Privacy Policy

Erphele is a personal productivity agent that helps you manage your tasks, calendar, notes, and day-to-day thinking, and remembers what matters to you. This policy explains what we collect, why we collect it, and the choices you have. Our rule is simple: we collect what's needed to run Erphele well for you, and nothing more.

Account information. You sign in with Google, with Apple, or with a one-time code sent to your email, all handled by our authentication provider, Clerk. We receive your name, email address, and profile image. Erphele never sees or stores a password.

Content you create. Tasks, projects, goals, calendar entries, chat messages, notes, journal entries, people you mention, uploaded files and photos, agent-generated files and sites, long-term memories, and daily briefs.

Voice. If you send a voice message, we store the recording (so you can play it back) and a transcript of it. Both live in your account and are deleted with it.

Preferences & usage. Theme, language, timezone, region, notification settings, and usage counts used to enforce plan limits.

Device & notifications. Web push subscriptions and mobile push tokens so Erphele can reach you when you ask it to.

Location. Only in the foreground, and only when you explicitly ask: for a place lookup or to save coordinates on a place-based task. Erphele never requests background or always-on location.

Computer Use. If you pair the desktop app and enable Computer Use, we store the commands the agent proposed, your approval decisions, and the command output, so you always have a complete record of what happened on your machine. See our Security page for how pairing is protected.

Cloud computer. Your agents have their own private cloud computer, hosted by our sandbox provider, E2B. Commands the agent runs there are sent to E2B, and their bounded output is recorded in your chat. The computer keeps its files between chats and is paused while idle. It has no access to your devices, account credentials, or other Erphele data; a Library file reaches it only when the agent copies that file there for your task. Files the agent exports from it are saved to your Library. You can switch it off or erase it in Settings, it is deleted after 30 days without use, and it is deleted with your account. Its running minutes are counted against your plan.

Voice calls. When you call your agent, your voice is streamed to OpenAI for that call only, over an encrypted connection your device opens after Erphele approves it; our server key never reaches your device. The call is created with storage turned off, so OpenAI does not keep the audio or the conversation for later. During the call the agent can read and change your tasks, notes and memories exactly as it can in chat. When the call ends, its captions and what it changed are saved to your conversation so you can read them back and your agent can remember them; a call from a temporary chat saves nothing. You can delete the saved call with its conversation, and it is deleted with your account. We keep the call's length for billing.

Home-screen widgets. While you are signed in, the mobile app stores a small snapshot of today's task counts, next task, and top goal in app-private native storage so the widget can show it. The snapshot is cleared when you sign out; stale snapshots ask you to reopen the app to refresh.

Live sources you configure. If you add a live tile (a stock symbol, a currency pair, a website), we periodically fetch that public data to keep the tile fresh. The source itself receives only the request, never your identity or content.

Visitor submissions on your hosted sites. If you publish a site with a form, submissions from visitors are delivered to your site inbox and stored in your account. You are the owner of that data and responsible for handling it appropriately.

Visitor traffic on your hosted sites. Pages published on erphele.site keep a small daily traffic rollup for their owner (see “Visitors to hosted sites” below).

Diagnostics & product analytics. Sentry (hosted in the EU) receives crash and performance diagnostics, and PostHog (EU Cloud) receives a small set of explicit product events. Automatic interaction capture, automatic pageviews, advertising tracking, and session replay are all disabled.

To make Erphele fast and usable offline, the app keeps a local cache on your device: your profile, recent conversations, notes, tasks, and similar content. Cached entries expire automatically after about 30 days, and the entire cache is wiped when you sign out or delete your account. On mobile, session credentials are stored in the operating system's secure keychain, never in plain storage.

To provide and operate Erphele: run the agent, manage your tasks and calendar, generate files and sites, deliver notifications, enforce plan limits, and provide proactive help. We use aggregate, non-identifying information to maintain and improve the service. We do not sell your personal data, and we do not use it for advertising.

Where your chats run. When you talk to Erphele, your messages and the context needed to answer them are sent to AI models. Every ordinary (non-temporary) turn, on every plan including Free, is routed through OpenRouter and pinned to OpenAI-hosted endpoints, which serve the model Erphele runs on. The same lane handles the work you don't see directly: chat titles, memory distillation, recall reranking, web-search summaries, and daily briefs.

Temporary chats. A temporary chat is deliberately not pinned to OpenAI. It is sent with zero-data-retention and no-data-collection flags, which route it to whichever zero-retention endpoint serves the same model, operated by a provider other than OpenAI, because OpenAI's own endpoints are not zero-retention eligible. We store nothing from a temporary chat, and the provider serving it is instructed not to retain or log it. One exception, stated plainly: the quick-decision step described below also runs in temporary chats, and its provider does not offer zero retention.

Voice, images, speech, and recall. Voice messages are transcribed by Alibaba Cloud's Qwen ASR model through OpenRouter. Voice inside a temporary chat, and any transcription that has to fall back, goes to Google's Gemini model on Vertex instead, because that lane has zero-retention endpoints and dedicated speech models do not. Generated images and read-aloud speech also run on Google's Gemini models. For semantic memory and note recall, short snippets of your content are sent to Google's Gemini API to create embeddings: numerical representations used only to search your own content.

