Privacy Policy
Effective Date: July 2026 · Last Updated: July 2026
GreatOak takes your privacy seriously. This policy explains what data we collect, how we use it, and your rights.
The short version: Your conversations are yours. We don't sell them, share them, or use them to train AI models. Period.
1. What We Collect
Information you provide:
- Account details: Name, email address, password, location (city/region for timezone)
- Companion preferences: Companion name, personality settings, boundaries, quiet hours
- Conversations: Everything you say to your Companion and everything it says back
- Payment information: Processed by Stripe — we never see or store your credit card number
Information collected automatically:
- Usage data: Message counts, feature usage, credit consumption
- Device information: Browser type, operating system (for website functionality)
- Companion memories: Facts, preferences, and context your Companion learns from conversations
2. How We Use Your Data
| Data | Purpose |
|---|---|
| Account details | To operate your account and communicate with you |
| Companion preferences | To configure your Companion's personality and behavior |
| Conversations | To generate responses and build your Companion's memory of you |
| Usage data | To track credit consumption and improve the service |
| Payment info | To process payments (handled entirely by Stripe) |
What we do NOT do:
- Sell your data — never, to anyone, for any reason
- Share conversations with third parties (except AI providers who process them to generate responses)
- Train foundation AI models on your conversations
- Use your data for advertising
- Profile you for marketing purposes beyond our own service
3. How Your Data Is Stored
- Encryption: All data is encrypted in transit (TLS/HTTPS) and at rest
- Isolation: Each customer's Companion runs on its own dedicated server. Your data is physically separated from other customers
- Backups: Daily automated backups with 7-day retention
- Location: Servers are hosted on Hetzner Cloud in the US (Ashburn, VA), EU (Nuremberg, Germany), or Asia (Singapore), based on your location
4. Third-Party Services
We use these services to operate GreatOak. Each processes only the minimum data necessary:
| Service | What they see |
|---|---|
| Anthropic | Your messages (to generate Companion responses) |
| Google AI | Your messages (alternative AI processing) |
| OpenAI | Your messages (alternative AI processing) |
| Stripe | Payment details, email |
| Hetzner Cloud | Server hosting (encrypted data at rest) |
| ElevenLabs | Voice message audio (when voice enabled) |
| Resend | Your email address (for transactional emails) |
Important: AI providers (Anthropic, Google, OpenAI) process your messages to generate responses in real-time. Under their API terms of service, they do not retain your data for training purposes and do not store your conversations beyond the processing window.
5. Your Companion's Memory
Your Companion builds a memory of you over time — things you like, people you mention, your preferences, your stories. This memory:
- Is yours alone — no other customer or GreatOak employee can access it
- Is viewable — you can see summary categories of what your Companion remembers in your dashboard
- Is deletable — you can ask your Companion to forget specific things, or use the “Forget Something” feature in your dashboard
- Lives on your server — stored in a private database on your dedicated server
6. Data Retention
| Scenario | Retention |
|---|---|
| Active subscription | Data retained indefinitely while you're a customer |
| After cancellation | Companion available for 30 days, then server shut down |
| After server shutdown | Data retained for 30 additional days, then permanently deleted |
| Account deletion request | Complete data wipe within 30 days of request |
| Backups after deletion | Purged from backup rotation within 7 days of deletion |
7. Your Rights
You have the right to:
- Access your data — see what your Companion knows about you via the dashboard
- Correct your data — update your profile or ask your Companion to correct memories
- Delete your data — request complete account and data deletion at any time
- Export your data — request a copy of your conversation history and Companion memories
- Object to processing — you can ask us to stop processing your data (this will require account closure since the service requires data processing to function)
For EU/EEA Residents (GDPR)
In addition to the above, you have the right to:
- Data portability — receive your data in a structured, machine-readable format
- Restrict processing — request that we limit how we use your data
- Lodge a complaint with your local data protection authority
To exercise any of these rights, contact us at privacy@greatoak.ai.
8. Cookies
We use minimal cookies:
| Cookie | Purpose | Duration |
|---|---|---|
| Session cookie | Keeps you logged in | Until logout |
| Auth token | Authenticates your requests | Until logout |
We do not use tracking cookies, analytics cookies, advertising cookies, or third-party cookies.
9. Children
GreatOak is for adults only (18+). We do not knowingly collect data from anyone under 18. If we discover an underage user, their account will be terminated and data deleted immediately.
10. Security
We implement industry-standard security measures:
- HTTPS/TLS encryption on all connections
- No exposed ports except essential services (SSH + HTTPS)
- Row-level security on all database tables
- Server-side authentication for all sensitive operations
- Regular security reviews
If you discover a security vulnerability, please report it to security@greatoak.ai.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes via email. The “Last Updated” date at the top reflects the most recent version.
12. Contact Us
For privacy questions, data requests, or concerns:
- Email: privacy@greatoak.ai
- General support: support@greatoak.ai
We aim to respond to all privacy requests within 30 days (sooner for simple requests).
GreatOak. Your AI. For life.