Ask Safely Privacy Policy

Effective October 1, 2026 · Last updated October 1, 2026

1. Who we are and what this covers

SafeLife Inc. ("SafeLife," "we," "us") runs Ask Safely. This policy covers the Ask Safely web app at app.asksafely.ai, our iOS and Android apps, and the free scam checker at asksafely.ai/scam-check (together, the "Service"). Our marketing website has its own Marketing Site Privacy Policy.

2. The short version

• Chats clear on your timer: 7 days by default, or 8 hours or 30 days.
• Knowledgebooks keep only what you allow. They don't clear on the chat timer. They stay until you forget or delete them, or delete your account.
• We never use your data to train AI models, and neither do our AI providers.
• We don't sell your personal information, share it for targeted advertising, or show ads.
• We share data only with the service providers in Section 9, and only to run the Service.
• Product analytics are content-free. They never include what you write or what your Knowledgebooks say.

3. What we collect

Guest mode (no account). Your messages, a guest session identifier (used to enforce 10 messages a day and one free Lookout check), and your IP address and device or browser type. Guest chats clear after 8 hours. Guests don't have Knowledgebooks. If you create an account, your guest chats move to it.

Account. Your email address (encrypted), your password (stored as a one-way hash; accounts that haven't signed in since March 31, 2026 are encrypted until the next sign-in), sign-in tokens (valid 90 days) and your settings, such as your chat timer and Keep mode. If you sign in with Apple or Google, we receive only your email address and a sign-in token.

Chats and what you add to them. To run the Service, we store your messages and the AI's replies, files and images you upload (including screenshots in a Lookout check), and voice audio and transcripts. All of it is encrypted, and we don't read it; Section 5 lists the narrow exceptions. It clears on your chat's timer.

Knowledgebooks. See Section 4.

Subscriptions. Apple, Google or Stripe (through RevenueCat) handle payments. We receive your plan, subscription status, key dates and a subscriber ID, never your card or bank details.

Usage and device information. Content-free product events, app version, device type and OS, IP address, and error logs (see Sections 8 and 10).

What you send us. Support emails, and posts in the optional Founding Member Slack channel if you join it.

We don't collect your precise location, contacts, or photo library, beyond the specific files you choose to upload.

4. Knowledgebooks and About you

What they are. About you holds facts about you, such as the people in your life, your home, work, interests and preferences. Custom Knowledgebooks are documents you create on a topic. Guests don't have them.

How things get kept. Your Keep mode decides:

• Ask me first (the default): nothing is saved until you tap Keep.
• Auto-keep: we save facts as you chat and show you a receipt with Undo.
• Lock: nothing new is kept.

To suggest facts, our AI reads your chats unless Keep mode is Lock. Suggestions you don't keep are thrown away and clear with the chat. Changes to a custom Knowledgebook are always shown to you for approval before they're saved. You can also add or edit facts yourself.

What we store. Each fact or piece of content; its category; the short quote from your message it came from (so you can see where it came from); a confidence value; version history for custom Knowledgebooks; and numerical representations of the text ("embeddings") that help us find the relevant facts for a question.

How we use them. We add relevant facts to your chats so answers fit your situation. Experts use them too; today every Expert can use all of your active Knowledgebook content. Books on the Shelf aren't used. Your Knowledgebooks are never used to train AI models, never used for advertising, and never visible to other users.

How we protect them. As a rule, fact text, source quotes, book content and version history are encrypted with AES-256-GCM under a key unique to you, managed by AWS KMS. Embeddings and structural data (such as IDs, ordering and timestamps) aren't encrypted with that key, so that search and sorting work.

How long they last. Until you forget a fact, delete a book, or delete your account. Clearing a chat doesn't remove facts you kept from it, including their source quote. Deleting a book deletes its version history. We may set aside facts that look out of date so they stop being used in chat.

Downgrading never deletes. On the free plan, custom books over the limit go on the Shelf. Shelved books aren't used in chat, but you can still read, export and delete them.

Your controls, free on every plan. View, edit or forget any fact; delete any book; change your Keep mode; export any Knowledgebook, including About you.

Sensitive information. You may choose to keep details about your health, money or family. We use them only to provide the Service to you. If you'd rather not store something, don't keep it, or forget it later.

5. How we use information

We use information to:

• run and personalize the Service (chat, Knowledgebooks, Experts, Lookout, web search, voice and uploads)
• manage accounts and subscriptions
• keep the Service secure and prevent fraud and abuse
• answer support requests
• send service emails and notifications
• improve the product using content-free analytics
• measure whether our own ads work
• comply with the law

Only people who need access to run, secure or support the Service can see your content. Beyond that, we look at it only when you ask us to (for example, in a support request), to investigate security or abuse, or when the law requires it.

