Privacy policy

The short version

• The audio of a call is not stored. It is turned into text as the person speaks, and the sound is discarded.
• Buddy remembers what it is told so the person never has to repeat themselves: names, interests, what is coming up, how they have been. The person can ask Buddy to forget something, and it does.
• Family see how the person is doing only with that person's recorded agreement. Safety alerts go out regardless, and the person is told so.
• Speech recognition, the language model and the voice run on servers we operate. Conversations are not sent to third-party AI providers.
• No voiceprints, no biometric identifiers, no advertising, no sale of data.
• Everything held about a person can be downloaded or permanently deleted from the family portal, and closing an account deletes it.

Who we are

GoodBuddy ("we", "us") provides the GoodBuddy service at goodbuddy.ai and app.goodbuddy.ai. We are the controller of the personal information described here. Our servers are in the United States, and your information is stored and processed there. You can reach us at [email protected].

This policy covers two kinds of people: the person who talks to Buddy ("the person"), and the family member or friend who sets GoodBuddy up and looks after the account ("the family account holder"). Where it matters, we say which one we mean.

What we collect

Account details

When a family account holder signs up, we keep their name, email address and the way they sign in. Sign-in is handled by Firebase Authentication, a Google service: with an email address and password, an emailed sign-in link, or a Google or Apple account. If you sign in with Google or Apple, we receive your name and email address from them and nothing else; we do not see your password for those services. We also keep a record of each sign-in (when, from what kind of device) so you can see where you are signed in and sign other devices out.

About the person

What the family account holder enters when setting up: the person's name, age or age group, how they like to be addressed, their interests, the people in their life, things to keep in mind (such as a health condition Buddy should be gentle about), the time of day they like to talk, and the two agreements described under "Who can see it". A phone or tablet linked to the person is recorded by a device identifier so that Buddy knows who is calling.

Calls

During a call, what the person says is turned into text on our servers so that Buddy can answer. The audio is used only for that and is discarded; it is never stored or listened to. We keep, for each call, when it happened, how long it lasted, a short summary written by Buddy, and how the person seemed. Whether the written words of a call (the transcript) are kept depends on the agreement the family recorded; see "How long we keep it".

What Buddy remembers

Buddy keeps a memory of the person so that each conversation can build on the last: facts the person shares, the people and pets they talk about, things that are coming up, how past calls went, what Buddy has asked and what was answered, and reminders the person asks for. Buddy is designed never to store a phone number, street address, email address, bank detail or password, even if one is said aloud.

How the person sounds

Buddy notices the tone of the person's voice (for example tired, cheerful, upset) and events like laughter or crying, so that it can respond with care and so that the family can be told when someone has sounded well below their usual for a while. This is a reading taken in the moment, like a friend noticing you sound low; it is not a recording and not a voiceprint, and it cannot be used to identify anyone.

Safety

If the person says something that suggests an emergency or that they may be at risk of harming themselves, we record that a safety event happened, what kind it was, and whom we told. The person's words are not stored for this; only the kind of event and the time.

The circle

When the person asks for help, or asks Buddy to send a message to their family, the family's phones are alerted. For an emergency alert we may send the approximate location of the person's device, if the device allows it, so that family know where they are. Messages between the person and their circle are kept so the family can see them.

Notifications and devices

If you turn on notifications (reminders to chat, alerts for family), we keep the push subscription your browser gives us so we can reach that device. We keep the time zone of each device so reminders arrive at the right local time.

Feedback and technical information

After a call the person may say how it went (Good or Not so good); we keep that answer. We keep technical measurements about calls, such as how long Buddy took to answer, to keep the service working well. Our server logs record what happened (kinds of events, identifiers, counts and timings), never what anyone said, what Buddy said, or what Buddy remembers.

How we use it

• To hold a conversation with the person and remember them from one call to the next.
• To let the family account holder set GoodBuddy up and, with the person's agreement, see how they are doing.
• To alert the family when the person asks for help or appears to be at risk.
• To send the reminders and notifications you have asked for.
• To keep the service secure, to prevent abuse, and to fix problems.
• To understand how well the service works, using measurements rather than conversations.

