Privacy Policy

Effective September 26, 2026 (updated September 26: family records, document number protection, multi-device sync)

Confidant (“the app”) is an AI personal assistant that runs on your phone, available for Android and iOS. This policy explains what information the app handles, why, where it is stored, and how you can control it.

In short: your data is stored only on your phone. Only with your consent is what a conversation needs sent to the model provider to generate a reply. When multi-device sync is on, your data passes through our relay end-to-end encrypted, and we cannot read it. We do not collect or sell any of your data.

1. Information we don’t collect

• The app doesn’t need an account and doesn’t collect your name, phone number or email address.
• The app includes no advertising, analytics, crash reporting or third-party tracking SDKs.
• The developer cannot see anything you save in the app. Apart from the multi-device sync relay, which you turn on yourself and which only forwards ciphertext it cannot decode (see section 4), we have no servers that receive your data.

2. Information stored on your phone

To do its job, the app stores what you type, photograph or ask Confidant to record in a local database on your phone. This includes: chat history, the things Confidant remembers about you, document and insurance records (which may include document numbers and expiry dates), names and birthdays of family and friends, reminders, spending records, mood journal entries, health records (such as height, weight and allergies), goals and notes.

The Volcano Engine Ark API key you enter is kept in the system’s secure storage (encrypted with Android Keystore / the iOS Keychain). Your documents can be protected with Face ID, Touch ID or fingerprint.

This information is never uploaded in readable form to the developer’s servers (with multi-device sync on, only end-to-end encrypted data is uploaded; see section 4). You can export it to a backup file or erase all of it in Me → Data. Uninstalling the app deletes it too.

3. Information sent to the model provider

Confidant’s chat, memory organizing, daily briefing and image recognition are powered by the Volcano Engine Ark model service (provided by Beijing Volcano Engine Technology Co., Ltd.). Before you use any AI feature for the first time, the app explains this in a prompt, and sends nothing until you tap to agree.

When you use it, the following is sent to Volcano Engine Ark over an encrypted connection (HTTPS) to generate that reply:

• The text you send, and any images you choose to send (for example a photo of a document or a meal);
• Summaries of local data relevant to your question, such as related memories, upcoming reminders or this month’s spending total, so Confidant can give a relevant answer;
• Search terms, when you ask Confidant to search the web.

Document numbers and document photos are not sent as chat context. When you ask about your own or a family member’s documents, the model only receives the document type, whose it is, the last few digits of the number and the expiry date. The full number and photos are shown only on your phone, after Face ID / Touch ID / fingerprint or passcode verification. The one exception is when you send a document photo yourself and ask Confidant to read it; that photo is sent to the model for recognition.

Requests use the API key you entered yourself and are governed by your service agreement with Volcano Engine. For how Volcano Engine handles this data, see its privacy policy. You can withdraw consent at any time in Me → Model → AI Data Sharing; after that, the app sends nothing to the model.

4. Multi-device sync (optional)

Multi-device sync is off by default. Before you turn it on, the app explains the following and asks for your consent:

• End-to-end encryption: when you turn on sync, your device generates a sync key that is kept only in the device’s secure storage. Your data is encrypted with this key (AES-256-GCM) before it leaves the device, then forwarded to your other devices through a relay server we operate (sync.babybearai.com).
• We can’t read it: the relay server stores only encrypted data and a random folder name derived from the key. Without the key it cannot decrypt the data or link it to who you are. We don’t need, and don’t collect, any account information.
• Pairing: a new device joins by scanning a QR code on an existing device or by entering the 24-word recovery phrase. The QR code and recovery phrase are the key itself, so don’t share them with anyone.
• What syncs: records, documents (including numbers and photos), people, reminders, spending, mood, health, notes, goals, memories and chats. The model API key doesn’t sync unless you turn that on separately in Settings. The inbox, daily briefings, activity log and device-specific settings don’t sync.
• Deletion: you can turn off sync at any time. “Reset Sync Key” immediately deletes the old encrypted data from the relay server, and removed devices can no longer read any new data.

5. System permissions

These permissions are requested only when you use the related feature. Declining one doesn’t affect anything else:

• Microphone and speech recognition: to turn what you say into text for voice input. Speech recognition is handled by the system (Apple speech recognition on iOS, the system speech recognition service on Android), and the audio may be processed by the system provider.
• Camera and photos: to take or choose photos of documents and meals for recognition.
• Contacts: to import names and birthdays of family and friends. Read on your device only.
• Calendar: to add events to your system calendar after you confirm.
• Notifications, alarms and background activity: to deliver expiry, birthday and briefing reminders on time, with alarms that ring on schedule.
• Face ID / Touch ID / fingerprint: to protect your documents. Biometric data never leaves the system.
• Network: to connect to the Volcano Engine Ark model service.

6. Health information

Health information you record, such as weight, allergies and medications, is stored only on your device. It is sent to the model as context only after you agree to AI data sharing, and only when it’s relevant to the current conversation. The app doesn’t read data from Apple Health or any other health platform. Confidant is not a medical device, and its suggestions are no substitute for a doctor’s diagnosis.

7. Minors

The app is designed for adults. If you are under 18, please use it with a parent or guardian.

8. Changes to this policy

If this policy changes materially, we’ll update the effective date on this page and let you know in the app.

9. Contact us

If you have any questions about this policy or your data, email support@babybearai.com.