Privacy & Trust
Something that knows this much about you has to earn real trust. Run alwyse on your own hardware and nobody but you can read it, today. On the hosting we run, we tell you exactly what we can and cannot see. What's real right now, per hosting option, lives on the trust roadmap.
Six commitments
Your memory is yours
No ads. No resale. What alwyse holds exists to serve you, and only you.
Opt-in capture
You choose which sources feed into alwyse. Nothing is captured without your consent, and every connection can be severed at any time.
Boundaries you set
You can tell alwyse what to know about and what to leave alone: work but not a relationship, or the reverse. Boundaries are explicit and enforced.
Understanding you can see
What alwyse has come to understand about you is inspectable and correctable. It is not a black box. Corrections reshape the model, not just the item in front of you.
Your hardware, if you want
The same software runs on your own infrastructure. Hosting is a configuration rather than a fork, so you get full data control without a different product.
You can leave with everything
Full export ships today, served by your own instance: your observations, what alwyse derived from them, your media, and your preferences.
Operator-blindness, honestly
The strongest claim a product like this can make is that nobody who runs it can read your content. On self-host the question doesn't arise, because nobody but you runs it. On Cloud, the managed service you're using during the beta, it is not true, and it never will be: standard isolation is what that tier is. Cloud Confidential would close the gap without asking you to run anything, and it does not exist yet.
So Cloud makes a different promise, and this one is built: running the service never requires reading you. Your cognition lives in a cell of its own, with its own database. The control plane that handles your account and finds your cell never receives your content. Inference goes from your cell straight to the model vendor, never through us. Our logs can't hold your content because it is never captured, not captured-and-filtered. That is weaker than operator-blindness — we run the cell, and an administrator with infrastructure access could reach what's at rest in it — and it is a great deal stronger than nothing. We say exactly which it is.
Rather than summarise the rest here, we publish it. Every claim, every tier, its honest status, where each one is headed, and the places each guarantee stops: the trust roadmap.
What crosses, and who decides
Everything alwyse captures, and everything it works out about you, lives inside a trust boundary. Crossing it buys capability: a frontier model, a web search, your calendar. Staying inside keeps everything in and costs you features. You choose, every time, and alwyse records every crossing.
Which is why we will never tell you your data never leaves. Run local models on your own hardware and nothing does. Bring a cloud model key and your content goes to that vendor, under their terms, because you asked for it. The promise isn't that nothing moves. It's that the boundary is real, the crossings are visible, and the levers are yours.
Reaching your own instance
Today, your devices reach a self-hosted instance across your own network. Reaching it from anywhere else means a relay of ours standing between your phone and your box, and that is the one place self-host would acquire an operator. It lands before broad launch, and it lands unable to read what it carries. Until both are true, we don't offer it and we don't describe it as though we did.
Trust is a product experience
Trust isn't a PDF. It's something you can see and control, every day, inside the product:
- See what it knows. The "You" surface shows what alwyse understands about you, in plain language.
- Corrections change behavior. "That's not what I meant" reshapes the understanding, not just the moment.
- Ask "why?" and get a real answer.
- Pause or stop capture whenever you want, per source or entirely.
alwyse will be wrong sometimes. It will misread a pattern, or surface something irrelevant. That's acceptable because it listens, adapts, and tells you why.
Deletion is half real. Delete something and it's gone from every screen, search, and answer immediately, and the removal cascades through what alwyse inferred from it. Erasing the underlying record, and a control you can reach without touching the API, land before broad launch. Both statuses are on the trust roadmap.
See the whole ladder
Every privacy claim, per hosting option, with its honest status. Published in full so our copy can't outrun the truth.
The formal records behind this page — the Privacy Policy and the Terms of Service — say the same things, in their legal form.