Privacy Policy

What we collect

Account

You sign in with Google, Facebook, or Apple. From the provider we receive your name, email address, and the provider’s user ID for you. We never see your password. If you use Sign in with Apple and choose Hide My Email, we receive Apple’s private relay address and treat it as your email; that works fine with every feature.

Mailing list

When you create an account, your name and email address are added to our mailing list so we can write to you about Excalibur. The subscribe form on the website does the same with the email you enter there. Every email we send has an unsubscribe link, and unsubscribing has no effect on your account.

What you put into Excalibur

This is the substance of the app and we store it so it can be there when you come back: your chat messages and the replies you receive, your quests, tasks, habits and goals, your mood check-ins, and the Codex (the structured record the app builds from your conversations). If you connect with friends inside the app, they can see your display name and avatar, and whatever you choose to share with them.

Voice

When you speak to Excalibur, your microphone audio is sent to Deepgram for transcription, either live while you talk or as a short recording when you finish. We keep the resulting text as a chat message. We do not store the audio.

Photos and files

Only when you attach them. An attached image or document is stored so the conversation it belongs to keeps working, and is deleted with your account. An attached audio file is transcribed by Deepgram and only the transcript is kept. The app does not scan your camera roll or file system.

Push notifications

If you opt in, your device gives us a push token so we can send notifications. Turning notifications off in your device settings makes that token useless to us; deleting your account removes it.

Purchases

Subscriptions are billed by Apple or Google. We receive your entitlement state (what you are subscribed to and until when) plus the store’s anonymous transaction identifiers. We never receive or store card numbers.

Usage and technical data

We record which features you use, whether you are on the app or the website, and how long you are active, in our own database, so we can see what works and fix what breaks. There is no third-party analytics or crash-reporting SDK in the app. Our servers keep ordinary request logs (IP address, timestamp, path) for a short time for security and debugging.

How we use it

• To run the service: answer you, remember what you said, keep your quests and habits in sync across devices.
• To build and update your Codex from your conversations. This is the point of the product.
• To send you notifications you asked for, and account or billing email that is necessary to operate the service.
• To email you about Excalibur through our mailing list. You can unsubscribe from any email.
• To diagnose failures and improve the product, using our own usage records and, where necessary, individual AI calls (see retention below).
• To enforce our Terms and comply with law.

We do not sell your data. We do not use your conversations to train AI models, and our AI providers are contractually barred from doing so with data we send them.

Who processes your data

We use a small number of providers, each for one job. Each one only receives what its job needs.

• Supabase - authentication and our database. Everything you store in Excalibur lives here.
• Anthropic and Google - the AI models that generate replies and build your Codex. They receive the relevant parts of your conversation and Codex for each request.
• Deepgram - turns your speech into text, and text into the voice you hear. Audio is processed, not stored.
• Cloudflare R2 - stores documents you attach and documents the app generates for you. Images you attach are stored in our database.
• Resend - delivers account and service email to you.
• Kit (ConvertKit) - runs our mailing list. Receives your name and email address when you create an account or subscribe on the website.
• RevenueCat - tracks subscription entitlements between the app stores and us.
• Firebase Cloud Messaging (Google) - delivers push notifications to your device.
• Google, Facebook, Apple - sign-in, and for Apple and Google, billing.

Our database and the providers above are in the United States; our application server is in Finland. If you are in the EU or UK, your data is transferred to the United States under the providers’ standard contractual clauses.

What we do not do

• No advertising, and no ad networks.
• No third-party analytics, tracking pixels, or fingerprinting. Usage data goes to our own database and nowhere else.
• No location access. The app never asks for it.
• No contacts, calendar, or camera-roll access.
• No selling or renting of personal data, ever.

How long we keep it

• Your content (messages, quests, habits, goals, moods, Codex, attachments): for as long as your account exists.
• AI request logs: to debug the product we log each AI call. The full text of the request and reply is deleted after 30 days; the metadata (timing, token counts, which feature) after 90 days.
• Server request logs: a short rolling window, typically days.
• Billing records: entitlement history is kept as long as required for tax and accounting.

Deleting your account

You can delete your account from inside the app: open Settings and choose Delete Account. This is immediate and cannot be undone. It removes your profile, every message, quest, habit, goal, mood entry, your Codex, any attached files, and your push token. AI request logs already written expire on the schedule above. Deleted data can persist in encrypted database backups for a short period until those backups roll over.

Deleting your account does not cancel a subscription; manage that through your Apple or Google account (see the Terms). It also does not remove you from the mailing list; use the unsubscribe link in any email, or ask us. If you cannot access the app, email us from the address on your account and we will delete it for you.

Your rights

Wherever you live, you can ask us to show you the personal data we hold, correct it, export it, or delete it, and you can object to or restrict how we use it. Deletion is self-serve in the app; for anything else email [email protected] from the address on your account. We answer within 30 days. If you are in the EU or UK you also have the right to complain to your data protection authority.

Security

Data is encrypted in transit and at rest. Database access is restricted per user at the database layer, not just in application code. Our production servers accept SSH by key only, our container images are built in CI and never on the server, and secrets are never baked into an app build. No system is perfectly secure; if we discover a breach that affects you, we will tell you.

Children

Excalibur is not for children under 13, and we do not knowingly collect data from them. If you believe a child has created an account, email us and we will delete it.

Changes

When this policy changes, we update the date at the top. If a change materially affects how we handle your data, we will tell you in the app or by email before it takes effect.

Contact

Divine Weapon Inc.
1111B S Governors Ave, Dover, DE 19904, United States
[email protected]