Quick decisions. Some small judgement calls are not written by a chat model at all: which of your memories bear on the message you just sent, which tools a request will need, whether a message is simply a thank-you, and whether a reply claimed something it did not do. For those, the relevant text (your message, the end of the assistant's previous reply for context, and outside temporary chats short memory snippets and the reply being checked) is sent through OpenRouter to TypeSafe's decision model, which returns only a yes, a no, or a pick from a fixed list. TypeSafe commits not to train on what it receives and not to share it beyond its own service providers. It does not offer a zero-retention option. Temporary chats use this step too (your message and the end of the previous reply only), so in a temporary chat the reply itself is zero-retention but the text classified to route it is not.

We never use your private content to train AI models, our own or anyone else's, and we never hand it to anyone else to train on. That covers everything Erphele processes for you on our own infrastructure and providers.

We rely on a small set of processors, each handling data only to perform its function:

• Clerk: authentication and identity.
• Convex: database and file storage, in the EU (AWS eu-west-1).
• E2B: your agents' private cloud computer (files kept until you erase it, 30 days of disuse, or account deletion).
• Vercel: web and hosted-site delivery.
• OpenRouter: routing of every AI request, and billing for it.
• OpenAI: the chat, reasoning, and utility model behind every ordinary turn on every plan, and the live voice model for calls (audio for the call only, never stored).
• TypeSafe: quick yes/no and pick-one decisions (memory relevance, tool routing), including in temporary chats, without zero retention.
• Alibaba Cloud: voice-message transcription (Qwen ASR).
• Google: embeddings for recall, image generation, and read-aloud speech (Gemini, including Vertex for private transcription).
• Other zero-retention model hosts: temporary chats route to whichever zero-retention endpoint serves the model at that moment, so the host varies and is not OpenAI.
• Polar: subscription billing as merchant of record; we share only your email and account ID and never see payment details.
• Expo: mobile push delivery.
• Sentry: crash and performance diagnostics, EU region.
• PostHog: product analytics, EU Cloud.
• Open-Meteo: weather.
• OpenStreetMap / Nominatim: place search when you ask for one.

Live tiles fetch public market data from Stooq, CoinGecko, and Frankfurter; those requests carry no identity or content. We keep this list current: when the model behind a feature changes, this page changes with it.

We retain saved data within your plan allowance while your account is active. If your saved data exceeds your current plan limits, we give you 30 days from detecting the excess to choose what fits to keep, export it, remove it, or upgrade. We show the deadline in Settings → Billing and remind you before expiry. After that deadline we permanently delete only excess items, oldest unselected items first. Site deletion includes its versions, assets, and domains; deleting an excess site file or asset also removes it from older snapshots. Upgrading or reducing usage before cleanup cancels or recalculates it. This does not delete your account. You can delete individual items (tasks, chats, files, memories) anytime, or delete your entire account from Settings → Account. Account deletion takes effect immediately: access is blocked, notifications stop, and Computer Use is disabled. A background job then removes your content from every table and storage bucket, deletes your identity at Clerk, and revokes any API key you connected. Your device's local cache is wiped as well. Processors may retain limited records where legally required (for example, billing records at Polar).

You can also export everything as a single ZIP: your data as both machine-readable JSON and human-readable files, including your attachments. Export links expire after 24 hours.

Your data is encrypted in transit (TLS) and at rest, and isolated to your account, enforced on every request. Everyone gets the same protection, whatever they keep in Erphele. No system is perfectly secure, but we follow industry-standard practices and welcome responsible disclosure at support@erphele.com. See our Security page for details.

This section is about people who visit a site an Erphele user published on erphele.site, not about Erphele account holders.

When a published page is viewed, we record a per-site, per-day rollup so the site's owner can see how it is doing: the number of page views, the number of distinct visitors, the most-viewed paths, and the hosts that referred traffic. Visitors are counted using a keyed pseudonym computed at our web edge and rotated every day. The visitor's IP address itself is never written to our database and is never shared with the site owner. There are no analytics cookies, no cross-site tracking, no advertising identifiers, and no profile that follows a visitor between sites or days. These rollups are deleted automatically after 90 days, and immediately if the site or the owner's account is deleted.

Anything else a visitor sends, such as a form submission, belongs to the site owner and is handled under their own terms, not ours. Abuse on a hosted site can be reported from any page at /__erphele/report.

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. Most of these you can exercise directly in the app; for anything else, contact us and we'll help.

Erphele is not directed to children under 13, and we do not knowingly collect their data.

Your account data is stored in the EU (Convex on AWS eu-west-1), and diagnostics and product analytics are hosted in the EU as well. AI processing is different: requests are served by providers in other regions, primarily the United States (OpenRouter, OpenAI, Google, TypeSafe) and, for voice transcription, Alibaba Cloud. Billing runs through Polar, and authentication through Clerk, both US-based. Those transfers are made under the standard contractual clauses or equivalent safeguards our providers offer, and the data sent is limited to what the request needs. Wherever your data is processed, it is handled in accordance with this policy.

We may update this policy as Erphele evolves. Material changes will be reflected by the “Last updated” date above, and where appropriate we'll notify you in the app.

Erphele is operated by a licensed self-employed software professional in the Kingdom of Saudi Arabia, who is the data controller for the information described here. Registered business details are provided on request. Questions about privacy? Email support@erphele.com.