Your space, your choices.
The same privacy model on web and iPhone
prœmise stores accounts, promise words, versions, returns, permissions and supporting files on private server infrastructure. It is not an on-device-only vault and it is not end-to-end encrypted. The iPhone keeps its sign-in credential in Keychain.
What we hold
We hold the email address and account/provider identifiers needed for sign-in; the words, photos or documents you choose to save; intended invitation addresses; and the timestamps and actions needed to show a promise’s history. Uploaded originals may contain private image metadata. We do not record continuous location or measure walks.
Receiving without joining
A private invitation is bound to its intended email. A short-lived email code verifies control of that inbox and creates an invitation-scoped guest session, not a product account. A forwarded link alone does not grant private access. You may respond, decline or remain silent.
Files and disclosure
Originals stay private to their owner. You may separately share a prepared image with the intended participant. Prepared images remove embedded metadata. Private documents are not directly shared in this beta; you can choose limited words to disclose after reviewing them. Revoke prepared-image access or erase a file from its promise.
Seven is optional
Each request asks for permission to send only your selected text and selected files to the AI provider. Recipient access is a different permission. AI output starts private. Guided follow-ups include only your selected answers from that conversation and the files you authorize again. Private conversation answers and results are retained with your reviews until discarded or your account is deleted; earlier reviews can be discarded separately in Settings. Only you may approve exact words for sharing. When you use linked AI wording in a promise, its participants can see whether you approved it unchanged or edited it. Private prompts and rejected suggestions are not disclosed. An explicit action record does not prove reading, attention or thought. Seven cannot undertake a promise, accept a revision, confirm kept, or judge, score, rank or label people.
Service providers
Vercel hosts the application and private files. PostgreSQL on Supabase stores application records. Resend handles authentication and invitation emails. Apple handles Apple sign-in. Selected Seven material passes through Vercel AI Gateway to OpenAI, with routing restricted to OpenAI. Such material may itself contain personal information; we do not claim it is automatically anonymized. Requests disable provider response storage, but that is not a promise of zero provider retention. We retain basic model and usage information with the private operation, not provider copies of your files.
Deletion, shared words and recovery
Erasing a private file revokes application access immediately and queues deletion of its original and prepared image. Failed cleanup remains visible for retry. Deleting an account removes its account access, private personal/draft records, private sources and AI drafts. Words and human events deliberately shared with another person may remain in that person’s record. Downloaded copies cannot be recalled. Private recovery archives and provider backups may retain previous data until separately purged; this beta does not promise a fixed maximum purge time. Restoration must reapply deletion and access revocations before serving data.
On this device
Authored text drafts are saved locally for the current account or guest session. Sign-out clears that identity’s local drafts. Files need a connection. The client does not keep an offline cache of private server records or automatically replay promises under another account. A sketch begun before sign-in stays local until you choose to continue.
Activity and messages
In-app activity is separate from response or agreement. Invitation and login emails contain minimal details. Optional activity emails are off until you opt in, contain no private words or pictures, and can be stopped in Settings or through their unsubscribe link. Delivery queued, provider accepted, read and responded are different facts. There are no advertising trackers, public profiles, person scores or push-notification delivery in this release. Operational errors and abuse limits are recorded without intentionally logging promise text, files, invitation secrets or codes.
Your choices
Inspect your words and version history, review file permissions, revoke prepared-image access, discard AI results, erase private sources or delete account access from Settings. Receiving a promise does not oblige you to join or respond. The service is not directed to children under 13.
Privacy questions: privacy@promiseme.ai
Terms