Privacy Policy

What we collect

Account

You sign in with Google, Facebook, or Apple. From the provider we receive your name, email address, and the provider’s user ID for you. We never see your password. If you use Sign in with Apple and choose Hide My Email, we receive Apple’s private relay address and treat it as your email; that works fine with every feature.

We keep a record of what you agreed to and when, so you can read it back in Settings.

Mailing list

You join our mailing list only if you choose to: by switching on “New features and special offers” in Settings, or by confirming your email through the subscribe form on the website. We then write to you about new features, ways to get more from Excalibur, and special offers. Every email has an unsubscribe link, and unsubscribing has no effect on your account.

What you put into Excalibur

This is the substance of the app and we store it so it can be there when you come back: your chat messages and the replies you receive, your quests, tasks, habits and goals, your mood check-ins, and the Codex (the structured record the app builds from your conversations). If you connect with friends inside the app, they can see your display name and avatar, and whatever you choose to share with them.

Voice

When you speak to Excalibur, your microphone audio is sent to a speech-to-text service for transcription, either live while you talk or as a short recording when you finish. We keep the resulting text as a chat message. We do not store the audio. When Excalibur speaks a reply aloud, the text of that reply is sent to a voice service, which turns it into speech.

Photos and files

Only when you attach them. An attached image or document is stored so the conversation it belongs to keeps working, and is deleted with your account. An attached audio file is transcribed by the same speech-to-text service, and only the transcript is kept. The app does not scan your camera roll or file system.

Apps you connect

Only if you connect one, in Settings under Connections, such as Krisp for your meetings. You sign in to the app and choose to let Excalibur read from it; we keep that sign-in, locked so only our server can use it. When a conversation needs it, your coach reads from the app, and what it reads goes to our AI model providers with that request. We do not store what it reads, beyond your chat itself. Disconnecting deletes the sign-in.

If you connect Gmail, the AI tools you connect to Excalibur can search and read your email through it, and save drafts in your Drafts folder; what they read goes to them. Excalibur sends a draft only when you approve it, and never changes or deletes your email. What Excalibur receives from Gmail is used only to give you these features: it is never sold, never used for advertising, and never used to train AI models, ours or anyone else’s. People on our team read it only with your permission, to keep the service secure, or where the law requires it. Excalibur’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Push notifications

If you opt in, your device gives us a push token so we can send notifications. Turning notifications off in your device settings makes that token useless to us; deleting your account removes it.

Purchases

Subscriptions are billed by Apple or Google. We receive your entitlement state (what you are subscribed to and until when) plus the store’s anonymous transaction identifiers. We never receive or store card numbers.

Usage and technical data

We record which features you use, whether you are on the app or the website, and how long you are active, in our own database, so we can see what works and fix what breaks. There is no third-party analytics or crash-reporting SDK in the app. Our servers keep ordinary request logs (IP address, timestamp, path) for a short time for security and debugging.

How you found us

On your first visit to the website we note which link brought you: the campaign tags on the link, the site you came from, and the page you landed on. The note is kept in a cookie in your browser and holds nothing that identifies you. If you then create an account, we keep it with your account so we can see which of our posts reach people, and the cookie is removed. In the EU, the EEA and the UK we ask first, and if you say no, nothing is noted.

How we use it

• To run the service: answer you, remember what you said, keep your quests and habits in sync across devices.
• To build and update your Codex from your conversations. This is the point of the product.
• To send you notifications you asked for, and account or billing email that is necessary to operate the service.
• To email you about Excalibur through our mailing list. You can unsubscribe from any email.
• To diagnose failures and improve the product, using our own usage records and, where necessary, individual AI calls (see retention below). People on our team read your chats and your Codex only if you turn on Help improve Excalibur, and you can turn it off in Settings at any time.
• To enforce our Terms and comply with law.

Some of what you tell Excalibur is sensitive: your health, your relationships, what you believe. We process it only with your consent, which you give when you start. The Codex is a separate choice: you can switch it off in Settings at any time, and chat keeps working. To withdraw your consent altogether, delete your account.

We do not sell your data. We do not use your conversations to train AI models, and our AI providers are contractually barred from doing so with data we send them.

Who processes your data

We use a small number of providers, each for one job. Each one only receives what its job needs.

• A database provider - authentication and our database. Everything you store in Excalibur lives here.
• AI model providers - generate replies and build your Codex. They receive the relevant parts of your conversation and Codex for each request. Some may keep a request for a short time to check for abuse; none trains on it.
• A speech-to-text service - turns your speech into text. Audio is processed, not stored.
• A voice service - turns Excalibur's replies into the voice you hear. It receives the text of each reply it speaks, and does not train on it.
• A network and storage provider - carries the traffic between you and our server, and stores documents you attach and documents the app generates for you. Images you attach are stored in our database.
• A hosting provider - runs our application server, in Finland.
• A background-jobs service - runs the jobs that build your Codex and prepare your briefings. Your conversations pass through it while a job runs.
• An email service - delivers account and service email to you, and runs our mailing list.
• A subscription service - tracks subscription entitlements between the app stores and us.
• A push notification service - delivers notifications to your device.
• Google, Facebook, Apple - sign-in, and for Apple and Google, billing.

Our database and AI providers are in the United States; our application server is in Finland. If you are in the EU or UK, your data is transferred to the United States under the providers’ standard contractual clauses.

What we do not do

• No advertising, and no ad networks.
• No third-party analytics, tracking pixels, or fingerprinting. Usage data goes to our own database and nowhere else.
• No location access. The app never asks for it.
• No contacts, calendar, or camera-roll access.
• No selling or renting of personal data, ever.

How long we keep it

• Your content (messages, quests, habits, goals, moods, Codex, attachments): for as long as your account exists. A Codex you switch off is deleted 30 days later, unless you switch it back on first.
• AI request logs: to debug the product we log each AI call. The full text of the request and reply is deleted after 30 days; the metadata (timing, token counts, which feature) after 90 days.
• Server request logs: a short rolling window, typically days.
• Billing records: entitlement history is kept as long as required for tax and accounting.

Deleting your account

You can delete your account from inside the app: open Settings and choose Delete Account. This is immediate and cannot be undone. It removes your profile, every message, quest, habit, goal, mood entry, your Codex, any attached files, and your push token. AI request logs already written expire on the schedule above. Deleted data can persist in encrypted database backups for a short period until those backups roll over.

Deleting your account does not cancel a subscription; manage that through your Apple or Google account (see the Terms). It also does not remove you from the mailing list; use the unsubscribe link in any email, or ask us. If you cannot access the app, email us from the address on your account and we will delete it for you.

Your rights

Wherever you live, you can ask us to show you the personal data we hold, correct it, export it, or delete it, and you can object to or restrict how we use it. Deletion is self-serve in the app; for anything else email [email protected] from the address on your account. We answer within 30 days. If you are in the EU or UK you also have the right to complain to your data protection authority.

Security

Data is encrypted in transit and at rest. Database access is restricted per user at the database layer, not just in application code. Our production servers accept SSH by key only, our container images are built in CI and never on the server, and secrets are never baked into an app build. No system is perfectly secure; if we discover a breach that affects you, we will tell you.

Children

Excalibur is for adults. You must be 18 or older to use it, and we do not knowingly collect data from anyone younger. If you believe someone under 18 has created an account, email us and we will delete it.

Changes

When this policy changes, we update the date at the top. If a change materially affects how we handle your data, we will tell you in the app or by email before it takes effect.

Contact

Divine Weapon Inc.
1111B S Governors Ave, Dover, DE 19904, United States
[email protected]