How your conversations are handled

When AI is involved, relevant content is sent to OpenAI

IdentityOS uses OpenAI to build your reflection, generate your character options, and run rehearsal conversations. Whatever that specific step actually needs — your selected statements, your onboarding context, the current conversation — is sent to OpenAI to produce the response. We send only what a given step needs, not your whole account history indiscriminately: for example, your desired identity is deliberately withheld from the call that reflects your current patterns back to you, because it isn’t evidence for that.

OpenAI doesn’t use this to train its models

By default, OpenAI does not use API requests like ours to train or improve its models — that only happens if a customer opts in, and we haven’t. Separately, OpenAI keeps a copy of API requests for a short time on its own systems (currently up to 30 days) for abuse and safety monitoring, the same as any API customer’s traffic under its standard terms. That’s a routine operational detail of using their API, not model training, and not something IdentityOS controls or can shorten.

Conversation history is stored for continuity

Rehearsal and other conversations are saved so you can pick up where you left off, and so the character you’re practicing with can respond to what you actually said rather than starting fresh every time. There is currently no way to delete a single conversation on its own — removing it means removing your account, which you can do at any time from your account page.

Other members can never see your data

Every table that holds your information is protected by database-level row security tied to your own signed-in account. Another member’s app session simply cannot query your rows — this isn’t a setting that could be toggled off by mistake in the product; it’s enforced by the database itself on every request.

Authorized backend operators can technically access stored data

IdentityOS runs on a hosted database (Supabase) and hosting platform (Vercel). The small number of people who operate IdentityOS and hold the credentials for those systems can, like any operator of a hosted service, technically access what’s stored there — this is true of the database directly, not just through IdentityOS’s own admin tools. We’re stating this plainly rather than implying otherwise: “private from other members” is a real, enforced guarantee; “private from everyone who could ever run the service” is not a claim any hosted product can honestly make.

Application logs don’t contain your content

IdentityOS’s own logs never record your statements, your reflection, your prompts, or your conversations — only operational details like which action happened, when, and whether it succeeded. This is a real architectural discipline in the code, not just a policy we’re describing after the fact.

Deleting your account, and what temporary copies may remain

Deleting your account (from your account page) removes your account and personal IdentityOS records from the live product — we’ve verified this directly, table by table, on a real account. It doesn’t reach every copy that may have briefly existed elsewhere first. Our database provider keeps rolling daily backups for 7 days, so a backup made shortly before you delete could still contain your information until that backup ages out on its own. And as noted above, OpenAI may hold a short-lived copy of what was sent to it (up to 30 days) under its standard API terms. Neither of those is IdentityOS actively using your data after deletion — they’re temporary provider-side copies expiring on a schedule we don’t control, not something we read, query, or keep working with.

Our hosting provider (Vercel) keeps request/operational logs for about the last hour on our current plan, and we don’t forward them anywhere for longer-term storage. As stated above, those logs never contain your statements, reflections, or conversations — only operational details like which action happened and when.