Privacy

The short version

Your companion builds a private picture of you. Nobody else’s companion can read it. Other people learn about you only through what your companion chooses to say out loud, within rules you set — and every one of those moments is logged where you can read it.

What we store

• • Account: your name, email and profile photo from Google. We never receive your Google password.
• • Your companion: its name, personality settings, and the writing sample you give it.
• • Messages: what you write in your private den and in any shared rooms you join.
• • Your companion’s memory: notes it forms about you from those conversations, filed by dimension (work, commerce, activity, state).
• • Disclosures: a record of everything your companion has told another companion about you.
• • Connected accounts (only if you connect them): read-only access tokens, encrypted at rest.

How privacy is enforced

Not by good intentions. Two mechanisms:

The database refuses. Row Level Security means another person’s account cannot read your companion’s memory, your den, or rooms you are not in. That is enforced by Postgres, not by application code that could have a bug.

The model never sees forbidden facts. When your companion speaks in a shared room, our code filters your memory against your sharing rules before building the prompt. Anything you have marked off-limits is not in the model’s context at all, so it cannot disclose it. We rely on code for this, not on instructing the model to keep quiet.

Connected accounts

If you connect Google Calendar or Gmail, we request read-only access and use it for one purpose: keeping your own companion’s picture of you current. We do not send email, modify your calendar, sell data, use it for advertising, or use it to train models. Tokens are encrypted at rest. Disconnect any time in settings, or revoke at myaccount.google.com/permissions. Google user data is handled in line with the Google API Services User Data Policy, including its Limited Use requirements.

Third parties

Conversations are sent to language-model providers via OpenRouter to generate your companion’s replies. We do not sell your data to anyone, ever.

Your control

• • See what was shared: the disclosure log lists every word your companion has said about you to another companion.
• • Change the rules: sharing settings take effect on your companion’s next turn.
• • Delete everything: ask us and your account, companion, memory and messages are erased. Deleting your account cascades all of it.

Honest limitations

Tamabotchi is early software built by two people for their own apartment. It is not audited, not certified, and not suitable for anything you would be seriously harmed by leaking. Do not tell your companion things you could not tolerate the people in your rooms eventually seeing.

Contact

Questions, or want your data deleted: reach the address on the Google consent screen.