Privacy Policy · Link Council AI

In short: we keep your account, your conversations and the decisions you save, because that is the product. Answering a question means sending it to the AI providers behind your council — OpenAI, Anthropic, Google and xAI — which may process it in the United States and, under their terms for paying API customers, do not train their models on it. If you attach a document to a question, its text is kept with the conversation and sent to those providers too; the file itself is not kept. If you attach an image, a copy of it without its location or other details is kept and sent the same way. If you turn on Search for a question, its text goes to Tavily, a web search service, and the sources it finds are kept with the conversation and given to every model you asked. If you leave reminders on, we email you when a decision is due for review, saying only how many are due; if you turn them on in our app as well, Apple or Google delivers the same reminder to your phone. If you report an answer, we can read the conversation it is in, and may send that answer and its question to the provider whose model wrote it. Our iOS and Android apps tell you who receives your questions and ask you to agree before the first one is sent. On your phone they keep only what keeps you signed in, and what lets us reach the phone with reminders, in the phone's own secure storage; if you unlock them with your face or fingerprint, that check stays on your phone and we never see it. We set no advertising or analytics cookies, the apps carry no analytics or tracking, and we never sell your data. You can download a copy of your journal, delete your decisions and the conversations you can open, and delete your whole account yourself, in Settings; for your account details, or an older conversation the service no longer lists, ask us at any time.

1. Who is responsible for your data

The controller of the personal data processed through Link Council AI, within the meaning of Article 4(7) of the EU General Data Protection Regulation (GDPR), is:

The operator of this deployment has not published its name, postal address and contact email yet. Do not create an account here until it has.

Write to that address with any question about this policy or about your data. We have not appointed a data protection officer, because the GDPR does not require one for a service of this kind and size.

2. What this policy covers

This policy explains what personal data we process when you use the Link Council AI web application, the Link Council AI apps for iOS and Android, and the API behind them (together, "the service"): what we collect, why, on what legal basis, who receives it, how long we keep it, and which rights you have. It is information we owe you under Articles 13 and 14 GDPR — it is not something you are asked to consent to.

