Privacy Policy

What is Carae?

Carae is a personal AI assistant that operates through Telegram. You sign up on the web, connect your accounts, and then interact with Carae through your Telegram app. We're a small EU-based product and we take your privacy seriously — it's designed in, not bolted on.

What data we collect

• Account data: Your name, email address, timezone, and country. Provided at signup.
• Conversation history: Every message you send to Carae and every reply we send back. Retained for 90 days, then automatically deleted.
• Long-term memories: Key facts extracted from conversations (e.g. your preferred working hours, names you mention frequently). You can view and delete these at any time.
• Calendar data: If you connect Google Calendar, we read your event titles, times, and attendees to power your morning brief and reminders. We never modify your calendar.
• Email data: If you connect Gmail, we read message metadata (sender, subject, date) for inbox triage. We only read full email bodies when you explicitly ask us to summarise a specific email.
• Payment data: Handled entirely by Stripe. We never see or store your card number.
• Telegram data: Your Telegram user ID and chat ID, used to route messages to your account.
• Community skill submissions (The Forge): If you publish a skill to The Forge, the skill's name, description, and instruction content are stored on our servers and reviewed by Carae before publication. This content is associated with your account.

What we don't collect

• We don't use analytics trackers, advertising pixels, or third-party cookies.
• We don't sell your data. Ever.
• We don't use your conversations to train AI models.
• We don't build advertising profiles.

Third parties we use

Here is every external service your data touches:

How we store your data

All your data is stored on Hetzner Cloud in Frankfurt, Germany. Hetzner is a German company subject to EU law. Data never leaves the EU infrastructure.

OAuth tokens (your Google Calendar and Gmail access credentials) are encrypted at rest using AES-256 encryption. The encryption keys are stored separately from the data. Tokens are never logged or included in error messages.

Your database rows are protected by PostgreSQL Row Level Security — the platform is designed so that one user's data is inaccessible to another user's application queries, enforced at the database engine level. (For full transparency: like every operated SaaS, our small ops team can technically read user data via direct database admin access for support and debugging, and only does so when explicitly required. We never sell your data, never use it for advertising, and never train AI models on it. Every operator-access event is audit-logged. The full details are in the legal Privacy Policy.)

AI and your data

We use the following AI providers to process your messages:

• Anthropic (Claude) — for complex queries and drafting
• OpenAI — for embeddings (memory system) and fallback responses
• Groq — for fast, cheap routine tasks

All three are accessed via commercial API tiers. None of them train on API data.Your conversations are not used to train any AI model.

Retention and deletion

• Conversation messages: Deleted after 90 days automatically.
• Long-term memories: Kept until you delete them or close your account.
• Account data: Kept while your account is active. Deleted within 30 days of account closure.
• Payment records: Retained as required by law (7 years for tax purposes — stored only at Stripe, not on our servers).

To delete your account and all data, send /forgetme to the bot, or email [email protected]. Deletion happens within 24 hours. This is a legal right under GDPR Article 17.

Your rights (GDPR)

You have the right to:

• Access — request a copy of all data we hold about you
• Rectification — correct inaccurate data
• Erasure — delete your account and all data
• Portability — export your data (send /exportme to the bot)
• Objection — object to processing (contact us and we'll discuss)

To exercise any of these rights, email [email protected]. We'll respond within 30 days.

Contact

Questions about this policy? Email us at [email protected]. We're a small team and we actually respond.