Privacy Policy
Last updated October 20, 2026
What we collect
Account data (email, display name, hashed password), billing state (handled by Stripe — we never see card numbers), runtime telemetry (health heartbeats, public connection status), and metering records (model, token counts, cost). Your desk's content — files, conversations, event history — lives on your Habitat's own volume, not in our control plane.
How AI processing works
When you talk to your Envoy or run workers, the relevant text or audio is sent to the model provider serving that lane (xAI, OpenRouter and its upstream hosts, OpenAI for transcription) to produce the response. If you connect your own Codex or Claude subscription, those requests go to your provider under your own agreement, and your credentials stay on your Habitat's volume — we never receive them.
Google accounts
You can connect one or more Google accounts in Settings, under Google accounts. For each one, Habitat asks Google for your name and email address and, for the services you allow, access to that account's Gmail (to read, send, star, archive and move messages to the trash) and Google Calendar (to read your calendars and to add, change, delete and answer events). We use them only for your desk's Mail and Calendar apps, to do what you ask your Envoy to do with them, and to show them on your Habitat card. Mail and Calendar open only for you, the desk's owner. If you share your desk, your Envoy uses them only for what you ask on your own Habitat card, and its answer is part of the desk's conversation like anything else you ask there. Habitat never deletes mail permanently: what you delete goes to Gmail’s trash. Anything your Envoy prepares that would reach another person (a message, an invitation, a change its guests are told of, an answer to an invitation) is shown to you as a draft and goes only when you send it, and your Envoy never acts on what a message asks of it.
The token Google issues for each account stays in our control plane, encrypted (AES-256-GCM), and is never given to your desk or to any AI agent; your desk receives access tokens that expire within an hour. Your mailbox and calendars are not copied to our servers: your desk reads them from Google when you look, and files you attach or download pass through your desk without being kept. We keep each account's email address, name, the label and colour you give it, and what you allowed. When you ask your Envoy about your mail or calendar, the part it needs (a few messages or a few days' events) is sent to the model provider serving your Envoy, only to produce that answer, and stays in that conversation's history on your desk. A page your card shows from them stays on your desk only while it is among the card's last few pages.
Habitat's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We don't sell Google user data, use it for advertising, or use it to develop, improve or train AI or machine learning models. No one at Habitat reads it unless you ask us to for support, it is needed for security, or the law requires it.
To disconnect an account, remove it in Settings, under Google accounts: we revoke our access at Google and delete its token. You can also remove Habitat at myaccount.google.com/permissions. Closing your Habitat account revokes and deletes every Google account connected to it.
Ads and measurement on our product pages
On our Envoy 1 pages we measure which of our ads bring visitors, using the TikTok and Meta pixels and their server-side counterparts (TikTok’s Events API, Meta’s Conversions API). They record the pages you view, when you start checkout, when you go to pay and when you reserve or pay. With a reservation or a paid deposit we send your email address only in hashed form (SHA-256), with a random visitor id (also hashed), your IP address and browser details, so TikTok and Meta can match the visit to an ad. TikTok and Meta set cookies for this. We don’t sell your personal information for money, but under California law this counts as “sharing” for advertising. You can opt out at any time with “Your privacy choices” at the foot of those pages, and we treat a Global Privacy Control signal from your browser as an opt-out. Separately, and only for ourselves, those pages count how far down each visit scrolls, how long the page is on screen and whether you tapped to buy, under a random id kept in your browser. That count holds no email address and goes to no one else.
Visit recordings on our product pages
Also only for ourselves, our Envoy 1 pages record what you do on them, so we can see where they work and where they don’t: your screen size, where you scroll, where you tap and the words of the link or button you tap, when you tap into a field (never what you type in it), and when you leave. We don’t record what the page shows you, and payment details are entered on Stripe’s page, which isn’t recorded. A recording is tied to the same random id kept in your browser, not to your name or email address, goes to no one else, and is deleted after 30 days. If you opt out with “Your privacy choices”, or your browser sends Global Privacy Control, nothing is recorded, and opting out also deletes the recording of the page you’re on.
Processors
Cloudflare (edge, control plane, storage), ascii.dev (cloud servers), Stripe (payments), Resend (transactional email), TikTok and Meta (ad measurement on our product pages, as above), and the model providers above. Each receives only what its role requires.
Retention and deletion
Deleting your device disconnects it and revokes its credential; cloud volumes follow the stated retention policy before removal. Deleting your account removes account records; email us to exercise deletion or export rights and we will complete them within 30 days.
Security
Passwords are slow-hashed; sessions are opaque tokens stored hashed; runtime credentials are revocable and stored hashed; secrets never enter event logs. Report issues to hello@habitatcomputer.com.