6. AI processing

Anthropic's Claude models generate responses and Knowledgebook suggestions, and run through Amazon Web Services (AWS) Bedrock in the United States. Embeddings are created with Cohere Embed on AWS Bedrock. Voice runs on Amazon Nova Sonic on AWS. Under AWS Bedrock's terms, model providers don't store your prompts or use them for training. The model that answers depends on your plan and your question. Expert includes Claude Opus.

7. Web search and Lookout

Web search. When a question needs current information, we send the search text (or a rephrased version) to Brave Search. Brave doesn't receive your email, user ID or account details.

Lookout. To check a message, we analyze it with AI and compare its links, domains and phone numbers against scam and reputation data. Most of that data we keep and check on our own servers, including threat lists and Google Web Risk's database; Google receives at most a short partial fingerprint of a link, never the link itself. A few checks go outside, without your account details:

• phone numbers you ask about go to Twilio
• domain names are looked up in public domain-registration (RDAP) and DNS records

8. Email, notifications, analytics and attribution

• Email (Resend). We send account, billing and security emails, a short welcome series (up to 3 emails) and occasional check-ins. Open and click tracking are off. You can unsubscribe from everything except account, billing and security emails.
• Push notifications (Knock, Apple and Google). Notifications never include your chat text, Knowledgebook facts or topics. You can turn them off in your device settings.
• Product analytics (PostHog, US, under a data processing agreement). Pre-set events such as "completed sign-up" or "viewed the paywall," tied to a random ID. Never message or Knowledgebook text, your name, email, IP address or location. Session recording, autocapture and heatmaps are off. We keep these events until you delete your account.
• Web analytics (Plausible). Cookieless, aggregate page counts.
• Mobile attribution (Adjust). Install and first-chat events (never content), the vendor identifier, the advertising identifier where your device allows it, IP address, device, OS and app version. Used only to measure our campaigns.
• Web attribution. Ad click IDs and campaign tags from the link you arrived on, stored apart from your chats and deleted after 90 days.
• Feature flags (LaunchDarkly). Your user ID, email and plan, used to turn features on for your account.

9. Service providers

Each provider is bound by contract to use data only to provide its service to us. Where applicable, we have data processing agreements with them.

We may also share information if the law requires it, to protect people's safety or our rights, or as part of a merger or acquisition, in which case this policy continues to apply.

10. Retention and deletion

What "deleted" means. Deleted data is removed from our production databases. It isn't archived or soft-deleted, and we can't restore it. Copies may remain for a limited time in encrypted backups and access-controlled logs, which we purge on a rolling schedule. While we investigate a failure, diagnostic logs may capture parts of a message.

11. Security

We use TLS in transit and AES-256-GCM envelope encryption at rest, with keys held in FIPS 140-2 validated hardware security modules through AWS KMS, plus least-privilege access controls. Face ID and Touch ID run on your device; we never receive biometric data. Our SOC 2 Type II audit is in progress; the observation period began June 10, 2026. No system is perfectly secure. If a breach affects your personal information, we'll notify you as the law requires.

12. Your choices and rights

In the product. You can:

• delete any chat
• choose your chat timer
• set your Keep mode
• view, edit, forget or export what's in your Knowledgebooks
• unsubscribe from non-essential email
• turn off notifications and device permissions
• delete your account

Account deletion removes your account, chats, uploads, voice audio, Knowledgebooks, About you and analytics events from our production systems. We keep only the transaction records we're required to keep and limited technical records from guest sessions. Deleting your account doesn't cancel an App Store or Google Play subscription; cancel that in your store settings.

Requests. Wherever you live, you can ask to access, correct, delete or get a copy of your personal information. Email mike.ebener@asksafely.ai. We'll verify your request and respond within 30 days, or 45 days where state law allows. If we deny a request, you can appeal by replying to our answer. An authorized agent may make a request on your behalf.

California (CCPA/CPRA). In the last 12 months we collected:

• identifiers (email address, account and device IDs, IP address)
• commercial information (subscription status)
• internet and device activity
• audio (voice, if you use it)
• the personal information you put in chats and Knowledgebooks, which may include sensitive personal information you choose to share

We use this for the purposes in Section 5, and sensitive information only to provide the Service to you. We don't sell or share personal information for cross-context behavioral advertising, and we won't discriminate against you for using your rights.

13. Children

The Service is for people 17 and older. If we learn we've collected information from someone younger, we'll delete it.

14. Where we process data

We and our providers process data in the United States.

15. Changes

We'll update this policy before launching features that collect new kinds of data, such as sharing Knowledgebooks with household members or connecting them to other assistants. For material changes, we'll notify registered users by email or in the app before the changes take effect.

October 1, 2026 update. This version adds Knowledgebooks and About you, which launched on the web on September 21, 2026. It also covers Experts' use of Knowledgebooks, Lookout's checking services, push notifications, the scam checker, the 7-day default timer and 30-day chat extensions, and current plans.

16. Contact

SafeLife Inc., Minneapolis, MN · mike.ebener@asksafely.ai. SafeLife Inc. is a Delaware corporation.