Privacy & Data

Account and profile

Your name, email address and how you sign in (email, Google or Apple), plus what you tell us during onboarding and in your profile: age range or birthday, gender and pronouns, city, country and time zone, your goals and what you'd like support with, topics you'd rather avoid, and the kind of companion, relationship and tone you prefer. This is what lets your companions feel personal. You decide how much to share, and you can edit or remove it from your profile at any time.

Conversations and memories

Messages you exchange with your companions, the memories they keep about you (facts, preferences, events and feelings you've shared) and short summaries of long conversations, so they stay in context across sessions. Memories are stored encrypted with a key specific to your account, and you can see, edit and delete them from each companion's profile.

Activities

What you create in Bondi's activities — journal entries, habits and check-ins, language-learning and flashcard progress, the films, series and books you track, trips you plan, badges and streaks — is stored on our servers so it follows you across devices.

Usage and technical data

How you use Bondi — screens visited, features used, onboarding steps completed (including the age range and gender you picked) and whether you upgraded — along with your device or browser type, app version and time stamps. If you allow analytics, a random visitor ID connects your onboarding steps before you have an account. We also keep a technical log of each AI request (model, tokens and cost — never the content) and of whether our emails were delivered, bounced or reported as spam.

Essential storage

Bondi always stores what it needs to work: your sign-in token, your cookie choice, your language and theme, and — on sign-up and checkout pages — cookies set by Cloudflare Turnstile and Stripe for bot protection and payment security. These need no consent and are not used to track you.

Analytics — only with your consent

If you choose "Accept all", we use Google Analytics 4 and our own event log to understand which pages and features people use and where onboarding loses them. Google sets _ga cookies (kept for up to two years) and receives page views, sign-ups, tutorial completions and purchases — never your conversations. Choose "Essential only", or switch analytics off in Settings at any time, and nothing is sent. Google Analytics is never loaded inside the iOS and Android apps. We don't use advertising pixels or ad networks.

Cookieless metrics and error reports

Vercel, which hosts the web app, counts page views in aggregate without cookies or any identifier that could follow you across sites. Sentry receives technical error reports (what went wrong and where) so we can fix bugs.

Powering your companions

Your recent messages, memories and profile are combined into the instructions we send to the AI model, so replies are personal and in context. Bondi also uses AI automatically to pull memories out of conversations, summarise long chats and decide when a companion checks in with a proactive message (you can turn those off per companion). None of this makes decisions with legal or similarly significant effects on you.

No selling, no ads

We don't sell your data, we don't build advertising profiles, and there are no ads inside Bondi. We use your data to run and improve Bondi and, if you opted in, to email you about it.

AI processing

Your messages, memories and profile details are sent to third-party AI providers — Anthropic, OpenAI, Google and Groq — to generate companion responses and extract memories; some requests are processed in batches. Each provider's own terms govern the data they process for inference. We never sell your conversations or use them for advertising, and you can delete them at any time.

Service providers

We rely on providers who process data on our behalf: AI model providers (Anthropic, OpenAI, Google and Groq); Stripe for web payments, and Apple's App Store with RevenueCat for subscriptions bought in the iOS app; Resend for email; Google Firebase and Apple's push service for notifications; Vercel and Fly.io for hosting; Neon and Upstash for databases; Cloudflare for image storage, bot protection and email routing; Sentry for error monitoring; Google Analytics only with your consent; OpenWeatherMap for city-level weather in your companion's time zone; and OMDb for film and series search. Each is bound to use your data only to provide its service to us. Stripe and Apple handle payment details under their own privacy policies — we never see your full card number.

Email

We send service emails while you have an account — verification, receipts, subscription and account-deletion notices. Tips and check-in emails are only sent if you opted in at sign-up, and every one has an unsubscribe link. We record whether emails were delivered, bounced or reported as spam so our sending stays healthy.

Notifications

Push notifications are only sent if you enable them on your device or browser, and you can switch them off at any time in Settings or your device settings. To deliver them we store a push token for your device with Google Firebase or Apple's push service.

Access and export

See and edit what your companions remember from each companion's profile, edit your details in your profile, and download a copy of your data — profile, companions, conversations, memories and settings — as a file from Settings. Any single chat can also be exported from the chat menu.

Delete memory

You can clear a companion's memory at any time from their profile page. This removes all learned facts about you for that Bondi.

Delete your account

Delete your account from Settings at any time. Your account is disabled immediately: you're signed out on every device, a web subscription is cancelled, and scheduled emails stop. For 30 days the account can be recovered — sign back in and everything is restored. After 30 days it is permanently deleted, together with your conversations, memories, journal, activity data and uploads. If you subscribed through the App Store, cancel that subscription in your Apple ID settings — deleting your account does not cancel it.

What remains after deletion

Nothing that identifies you. For a limited time we keep technical logs that no longer link to your name or email: product-analytics events for up to 180 days, AI request logs (model, tokens and cost — no content) for up to 120 days, email delivery logs for up to 90 days, and internal audit entries about admin actions. Payment records stay with Stripe or Apple as their rules require, and copies in database backups expire automatically. Email privacy@bondi.life to have your data purged before the 30 days are up.

Account suspension

If your account is suspended (typically for breach of the Terms of Service), you cannot sign in or use chat, games, or activities. Your personal data is not modified or deleted by a suspension — it is preserved unchanged so the suspension can be reviewed and reversed if appropriate. Active sessions on every device are revoked at the moment of suspension.

Admin actions are logged

When our staff suspend, delete or restore an account, we record who took the action, when, the affected account and an optional reason in an internal audit log. The log is used for accountability — for example, to review your case if you appeal a suspension or deletion — and is kept separately from your account data, so an entry can outlive the account it refers to.

Data storage

Your data lives in encrypted databases, and memory items are additionally encrypted with a key specific to your account. Conversation data is kept for as long as your account is active, and for the 30-day recovery window after you delete it.

On your device

Your device keeps your sign-in token, your cookie choice, your language and theme, and a few interface preferences, such as which tips you've dismissed. Everything you'd expect to see on another device — chats, memories, progress, streaks — lives on our servers.

Data location

Your data is primarily stored and processed in the European Union. Some service providers — for example AI inference and payments — process limited data outside the EU, including the United States, under appropriate safeguards such as Standard Contractual Clauses.

Adults only

Bondi is for people aged 18 or over. We don't knowingly collect data from anyone younger, and if we learn that we have, we delete the account.