3. What we process, why, and for how long

Data	Why	Legal basis	Kept for
Account details — your email address, display name, and password, which is stored only as a salted one-way hash. If you use Google: your Google account identifier, name and verified email address. If you use Apple: your Apple account identifier, the name you choose to share and the verified email address Apple gives us — which may be a private relay address that forwards to yours.	To create your account, sign you in, and contact you about it — for example with a password-reset link.	Performance of our contract with you (Art. 6(1)(b) GDPR).	Until your account is erased.
Your acceptance of our terms — the version of the Terms of Service you accepted and the moment you accepted it.	To know which terms apply to your account, and to be able to show it.	Art. 6(1)(b) GDPR, and our legitimate interest in evidencing the contract (Art. 6(1)(f) GDPR).	Until your account is erased.
Your agreement in the app — that you agreed, on the screen our apps show before your first question, to your questions going to the AI providers (section 4), which version of this policy that screen linked to, and when you agreed.	So that the apps send nothing to the AI providers until you have been told who receives it, and do not ask again on every phone you sign in on.	Art. 6(1)(b) GDPR, and our legitimate interest in being able to show that you were told (Art. 6(1)(f) GDPR).	Until your account is erased.
Conversation content — the questions you ask, each model's answer, each model's structured position on your question (stance, self-reported confidence, key reasons and risks), the secretary's synthesis with what it says would change its recommendation, and the decisions you save to your journal, with the title and the date to review each one that you give it. The secretary's latest synthesis of each turn is kept with the turn as structured lines — the recommendation, what it rests on, the risks, the next actions and what would change it, each with the models it came from — whether or not you save it, so that it is still there if you leave before it is finished; asking the secretary again about the same turn replaces it.	This is the service itself: showing you your council's answers, keeping your history, and keeping your decision journal.	Art. 6(1)(b) GDPR.	Until you delete it — a decision from its page, a conversation with everything saved from it from the conversation's menu, or everything at once by deleting your account — or ask us to. A deletion is permanent and cannot be undone. The usage records below are kept, without any text; a deleted item can remain in our database backups until those backups are deleted in their normal rotation.
Your reviews of decisions — whether you followed a decision, how it turned out, the note you add, and when you recorded it.	To keep the outcome of each decision with it in your journal, and to count your reviews by outcome there for you. No model is asked to grade an outcome.	Art. 6(1)(b) GDPR.	As long as the decision they belong to: they are deleted with it, or when your account is erased.
Review reminders — whether you want reminder emails, the day we last sent you a reminder, by email or on your phone, and, for each decision, when we reminded you about it.	To remind you — by email, on your phone, or both — at most once a day, when decisions you saved are due for review, and to send you at most one reminder each time you schedule a review — setting or moving a decision's review date, or recording a review, schedules a new one. You can turn email reminders off in Settings, or with the link in every reminder email, which works without signing in, and reminders on a phone in the app's Settings on that phone.	Art. 6(1)(b) GDPR.	The setting until your account is erased; the reminder marks as long as the decision they belong to.
Phones you turn reminders on for — for each phone on which you turn on Reminders on this device in our app: a random identifier the app made for its installation on that phone, whether it is an iPhone or an Android phone, the push token Apple's or Google's notification service gave the app there, whether reminders are on, the version of the app, which of your sign-in sessions registered it, when it was registered and last changed, and when we last sent it a reminder.	To deliver your review reminders to that phone, and to list your phones in Settings on the website so you can remove one.	Art. 6(1)(b) GDPR.	Until you turn reminders off on that phone, remove it in Settings on the website, sign out of the app on it, or its sign-in session ends — after 90 days without use, or when your password is reset — or until Apple or Google tells us the token no longer works, or your account is erased. It is then deleted, not kept. A token is held for one account only: if someone else signs in on the phone and turns reminders on, it moves to their account.
Documents you attach — when you attach a document to a question, the text we read out of it, its file name, its type, its size and a SHA-256 fingerprint of the file. The file itself is read once, when you upload it, and then discarded: we do not keep it and cannot give it back to you. For an image you attach, we keep instead a copy we make of it — scaled down, and without the location, camera or other details the original file can carry — and a small preview of it to show you.	To give every model in your council the same material to answer from, and to show you which documents each question was sent with.	Art. 6(1)(b) GDPR.	Once sent with a question, as long as the conversation it belongs to: until you ask us to delete it, or your account is erased. A document you remove before sending is deleted at once. One you upload and never send becomes eligible for deletion once it is 24 hours old and is removed by our next clean-up, which runs every hour, so it normally goes within about 25 hours of being uploaded.
Web sources for a question — when you turn on Search for a question: whether the search ran, when, and the sources it found — each one's title, web address, publication date where given, and the excerpt of the page the search service returned. We never visit the pages ourselves.	To give every model you asked the same up-to-date material to answer from, and to show you which sources each answer could draw on.	Art. 6(1)(b) GDPR.	As long as the conversation the question belongs to: deleted with it, or when your account is erased.
Answers you report — which answer you reported, what as (offensive, harmful, inaccurate or other) and when, and what we did about it: sent it to the provider whose model wrote it, by email or through the provider's own reporting page, dismissed it, or could not send it.	To review what you reported: to read the conversation the answer is in, decide whether to send the answer and the question it answered to its provider, and send them (section 4); and to count, per model and month, how often answers are reported.	Our legitimate interest in reviewing the output you flag and having its provider correct it (Art. 6(1)(f) GDPR); you can object (section 9).	As long as the conversation the answer belongs to: deleted with it, or when your account is erased. We can read the conversation for as long as it exists.
Usage records — for each call to an AI model: the provider, the model, the number of tokens, the cost, whether it succeeded, when it happened, which conversation it belonged to and which account made it; and the same for each web search request, without tokens. They contain no text from your conversations, so they stay when you delete a conversation: they are our record of what the service cost to run.	To control what the service costs to run, plan capacity, and decide things such as which models to offer by default.	Our legitimate interest in running the service economically (Art. 6(1)(f) GDPR).	While your account exists. When it is deleted, the records stay with the link to your account removed, so they can no longer be linked to you.
Sign-in sessions — when each session was issued and when it expires, when you signed in to start it, and which kind of client started it: the website, or our iOS or Android app. Each is stored against a one-way hash of its token rather than the token itself.	To keep you signed in on each of your devices separately, to recognize a stolen session token if someone tries to reuse it — which ends that device's session and no other, though sessions signed in before this version of the policy share one and end together — and to ask you to sign in again before something as final as deleting your account.	Art. 6(1)(b) GDPR, and our legitimate interest in security (Art. 6(1)(f) GDPR).	A session on the website lapses after 14 days without use, one in the app after 90; its record is kept until your account is erased.
Technical logs — IP address, time, request and trace identifiers, your account identifier when you are signed in, the platform and version of our app when a request comes from it, which operation ran and how long it took, errors, and the token count and cost of each AI call. Logs record what happened rather than what you wrote: they never contain your questions, the names or text of your documents, the secretary's syntheses, the titles of your decisions, what would change them, the notes in your reviews or what you search your journal for — a search is logged only as a request and how long it took — and the only content that can reach them is a short excerpt of a model's reply — at most 60 characters — kept when the reply arrives malformed and the fault has to be diagnosed.	To keep the service secure, prevent abuse (for example by rate-limiting requests), find and fix faults, and measure cost.	Our legitimate interest in a secure, working service (Art. 6(1)(f) GDPR).	14 days, then deleted automatically.

