forget me" feature. In the app's Inner World you can see what Anjo has formed about you, mark it wrong, or delete it.
• Billing data. On iOS, payments are processed by Apple's in-app purchase system. We store only your subscription tier and status. We never see or store your payment card details.
• Device data. IP address, browser type, and device identifiers for security and fraud prevention.

What we do not collect

• We do not sell your personal data to third parties.
• We do not use your conversations for advertising, and we do not use them to train AI models. The one exception is personal learning, which is on by default and which you can turn off: it shapes a small policy for your own Anjo only (see Personal learning).
• We do not run ads or share conversation data with advertisers.
• By default, no human reads your conversation history. It is accessed by automated systems for memory retrieval, continuity, and response generation.
• In rare cases (for example, technical troubleshooting with your explicit permission), authorized staff may access limited derived profile data to resolve issues. This access requires a temporary support grant, is logged, and is limited to senior engineers. Raw chat content is not exposed through admin support tools.

How we use your data

• To generate responses through our AI providers. Depending on your plan and the feature you use, your messages and the memory context for that reply may be sent to Anthropic (Claude, which we run through Amazon Bedrock), Google (Gemini, through Google Cloud Vertex AI), or OpenAI's Sol model for Premium replies (reached through OpenRouter or Amazon Bedrock), to produce replies or classify messages. If you choose the Gemini voice, the text of each reply Anjo speaks is also sent to Google Cloud Vertex AI to turn it into speech. We use these providers' paid API services. Under their API terms and data-processing agreements they process this data to provide the service to Anjo, may keep it for a limited time for abuse monitoring or legal reasons, and are bound to protect it to a standard equivalent to this policy; Anthropic, Google and OpenAI do not use Anjo API inputs or outputs to train their models. Their privacy policies govern their handling of API data. If you choose On Device where it is offered, a model on your phone writes Anjo's replies; your messages and the memory context for each reply are still sent to our servers, stored encrypted, and used for Anjo's memory and background work as described here. In the mobile app, you are shown what data is sent and to whom, and asked to consent, before this sharing begins; you can revoke that consent at any time. Signing out of the app stops all sharing immediately, the disclosure is shown again before sharing resumes, and deleting your account (in app settings, or from the consent screen itself) permanently ends it and removes your data. On the web, sending a message is how sharing occurs, and this section together with the disclosures at sign-up describes it; signing out likewise stops all sharing, and account deletion is available in settings.
• To talk by voice. In the iPhone app, what you say in voice mode is turned into text on your iPhone by Apple's speech recognition; the recording is not sent to us, and the text is sent like a typed message. Replies are spoken either on your iPhone (Anjo Free) or, if you choose the Gemini voice, by Google Cloud Vertex AI from the reply's text. In the web chat, your browser's own speech recognition turns what you say into text; some browsers, Chrome for example, send the audio to their maker's service to do this.
• To build a personality profile, Anjo derives OCEAN personality traits, emotional patterns, and topic clusters from your conversations to personalise how it responds and what it remembers. This profiling is core to how Anjo works; you can reset it at any time.
• To build persistent memory, summaries and embeddings of your conversations are stored and retrieved to give Anjo context in future sessions.
• To keep that memory accurate, small yes/no decisions about it (for example, whether a new fact replaces an older one, or whether a new note actually changes a memory page) may be sent to TypeSafe. Only the facts or memory text involved in that one decision are sent, never memories you marked sensitive or kept out of chat. This is on for everyone; declining the in-app AI disclosure or signing out stops it until you accept the disclosure again.
• Personal learning (on by default; you can turn it off). While you have accepted the in-app AI disclosure, Anjo keeps a record of the corrections and reactions you give it, unless you turn this off in Privacy & Trust. Those corrections and reactions train a small policy for your own Anjo only, never a shared model. Each one adjusts how Anjo replies to you. When the policy is in use, what it decides, for example “keep replies shorter”, becomes part of the instructions sent with your messages to the AI provider that writes the reply. See Personal learning below for what is kept and how to stop it.
• To maintain your account and subscription.
• To operate and debug the service using operational logs and product events. These records are designed not to include raw conversation content, memory text, model prompts/responses, passwords, reset tokens, API keys, or payment secrets.
• To send transactional emails (email verification, password reset). We use Resend for email delivery.
• Reactions and reply records (always kept, without the reply’s words). When you tap Landed or Not quite on a reply, we store that reaction with the reply’s ID, but not the reply’s text, whether or not personal learning is on. With personal learning off, reactions are used only to check reply quality, and do not shape your Anjo. Where it is switched on, we also keep a record of how each reply was shaped (for example its length target and question style, never its words) for 400 days. If personal learning is on, we also keep which of your memories a reply drew on, for up to 30 days, so that deleting a memory also removes anything learned from the replies it shaped. All of these are in your data export and are deleted with your account or a factory reset.

Conversation preferences

You can tell Anjo directly how to talk to you — for example, to stop giving unsolicited advice, ask fewer questions, keep replies short, or help you think instead of just listening. This is available once you’ve seen the current in-app disclosure.