We do not use what anyone says to Buddy to train language models, we do not sell personal information, and we do not use it for advertising.

Where the law requires a legal basis: we process the person's information on the basis of the agreements the family records on their behalf and our legitimate interest in providing the companion they asked for; the family account holder's information on the basis of our contract with them; and safety alerts on the basis of the vital interests of the person.

Who can see it

The person can hear from Buddy what it remembers, ask it to forget something, and have reminders read back.

The family account holder sees the person's set-up, the list of calls, and what Buddy remembers, which they can correct or remove. Whether they also see how the person seemed and the summary of each call depends on an agreement the family records on the person's behalf: without it, the portal shows only when calls happened. A second agreement covers keeping written transcripts.

Safety alerts (an emergency, or signs the person may harm themselves) go to the family regardless of those agreements. The person is told this in the service, and Buddy says it is an AI at the start of every call.

Our team can access information only to run the service, investigate a problem you report, or meet a legal obligation. Our logs never contain conversation content.

Nobody else, except the service providers below and, if the law requires it, the authorities.

Services we rely on

Speech recognition, the language model, the voice and the reading of tone all run on servers we operate. The services below handle limited information for us:

• Firebase Authentication (Google) handles sign-in for family accounts: email address and password, emailed sign-in links, and sign-in with Google or Apple. Google's use of that information is described in Firebase's privacy information.
• Cloudflare carries our web traffic and protects our servers; it sees network information such as your IP address.
• An email delivery service sends sign-in links, alerts and the family's emails; it sees the recipient's address and the message.
• Twilio sends urgent alerts by text message to contacts who have given a phone number, where texts are switched on.
• Browser push services (Apple, Google, Mozilla) deliver notifications to your devices; the message is encrypted to your device and the service sees only that a notification was sent.
• Google Fonts serves the typeface on this website; your browser requests it from Google.

GoodBuddy is free of charge; no payment card is collected. If we ever introduce a subscription, payments would be handled by a payment provider and this page would say so first.

Our use of information received from Google accounts complies with the Google API Services User Data Policy, including its Limited Use requirements. We use it only to create and sign in to your GoodBuddy account.

How long we keep it

• Call audio: not kept at all.
• Transcripts: if the family recorded the person's agreement to keep written transcripts, the words of each call are kept for 90 days and then erased; without that agreement, the words are used once, to let Buddy remember, and are not kept.
• Call summaries, how the person seemed, and what Buddy remembers: kept while the person is set up on GoodBuddy, so that Buddy keeps knowing them, unless you delete them sooner.
• Safety events and circle messages: kept while the account is open, so family can see what happened.
• Account details and sign-ins: kept while the account is open; sign-in records expire on their own.
• Server logs: a short period, for security and fixing problems; they contain no conversation content.

When a person is removed from GoodBuddy, or an account is closed, everything held about them is deleted, apart from the minimum we may be required to keep by law.

Your choices and rights

• See and download everything held about a person from the family portal.
• Correct or remove individual memories, people and reminders in the portal, or by asking Buddy to forget something.
• Delete a person, or close the whole account, from the portal. Deletion is permanent.
• Change the agreements about sharing and transcripts at any time in the portal.
• Turn notifications off on any device, and remove a device from the person's set-up.
• Sign out everywhere from the account page.

Depending on where you live, you may also have rights to access, correct, delete, restrict or object to our use of your information, to take it with you, and to complain to a data protection authority. Write to [email protected] and we will answer within thirty days. If someone asks on behalf of the person who talks to Buddy, we may ask for enough information to be sure they are entitled to.

Children

GoodBuddy is for adults. We do not knowingly set up or talk to anyone under 18. If you believe a child's information has reached us, tell us and we will delete it.

Security

Connections to GoodBuddy are encrypted. Sign-in tokens are stored only as hashes, sign-in attempts are rate-limited, and access to our servers is limited to the people who run them. No system is perfectly secure; if we learn of a breach affecting your information, we will tell you and the authorities as the law requires.

Changes to this policy

When we change this page we update the date at the top. If a change affects what we collect or who can see it, we will tell family account holders by email before it takes effect.