We do not use your data for advertising, we do not build profiles of you, and we do not sell your personal data or share it with data brokers.

4. How your questions reach the AI models

Link Council AI does not run its own language models. When you put a question to your council, we send it to each model you seated, at that model's own provider:

OpenAI — privacy policy
Anthropic — privacy policy
Google, for Gemini models — privacy policy and Gemini API terms
xAI, for Grok models — privacy policy and enterprise terms

In our iOS and Android apps, before your first question, a screen names these four providers and says what is sent to them, with a link to this policy. Nothing you ask from the app is sent until you press Agree there; we record that you agreed (section 3), so the apps ask once for your account.

What each model receives

Your new question, the earlier questions in the same conversation, and that model's own earlier answers in it. A model never receives another model's answers — the council's opinions stay independent.
The text of every document you have attached in the conversation, with each document's file name, ahead of your question — every model that is asked receives the same text, and it is sent again with each later question it is asked in that conversation. A question you address to one model with an @mention goes to that model alone, and so do the documents. Documents are not sent with the calls that restate a model's position or write the secretary's synthesis. The file itself is never sent, only the text read from it.
Every image you have attached in the conversation, with its file name, in the same way: every model that is asked receives the same image, again with each later question, and never with the calls that restate a position or write the synthesis. What is sent is our scaled-down copy, without the location, camera or other details the original file can carry.
When you turn on Search for a question, the sources the search found (below) — the same sources to every model asked, with that question only. They are not sent again with later questions, nor with the calls that restate a position or write the synthesis.
When you ask for a synthesis with @secretary, each model is shown its own answer again and asked to restate its position in a fixed format. Those positions — not the full answers — are then sent to one of the two models, which acts as secretary.

What they do not receive

We do not send your name, email address, password or other account details to any provider. What you type into a conversation is sent as you wrote it, apart from the leading @mention that routes a follow-up, which is stripped before the call. Please do not include information you would not want a third party to process: health data or other special categories of data, other people's personal data, passwords, or confidential information you are not permitted to share. The same goes for any document you attach: everything in its text is sent as written. And for any image: everything it shows is sent, faces and any text in it included.

When you turn on Search

The Search control beside your question is off for every new question. If you turn it on, before any model is asked we send the text of that question — without a leading @mention, and never your documents, images, earlier questions or any model's answers — to Tavily, a web search service (privacy policy), and receive back a few results: each page's title, address and an excerpt of it. We do not send your name, email address or any account details, and we never fetch the pages ourselves. Every model you asked is given the same results with your question, and the results are kept with the conversation (section 3). If the search cannot run, the models answer without it and the conversation says so. Please do not turn on Search for a question you would not want a search service to see.