• What is stored. The preference itself (for example, “fewer questions”) and, where it came from something you said, the exact words it was taken from — encrypted, the same as the rest of your chat history. Not the rest of the conversation.
• Scope. You choose how long it holds: just this reply (not stored at all), this conversation, or from now on. A standing preference survives restarts and new conversations until you remove it.
• Visibility. Privacy & Trust lists your active preferences and the quote behind each one, where there is one.
• Export and erasure. Included in your data export. Deleting a preference removes the stored words immediately and invalidates anything derived from it (see Personal learning, below).

Personal learning

This is on by default. You can turn it off, and delete what was kept, in Privacy & Trust at any time. Your conversation preferences work either way, and turning it off changes nothing else about how Anjo works for you.

• What is kept. The corrections you make to what Anjo believes about you — for example marking a remembered detail wrong, or changing how Anjo talks to you — and your reactions to replies: Landed, or Not quite with the reason you pick. Each record holds the correction or reaction itself and, where the correction came from something you said, the short quote it was taken from — encrypted — plus identifiers for the message or memory involved. It does not hold the rest of the conversation.
• From when. From the moment it starts for you: when you accept the in-app AI disclosure, or for an existing account the first time the app opens after this change. Nothing from before that is ever included. Collection pauses while you are signed out, and a choice to turn it off is kept, even through a reset.
• What it is used for. Personalising your own Anjo through a per-person policy. Those corrections and reactions train a small policy for your own Anjo only, never a shared model. Each one adjusts how Anjo replies to you, such as length, how many questions Anjo asks, and tone. They are never used for research or pooled with anyone else's. No language model is trained on them. If we ever widen what this is used for, we will tell you first and update this section.
• Who else sees it. Nobody. These records stay on our servers and are not shared with our AI providers or anyone else. What the policy decides does shape the instructions sent with your messages, as described above.
• How long. Until you delete it or your account is deleted. Pausing stops new records and keeps the existing ones; withdrawing deletes them, and anything built from them, within 30 days.
• Your controls. Privacy & Trust shows what is saved and offers pause, withdraw-and-delete, and turning it back on. A factory reset or account deletion clears the records; a choice to pause or turn it off stays in place.

Searching your past conversations

Beyond the profile and summaries described above, Anjo keeps your conversations searchable, so it can answer accurately when you ask about your own past. This is part of how Anjo remembers and is not a separate opt-in.

• What is kept. Each conversation's exchanges — what you said and Anjo's reply — are kept word for word and made searchable.
• Where you see them. Memory Controls lists each kept conversation under Conversations in your Inner World, with its date and how it starts.
• Encryption. The exchange text itself is encrypted at rest, the same as the rest of your chat history. The search index built from it is not: the numbers used to find a match are computed from a copy of the text with emails, phone numbers, Social Security numbers, and card numbers stripped out first (other details, like names, are not removed by this step), and small labels — which conversation, and when — are stored unencrypted.
• Recall. When you ask about your past, Anjo searches this index and can bring back what it finds; that reaches the model only for the one reply you asked for, not on every turn. For now, this search only reliably works in English.
• What removes the conversation behind it. Asking Anjo to forget a conversation, or deleting its summary, removes its stored words directly and keeps them out of future search. Deleting a fact that carries your exact quoted words also removes the exchange it was quoted from. Deleting a graph memory or a vector memory removes the stored words of the whole conversation it came from.
• What doesn't. Deleting a wiki page or a fact that isn't tied to an exact quote does not remove the conversation it came from — that conversation stays stored and searchable.
• How long. This index lives as long as the conversation history it is built from. Deleting your account, or a factory reset, removes it entirely.
• Never searchable. A conversation is never added to this index if it included a crisis moment, and if a later evidence-memory pass identifies one that already was, any evidence kept for it is removed. Conversations you have marked sensitive, suppressed, or kept out of chat are excluded from search results.

Research use

To provide the service, Anjo derives and stores structural signals about every user's sessions, such as personality signals, emotional tone summaries, and session statistics. These are internal operational data used to operate and improve Anjo. They are never shared externally and never include your name, email address, or raw conversation content.

You can separately opt in to contribute your anonymized data to non-commercial research on human-AI interaction (off by default). When you opt in, a privacy-preserving, pseudonymized export of your structural signals may be shared with academic partners for research purposes. You can withdraw consent through the available research controls at any time, and no further data will be shared after withdrawal.

Data storage

Your data is stored on servers in the US. Conversation messages are encrypted and stored in a database on our servers so they can remain visible to you in the chat. Memory embeddings and session summaries are also stored in a vector database (ChromaDB) per user. Account data, subscription status, and usage metrics are stored in a database on our servers.

Your rights

• Forget me. From inside the app, you can ask Anjo to erase your conversation history and memory at any time. This is negotiated with Anjo and processed immediately.
• Delete account. You can permanently delete your account and all associated data from the app settings. This is irreversible.
• Data export. Get a copy of your data from Settings → Privacy & Trust in the app, or see “How to make a data request” below.

