Today, we don't read your data, and here is the evidence trail. We are building toward can't.
That distinction is the entire page. Most products in this space write “we take privacy seriously”, which is an adjective and costs nothing to type. What follows is what the architecture actually allows right now, including the parts that are not flattering.
Everything in your persona. The BackBone runs on a virtual machine the operator administers. Your files live in a SQLite database on that machine's disk, unencrypted. Anyone with root on that box can read the database file, the backups, or the memory of the running process. No promise made on this architecture is technically enforceable, so we are not going to make one.
What exists instead is deterrence and evidence: every read and write of your persona is written to an access log that you can see, including access by the operator and by system jobs. That is a real constraint on casual browsing and no constraint at all on a determined operator. T1 and T2 below are how that changes.
Every read, write, append, export and import of persona data: who did it (you in the browser, a named token, or a named system job), which file, and when. The log is written from day one so the history exists. It is not yet tamper-evident: an operator with database access could edit it. Making that detectable is T1's hash-chained log.
Your persona has an API. Nothing reaches it anonymously: every caller holds a token you created (or connected) yourself, named, scoped to read, write, or append, and revocable on the Tokens page in one click, including a revoke-everything button. Token secrets are stored only as hashes; each token's every access lands in the same log as above. Connecting Telegram binds your chat to your account through a single-use link and gives the collector its own revocable token; disconnecting revokes it immediately. These rows (tokens, bindings) are erased with everything else when you delete your account.
Trust is moved, never eliminated. The strongest claim this product will ever be able to make is precise: the operator cannot access your data, and you need only trust the audited code, the hardware attesting it, and Anthropic's terms. Never “nobody can see anything”.
We tell you exactly what we can technically see, log every access to your persona and show you the log, and make export and deletion real, including in the backups.
Your files encrypted with a key of your own, so the database file and every backup snapshot stop being readable. Designed, not built, and not started.
The server runs inside sealed hardware running a published, audited image, so the operator cannot read your persona even by trying. Approved as a goal only.
The database is continuously replicated to a private cloud bucket, and a connected collector keeps its own snapshots. Both are retained for 30 days.
So when you delete your account: every row of your persona, its history, your tokens and your access log are erased immediately, and your copies age out of the backups within 30 days. A single content-free record that an account was deleted, and when, is kept so the deletion itself is auditable. 30 days is therefore the honest maximum lag on the deletion promise, and it is stated rather than minimised. Deletion that ignores backups is theater.
One copy is deliberately not erased: if you connected your own GitHub repository, that repository is yours, on your account, and we do not touch it.