When you report an answer

Reporting an answer lets a person on our side review it, so it opens the conversation the answer is in to us: your questions, every model's answers, the secretary's syntheses and how many documents and images you attached — never their names, text or pictures, and never your name or email address. Every time we read a reported conversation is recorded. We then decide whether to send the answer and the question it answered to the provider whose model wrote it: by email, with the model, the provider's own reference for the answer and the time, to the address the provider publishes for reports of its models' output, or through the provider's own reporting page. We send nothing else: not your name or email address, not any document or image you attached, not the other models' answers and not the rest of the conversation. We can read the conversation for as long as it exists; deleting it, or your account, ends that. If you would rather we did not read a conversation, do not report an answer in it. The provider handles a report under its own terms and privacy policy.

What the providers do with it

Each provider processes your conversation content on our behalf, as a processor under data-processing terms (Art. 28 GDPR). Under their current terms for paying API customers, none of them uses API inputs or outputs to train its models; we use Google's Gemini API as a paying customer, and xAI does not train on API inputs or outputs without permission, which we do not give. Each may keep them for a limited period to detect abuse — generally no more than 30 days at OpenAI, Anthropic and xAI, and the period Google's Gemini API terms set — or for longer where the law requires it or where content has been flagged as violating its usage policies. All four may process data in the United States; see section 6.

No automated decisions about you

The council's answers, confidence figures and recommendations are generated automatically, but they are information for you to weigh. We make no decision about you based solely on automated processing within the meaning of Article 22 GDPR.

5. Who else receives your data

Our hosting provider, which runs the servers and the database the service uses, acting as our processor.
Our email delivery provider, which sends our emails on our behalf — confirming your address, sign-in links, password resets and review reminders — and receives your email address and the message. A review reminder says how many decisions are due for review and links to your journal; it never contains a decision's title, recommendation or question.
Google, if you choose to sign up or sign in with Google. Google authenticates you and tells us your account identifier, name and verified email address. Google handles the sign-in itself as an independent controller, under its own privacy policy. This is separate from Google's role as the provider of Gemini models (section 4), which receives no account details.
Apple, if you choose to sign up or sign in with Apple, on an iPhone, on Android or on the web. Apple authenticates you and tells us your account identifier, the name you choose to share and a verified email address — your own, or a private relay address that Apple forwards to it. Apple handles the sign-in itself as an independent controller, under its own privacy policy.
Apple's Push Notification service and Google's Firebase Cloud Messaging, if you turn on reminders in our app: Apple's for an iPhone, Google's for an Android phone. They deliver the reminder to your phone on our behalf, as our processors (Art. 28 GDPR), and receive the phone's push token and the notification itself — how many decisions are due for review, a fixed line inviting you to look back on them, and the page of the app it opens. A notification never contains a decision's title, recommendation or question, nor your name or email address. On Android, the Firebase Cloud Messaging library in the app obtains the token from Google once you turn reminders on, and not before; it is the only part of Firebase the app contains.
Tavily, a web search service, if you turn on Search for a question: it receives that question's text and returns search results, as our processor (Art. 28 GDPR), as section 4 describes. It receives no account details.
Apple and Google as app stores, if you install our app from the App Store, TestFlight, Google Play or Play's testing tracks. They handle your download, and any crash and diagnostic reports you let your phone share, as independent controllers under their own terms and privacy policies. We receive none of your account details from them, and send them nothing from your conversations.
The provider whose model wrote an answer you report, if we decide to send it — the answer and the question it answered, as section 4 describes. The provider handles it under its own terms and privacy policy.
Authorities and courts, only where we are legally obliged to disclose data, or where it is necessary to establish, exercise or defend legal claims.