How to make a data request

Most requests are fastest from inside the app: use "Forget me" or "Delete account" in Settings for erasure, or the in-app export (Settings → Privacy & Trust) for a copy of your data. Export asks you to re-authenticate, is limited to a few times a day, and we email you every time it runs.

If you cannot use those controls, email kevin@anjo.love. We confirm you control the account before acting on the request, and we will respond within 30 days.

Your rights (US state privacy laws)

Anjo is offered in the United States. It is not currently offered in the EU, UK, Switzerland, or mainland China. If you are a US resident, state privacy laws may give you rights including:

• Right to access. Request a copy of the personal data we hold about you
• Right to correction. Request correction of inaccurate personal data
• Right to deletion. Request erasure of your personal data
• Right to data portability. Request your data in a machine-readable format
• CCPA/CPRA (California). Request disclosure of the categories of data collected, request deletion, and opt out of the "sale" or "sharing" of personal data
• Washington My Health My Data Act & Maryland Online Data Privacy Act. For data about your health, including anything you choose to share in conversation: personal learning is on by default and you can turn it off and delete it in Privacy & Trust; the controls on this page are how you exercise these laws' rights

See "How to make a data request" above, or email kevin@anjo.love. We will respond within 30 days.

Cookies

We use a single authentication cookie (anjo_auth) to keep you signed in. This is a strictly necessary cookie for the service to function. We do not use tracking cookies, advertising cookies, or analytics cookies.

By using Anjo, you consent to this essential cookie. You can delete it by logging out, which will clear your session.

Data retention

• Active accounts. Your data is retained as long as your account is active
• Deleted accounts. All personal data is permanently deleted within 30 days of account deletion
• Conversation history. Stored until you delete it or request "forget me"
• Learning evidence (the corrections and reactions record described above, unless you turn personal learning off). Kept 12 months after capture, or until 12 months of inactivity, whichever comes first. Withdrawing deletes it, and anything derived from it, within 30 days
• Reactions and reply records. Reactions: until you delete your account or reset Anjo. How each reply was shaped: 400 days. Which memories a reply drew on: up to 30 days
• Evidence-memory search index. Lives exactly as long as the conversation history it is built from, and is deleted with it
• Financial records. Retained for minimum 7 years for tax and legal compliance

Data security

We implement industry-standard security measures including encryption, access controls, and regular security reviews. Passwords are hashed using bcrypt. Session tokens are HMAC-signed with secure secrets.

Third-party services

Anjo uses the following third-party services to operate. Each provider below processes data on Anjo's behalf under its own terms and, where it receives conversation data, a data-processing agreement, which bind it to safeguard your data to a standard equivalent to this policy. Those terms limit what it may do with the data, which may include short-term retention for security, abuse monitoring or legal compliance. Anthropic, Google and OpenAI do not train their models on Anjo API data:

• Anthropic. Claude AI language models for generating responses and background processing where used, which we run through Amazon Bedrock (Amazon Web Services). Anthropic Privacy Policy
• Google Gemini (via Vertex AI). AI language models for free-tier responses and some background processing, served through Google's paid Vertex AI tier, which processes API data under its Data Processing Addendum and does not use it to train Google's models. Google Sign-In may also be used for account authentication. Google Privacy Policy
• Vertex AI. Google Cloud Vertex AI runs the model behind your replies and some background work.
• OpenRouter and OpenAI (Sol). Premium replies. OpenRouter passes your messages and the memory context for that reply to OpenAI's Sol model and returns the reply. OpenRouter Privacy Policy, OpenAI Privacy Policy
• Amazon Bedrock (OpenAI Sol). When we reach OpenAI's Sol model through Amazon Bedrock instead of OpenRouter, Amazon Web Services runs it for those Premium replies, in the United States. AWS Privacy Notice
• TypeSafe (Jev). A decision model for small memory decisions, used for everyone except people who declined the in-app AI disclosure or signed out and have not accepted it again. It receives only the facts or memory text involved in a decision, and processes them as Anjo's processor, only to provide the service and on Anjo's documented instructions, under its Data Processing Addendum.
• Apple. In-app purchase processing and Apple Sign In on iOS. Apple Privacy Policy
• RevenueCat. Subscription management and purchase validation. RevenueCat Privacy Policy
• Resend. Email delivery for transactional emails. Resend Privacy Policy
• Expo / push notification infrastructure. Push notification delivery when notifications are enabled.
• AWS. Hosting and infrastructure, and Amazon Bedrock as above. Data is stored in US-based data centers.

Age requirements

Anjo requires users to be at least 18 years old. Companion chatbots may not be suitable for some minors. We do not knowingly collect personal data from children under 18. If you believe a child under 18 has created an account, contact us at kevin@anjo.love and we will delete the account and all associated data promptly.

Changes to this policy

We may update this policy. Material changes will be communicated by email if you have one on file. Continued use of Anjo after changes constitutes acceptance.

Contact

Questions? Email us at kevin@anjo.love.