Privacy Policy

The team that runs Confab decides how your data is used, which makes us its controller under UK data protection law. For anything about your data, email [email protected].

• Your account: email address, username, display name, password (stored only as a hash), profile picture and banner, two-factor settings, and the settings you choose. If you sign in with Apple or Google, they tell us your email address and name.
• Your chats and what Confab makes: your messages and Confab's answers, the plan and steps it took, files you attach, what it makes for you (files, designs and pictures), the memories it keeps about you, and who you share chats and designs with.
• When Confab acts for you: pictures of your screen and the buttons and text of the apps it uses, with sign-in, password and security windows blanked out; what's in the folder you share, as far as the task needs, and the changes it proposes; the pages it visits in its browser; and for servers, the address, the account name, the key Confab made (the private half encrypted), and the commands it ran with what they printed.
• Voice: on a computer or the web, what you say is turned into text on our own machines. On iPhone, the iPhone's speech recognition does it, on the phone where it can and otherwise through Apple. We keep the words as part of the chat, not the recording.
• Payments: what you bought, when and for how much. Stripe takes the payment and keeps your card details; we never see your full card number.
• The Confab API: your keys (as fingerprints only) and, for each request, when it was made, the key and model used, its size and whether it worked; plus the words of requests and answers, and pictures made, for the short times below.
• Safety and security: your signed-in devices and sessions, and records of requests our checks refused, with a short excerpt of the question.
• Technical: IP address, device, app version, time zone, when you were last active, and the usual server logs, kept briefly to run and protect Confab.
• From before Confab was a work app: if you used its earlier chat features (servers, direct messages, friends, calls or bots), what you made there is still stored. Ask us and we will delete it, or delete your account.

• To run Confab for you: your account, your chats, the work Confab does, memory, sharing, payments and the API. We need this to provide the service you signed up for (our contract with you).
• To keep Confab and the people using it safe: the automatic checks, refusal records, security logs and dealing with reports. This is in our legitimate interest, and needed to meet our legal duties.
• To fix and improve Confab: mostly from error logs and usage counts. We look at what's in a chat only to deal with a problem you've asked us about, a report, or a safety concern. This is in our legitimate interest.
• To meet the law: for example, keeping records of payments for tax.

We don't sell your data, we don't show ads, and we don't use your chats, files, pictures, voice or designs to train AI models, ours or anyone else's. Where we rely on legitimate interests, you can object, and we stop unless we have a strong reason to carry on, such as keeping people safe.

• People you share with: the people in a shared chat, and anyone with a view-only link to one of your designs.
• Anthropic, only for chats where you pick Claude: the words that chat sends to the model, meaning your messages and what Confab reads for the task. Pictures of your screen never go to Anthropic. Under its commercial terms, Anthropic doesn't train on this and deletes it within 30 days, unless its safety systems flag it or the law requires otherwise.
• Stripe, to take payments, and Apple for what you buy in the iPhone app.
• Your own server, only if you add one with Your own models and pick it: what that chat sends to the model, meaning your messages and what Confab reads for the task, goes to the address you gave.
• Cloudflare, which carries traffic to and from our machines and protects them from attacks.
• Apple and Google, if you sign in with them. Apple also delivers iPhone notifications, runs the TestFlight beta (sharing crash reports, and any feedback you send through it, with us), and turns speech into text when the iPhone can't do it on the phone.
• Search engines and websites: when Confab searches the web or reads a page for you, our machines send the search or fetch the page, so they see our machines, not you. Sites you open in Confab's browser see your computer, like any browser.
• The authorities, when the law requires it, or to protect someone from serious harm.

If Confab is ever sold or merged, your data would pass to the new owner under this policy, and we would tell you first.

Confab runs on machines we own and run ourselves. Some of the companies above are based outside the UK, mostly in the US. When they handle your data, it is protected by the safeguards UK law requires, such as approved contract terms.

• Your account, chats and creations: until you delete them. Delete a chat and it goes, with its pictures. Delete your account in Settings › My account › Delete account and everything in it goes at once. Server logs, which can include your IP address, are kept only briefly.
• Memories: until you forget them, line by line, in Memory.
• The Confab API: request records for 30 days, the words of requests and answers for 7 days, and pictures for 24 hours.
• Refusal records: while your account exists.
• Payments: Stripe keeps payment records for as long as the law requires.
• Sign-in sessions: they expire on their own.

You can ask for a copy of your data, and ask us to correct it, delete it, give it to you in a form you can take elsewhere, limit how we use it, or stop using it. Much of this you can do yourself in the app: edit your profile, delete chats, forget memories or delete your account. For anything else, email [email protected] and we will reply within one month.

Some safety decisions are made automatically, such as pausing picture making after refused requests. You can ask for a person to look at any of them.

If you're unhappy with how we handle your data, tell us first so we can put it right. You can also complain to the Information Commissioner's Office at ico.org.uk.

This website sets no tracking cookies and runs no analytics. The apps and app.confab.im keep what they need to work, such as your sign-in and settings, on your device.

Confab is for people 13 and over, and under 18s need a parent or guardian's OK. We don't knowingly keep data about children under 13. If you think we have some, tell us and we will delete it.

We update this policy as Confab changes. If a change matters, we tell you in the app before it takes effect. The date at the top shows when it last changed.