6. Transfers outside the EU and EEA

OpenAI, Anthropic, Google and xAI are based in the United States and may process data there, and our hosting and email providers may do so as well, as may Apple and Google when they deliver reminders to your phone, and Tavily when it searches for a question. Where a recipient is certified under the EU–U.S. Data Privacy Framework, the transfer relies on the European Commission's adequacy decision for it (Art. 45 GDPR). Otherwise it relies on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR), with additional safeguards where they are needed. You can ask us for a copy of the safeguards that apply.

7. Cookies, and what our apps keep on your phone

On the website, we only use cookies the service needs in order to work, and two that remember a choice you made in it — your theme and whether you collapsed the sidebar — set only when you make that choice. They are strictly necessary within the meaning of Article 5(3) of the ePrivacy Directive, for a service you asked for, which is why we do not ask for your consent to them. We use no analytics, advertising or social-media cookies and no tracking pixels, and our sign-in and sign-up pages load nothing from third parties.

Cookie	Purpose	Lasts
`council.auth`	Keeps you signed in to the web app.	Until you close your browser — or, if you choose "Keep me signed in", until your session lapses after 14 days without use.
`.AspNetCore.Antiforgery.*`	Protects our forms against cross-site request forgery.	Until you close your browser.
`.AspNetCore.Identity.External`, `.AspNetCore.Identity.Application`	Set by our API while it completes a sign-in with Google or Apple.	Until you close your browser; the first is removed as soon as the sign-in completes.
`lc-theme`	Remembers the theme you chose in Settings (dark, or following your device), so pages open in it. Not set while you use the default light theme.	One year, or until you choose light again.
`lc-sidebar-collapsed`	Remembers that you collapsed the sidebar to its strip of icons, so pages open with it collapsed. Not set while the sidebar is open.	One year, or until you expand the sidebar again.

In the iOS and Android apps

The apps keep on your phone only what they need in order to work, which is why we do not ask for your consent to it either. Your conversations, decisions and documents are not stored on the phone: the app fetches them from our servers as you open them and holds them in memory only while it runs. What the app does keep is this:

Your sign-in. The session's long-lived token, and a second token that lets the app end the session, are kept in the phone's secure storage: on an iPhone in the Keychain, for this device only, so they are never copied to iCloud or another device; on Android in the app's encrypted storage, which is left out of the phone's backups. The short-lived token each request carries is held in memory only. Signing out removes them, and a later installation of the app clears any an earlier one left behind. If the phone is offline when you sign out, the app keeps the token that ends the session and sends it to us the next time it can.
Reminders on this device, if you turn them on: the random identifier the app made for its installation, and the push token and app version it last registered with us, in the same secure storage as your sign-in and likewise never in a backup, so a phone restored from one starts with reminders off. Turning reminders off, or signing out, removes the token and the version; the identifier stays, and says nothing about you or when the app was installed. Whether the phone may show notifications at all is your phone's own setting.
Two settings: the theme you chose, and whether unlocking with your face or fingerprint is on — and a mark that the app has been installed, so that it can tell a first start.
A file you share, for a moment. When you share a decision or your data export through the phone's share sheet, the app writes that one file and deletes it once the sheet closes. When you attach a document, Android hands the app a copy of it, which the app deletes as soon as it has been uploaded or refused.

The app shows your name to greet you, read from your sign-in each time; it does not store it.

Unlocking with your face or fingerprint is off until you turn it on in the app's Settings. While it is on, your sign-in is locked with a key that the phone's secure key store releases only once Face ID, Touch ID or Android's fingerprint or face unlock has recognized you. That check happens in your phone's operating system: the app learns only whether it succeeded, and neither the app nor we ever receive your fingerprint, your face or anything derived from them. If a fingerprint or face is added to the phone, the app's key stops working and you sign in again. While it is on, the app also hides its screen in the phone's list of open apps.

Signing in with Google, and with Apple on Android, opens a private session of your phone's own browser, which keeps nothing once the sign-in is done; on an iPhone, Sign in with Apple uses Apple's own sign-in sheet. The apps contain no analytics, advertising, crash-reporting or tracking software and read no advertising identifier. If you have let your phone share crash and diagnostic reports with app developers, Apple or Google may pass us reports of where our app failed, under their own terms; you can turn that off in your phone's settings.

