Privacy

The file stays on your phone

Your phone opens the export and counts everything; the file is never uploaded. The AI that writes Finch's lines gets those counts plus up to 75 short quotes and a few of the lines each of you repeats most. Before they leave your phone, the names you saved become codes (M1, M2) and phone numbers, emails and links are removed. A nickname, a short form of a name, or a name written in the other alphabet can slip through. Group links are encrypted on your phone and the key stays in the link, so we can't open your show, unless we email you the link.

What leaves your phone to write the show

Counts (how many messages each member sent, at what hours, how fast they reply, and similar), up to about 75 short quotes, and up to three of each member's most repeated short messages (like "omw" or "ok"), with the names you saved replaced by codes (M1, M2) and phone numbers, emails and links removed. Also the language and dialect your group writes, and up to 12 of its most used everyday dialect words (for example Gulf Arabic, with "الحين" and "وش"), worked out on your phone, with the names you saved removed.

If Finch writes your show in Arabic, in Arabic letters or Arabizi, and you choose to say so, whether each member is "he" or "she", next to their code, so the grammar is right.

This goes to Anthropic, whose Claude models write Professor Finch's narration, under Anthropic's commercial API terms.

Finch's voice is recorded by ElevenLabs, who receive only the lines he speaks. In the free trailer he calls members by their species title. In the Director's Cut he says their names as the show displays them (usually first names), so those names reach ElevenLabs in his lines. Phone numbers and the chat file never do.

Your show

Your show is encrypted on your phone before it is stored. The key is only in the link, after the # sign, which browsers never send to our server, so we cannot read it. When we email you the link (after you buy the Director's Cut, or when you ask), it passes once through our server and we don't keep it. Our email provider (Brevo) delivers it, keeps a copy of the email for a while, and routes taps on the link through its own servers before your show opens.

Our server holds the encrypted show plus counts: the member count, which ranks claimed a card, guess scores, votes, appeals, paid status, the parent show id, and coarse events (country, OS, language, no content). Rate-limit records keep a hash of the IP for up to two days. A free show is deleted after 30 days, a show with the Director's Cut a year after payment (a gift, a year after it opens). Whoever made it can delete it at any time from its last page (in a show for two, either of you can: see below).

Your Tea is encrypted the same way and opens only with a secret kept in your browser.

Shows for two

A show for two is stored like a group show, with a few more things locked with the same key in the link: each partner's bets, each partner's appeal of the verdict with Finch's ruling, the Director's Cut for two, Finch's recording and any File one of you buys about the other. Next to them our server keeps, without names: that it is a show for two, which of you (M1 or M2) claimed a seat, placed bets, paid or bought a File, and when. Our event counts also note what you are to each other (partners, engaged, married, best friends, siblings or other).

What leaves your phone to write it also includes up to eight lines the two of you repeat most, cleaned like the quotes. The pet names and private words your phone finds stay on it: Finch writes around a placeholder and your phone fills it in. Other people's names your phone spots in quotes become “[a friend]”.

Either of you can delete the show at once from your own link, and the bets, the appeals, the cut, the recording and any File go with it. The delete works for anyone holding the link, so keep the link between you.

A gift keeps its opening time on our server, and whether it is sealed for both of you. Until it opens, the link shows the free trailer but not the Director's Cut; sealed for both, it shows only the countdown and a teaser (your first names, whether each of you is he or she, which of you gave it, your pair's species, the message count, the date of your first message, the opening time, the language, the wrapping and two hints Finch picked from your chat (a number, and one of your words or emoji, never a name), locked with the same key). Only the gifter's own phone can open it early. If the gifter switches on “Finch reads it aloud”, the note goes to our voice service (ElevenLabs) so he can say it, and his recording is stored locked with the show.

A File is written from counts the phone made from the chat when the show was made, never quotes, and opens only on the buyer's phone with a secret kept there. The other partner can see that a File about them has been opened, never what's inside.

The Director's Cut for two and the gift edition both ask for an email to send the link, and either of you can ask for the link by email from the free trailer too. That email carries the key and Brevo keeps a copy. Once it's sent, we unlink your address from the show.

Gift a screening to another couple (a voucher): your browser makes the code. Our server keeps only a one-way fingerprint of it, whether it is paid, its language and its dates (paid, expiry a year later, used), never the code, the name on the card or which show it opened, and deletes that 30 days after it is used, refunded or expired. The email you give at checkout goes to Stripe; we read it back from Stripe once to email you the code, so the code passes through our server that once, and Brevo delivers it and keeps a copy.

Remind us before our anniversary: if you ask, we keep your email address, your language, which anniversary and the day the reminder is due, with no show and no names, until the one email is sent, then we delete them. A reminder that can't be delivered is deleted 30 days after its date, and the link in the email deletes it at once. Brevo sends it.

Shows for couples are for people 18 and over.

Payments

Payments are handled by Stripe. We receive the amount, the currency and what it unlocks, never your card details. Stripe's record of the payment notes the show it unlocks (and, for a gift, its opening time), your language, the site that sent you and which Chatumentary link brought you. Stripe processes your payment details under its own privacy policy.

Email

When you buy the Director's Cut, we ask for your email so Finch can send you its link once you've paid. You can also ask Finch to email you a show's link. Either way, we keep your email address, the show it was for (after a purchase, only until its link is sent), your language and whether you ticked the box for news and offers. Without the tick, the address is deleted after 30 days. With it, we may email you Finch's news and offers until you unsubscribe with the link in any of them. Stripe gets your address with your payment and Brevo sends our emails. We never sell your address or share it with anyone else.

If Finch is resting and you ask us to tell you when he's back, we keep your email address, your language and which page you asked from until that one email is sent, and for 7 days at most. If something you paid for is waiting for him, we read your address back from Stripe to put it on that list and, if it is still undelivered 48 hours later, to tell you it was refunded.

What we count

To see whether Chatumentary works, we count events such as "a show was finished" or "a link was opened". Each one carries the country your connection comes from, the page language, whether your phone is an iPhone or Android, the app you opened the link inside (Instagram, TikTok and so on), the site that sent you, which Chatumentary link brought you, and a random test group (A or B) your browser keeps so we can compare two versions of a page. Some also carry the kind of show (a group, or a show for two and what the two are to each other), a choice you tapped from a fixed list, such as which way you bet, and, when you start a show, whether this browser made or opened a show before (a group, a show for two or both). No cookies, no names, no chat content and no advertising trackers.

At the end of a show we ask whether Finch sounded like your group. If you answer, we count the answer with your group's language (such as "Gulf Arabic"), never anything from your chat.

To stop abuse, rate limits keep a salted, hashed form of your IP address for up to two days. We also keep daily totals with no show and no IP in them, such as how many requests were refused.

Contact

Questions or requests: hello@chatumentary.com