8. How we protect your data

Passwords are stored only as salted, iterated one-way hashes, never in readable form.
Session tokens are stored only as hashes, so a copy of our database cannot be used to sign in as you.
Each device you sign in on has a session of its own: signing out, or a stolen token being reused, ends that device's session only, while resetting your password or having your account disabled ends all of them. Sessions signed in before this version of the policy share one and end together, as all sessions did before.
All traffic is encrypted in transit, and browsers are told to connect over HTTPS only.
In our apps, your sign-in is kept in the phone's secure storage and the short-lived token only in memory, as section 7 describes, and signing in with Google or Apple happens in your phone's browser or Apple's own sheet, never inside the app.
A phone's push token is never shown on a page, put in your data export or written to our logs, and a reminder on your phone says only how many decisions are due.
Repeated failed sign-ins lock an account for a few minutes, and password-reset requests are rate-limited.
Operational logs can be read only by people we have authorized to maintain the service.

No system is perfectly secure. If a personal data breach is likely to result in a high risk to your rights and freedoms, we will tell you without undue delay (Art. 34 GDPR).

9. Your rights

Under the GDPR you have the right to:

Access your personal data and receive a copy of it (Art. 15).
Rectification of data that is inaccurate or incomplete (Art. 16).
Erasure of your data, including your whole account (Art. 17). You can delete your account yourself at any time in Settings → Delete account; see below.
Restriction of processing, for example while the accuracy of data is contested (Art. 18).
Data portability — your account details and conversation content in a structured, machine-readable format (Art. 20). You can do this yourself at any time: Export my data in Settings downloads every decision and conversation you hold, your reviews, the text of your documents, the web sources found for your questions and the phones you turned reminders on for, as Markdown and JSON, and any saved decision can be copied or downloaded from its page. Your account details are not in that download; ask us for them.
Lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live, where you work, or where you believe the infringement took place (Art. 77).

Right to object (Art. 21 GDPR). Where we process your data on the basis of our legitimate interests, you may object at any time on grounds relating to your particular situation. We will then stop, unless we can demonstrate compelling legitimate grounds that override your interests, or need the data to establish, exercise or defend legal claims.

Some of these you can exercise yourself in the service: download a copy of your journal from Settings, delete any decision, delete a conversation you can open — one of your ten most recent, or one a saved decision came from — turn review reminders off, by email or on a phone, remove a phone from reminders, and delete your whole account.

Deleting your account asks for your password, or, if you sign in only with Google or Apple, for a sign-in within the last few minutes. It then deletes, in one step and for good, your account and every way into it, the sessions on all your devices, the phones registered for reminders, and every conversation, synthesis, position, decision, review and document you hold. If you signed in with Apple, we also tell Apple to disconnect your Apple ID from the service, within about an hour; this needs no more from you. What stays is what names no one: the usage records above, with the link to your account removed, and a count that an account was deleted, with its date and no email address, name or account identifier. Deleted data can remain in our database backups until those backups are deleted in their normal rotation. An account that administers the service cannot delete itself: another administrator first removes its administrator role, and its owner can then delete it in Settings.

For anything else — an older conversation the service no longer lists, or your account details — email the operator's contact address, and we handle the request by hand. We reply within one month; for complex requests that period can be extended by two further months, in which case we tell you why within the first month (Art. 12(3) GDPR). Exercising your rights is free. We may ask you to confirm a request from the email address of your account, so that we only ever hand your data to you.

10. Do you have to give us your data?

To create an account we need an email address and a password, or a Google or Apple account; without them we cannot provide the service. Everything you type into a conversation is up to you.

11. Children

The service is not directed at children. You must be at least 18 years old to create an account, and we do not knowingly process data about anyone younger. If you believe a child has created an account, tell us and we will delete it.

12. Changes to this policy

We will update this policy when the service or the law changes. Every version carries the version date shown at the top of this page. If a change materially affects how we use your data, we will tell you before it takes effect, by email or in the service.