Our privacy commitments.

What we do with your conversations

When you upload an AI conversation export, here's the entire lifecycle, end to end:

1. The file goes to our server (TLS in transit, AES-256-GCM at rest in any staging area).
2. We run it through a redaction pass that strips API keys, secrets, OAuth tokens, and patterns that look like personal identifiers, before any model sees it.
3. We sample down to a small representative slice, at most around 90 KB of conversation snippets per user, that's what the rubric needs to score you.
4. We send that sampled slice to our scoring model (Anthropic's Claude, contractually configured to not retain or train on what we send) and write the resulting scores back to your account.
5. We discard the raw upload. We keep the sampled slice for 90 days so we can re-score it when the rubric improves; after that it auto-deletes. Your scores stay; the underlying text is gone.

What we never do

• ✗ We never train models on your conversations. Not our own models (we don't have any), not Anthropic's, not anyone else's. The contract with our scoring provider forbids it.
• ✗ We never sell your data. Not to advertisers, not to data brokers, not to recruiters paying for leads. We don't run cross-site behavioural ads and we don't carry third-party advertising trackers.
• ✗ We never share your conversation text with third parties beyond Anthropic. Anthropic processes the sampled slice as our scoring subprocessor. No other vendor, not our email provider, not our hosting provider, not our analytics, receives the text of your conversations.
• ✗ We never keep your raw upload longer than the analysis run. The full export is discarded as soon as we've extracted the sampled slice. The sampled slice itself caps at 90 days.
• ✗ We never quote your conversations verbatim back to anyone. Not to you on your dashboard, not on your public credential, not in coaching. Standout examples describe what the behaviour was, not what the work was about. The scoring model is explicitly forbidden from naming specific products, projects, employers, clients, or collaborators in any output.
• ✗ We never make a portfolio public without you publishing it. Your dashboard, your scores, your conversations, and any linked project verification data are private by default. A public credential page or a Growth Snapshot link only exists if you explicitly publish.

What we strip before analysis

Three layers run before your conversation reaches a model. They're best-effort, we're not promising perfect scrubbing of every conceivable secret pattern, but they reduce the sensitive-content surface dramatically:

• Layer 1: known-secret patterns. We match and replace API keys (OpenAI, Anthropic, AWS, GCP, GitHub, Stripe), JWTs, OAuth tokens, private SSH keys, and long random hex/base64 blobs that look like credentials.
• Layer 2: personal identifiers. We strip patterns that look like email addresses, phone numbers, and credit-card-shaped digit groups before the model sees the text.
• Layer 3: model-side guardrails. The scoring prompt explicitly forbids the model from surfacing specific product, project, employer, client, or collaborator names in any output it generates. Outputs are also length-bounded so the model can't echo back long stretches of your text.

We are honest that this is best-effort. If a secret is unusual enough or embedded oddly enough to slip past Layer 1 (e.g. a custom internal token format), it could reach the scoring model. The Anthropic contract still binds them to not retain or train on it, and the sampled slice still auto-deletes at 90 days, but the scrubber isn't a guarantee.

Who can see what

• You. Everything we have on you, every score, every snapshot, every coach conversation, every connected integration, is visible on your dashboard. We'll also send you a full JSON export on request (see "How to get your data out or delete it" below).
• VibeWorks employees. We are a small team (currently fewer than ten people). Engineers can read the production database for debugging and customer support. Every privileged read of a user's data writes a row to an admin audit log: who read it, when, what action, and against which account. We can produce that log on request.
• Anthropic (our scoring subprocessor). Anthropic processes the sampled, redacted slice of your conversations to compute your scores. They're contractually configured to not retain or train on what we send.
• Our transactional email vendor. Magic-link emails, password resets, and notifications are sent through an email delivery vendor. They see your email address and the body of the message they deliver. They never see your conversation content.
• Our upload staging storage. We use cloud object storage as a short-lived staging area for direct-to-storage uploads (so the browser can upload large files without round-tripping through our API). The staging file is encrypted at rest and discarded once the pipeline finishes.
• Our hosting and database provider. Our application servers and PostgreSQL database run on managed infrastructure. They have the operational access any infrastructure provider does. They don't read your application data in the normal course of operations.
• Anyone you share with. If you publish a public credential page or share a Growth Snapshot link, anyone with the URL can see the scores and evidence you chose to publish. Treat shared URLs as public.

How long we keep what

This table is the source of truth for our retention windows. It's checked against the actual code and database.

When we delete an account, the rows above are permanently removed from production within 30 days. Anonymous aggregate counts (e.g. total signups per week) may be retained beyond that. They don't identify the deleted account.

How to get your data out or delete it

Self-serve controls are on the roadmap. Today, email hello@fluencity.ai from your account address and we'll handle any of these within 7 business days:

• Download my data. A JSON export of your profile, scores, snapshots, coach conversations, and analytics events. If something you'd expect to be in the export is missing, tell us and we'll add it.
• Delete my conversation corpus. We purge the stored sampled corpus. Your scores stay; the underlying text is gone.
• Delete my project verification data. We remove processed corpus, evidence extractions, and computed project verification scores.
• Clear my coach history. We permanently delete every AI coach conversation and reset what your coach remembers about you.
• Disconnect an integration. We remove the stored OAuth or API token for that provider.
• Delete my whole account. Personal data, portfolio content, scores, conversations, and connected integration tokens are permanently removed from production within 30 days.

How to report a privacy concern

If you believe we've mishandled your data, broken a commitment on this page, or exposed something we shouldn't have:

• Privacy concerns → hello@fluencity.ai. We aim to respond within 2 business days.
• Security vulnerabilities → security@fluencity.ai. See our Security Policy for our disclosure process.
• A regulator told you to contact us → use the same address. Include the regulatory reference and we'll route it internally.

When this page changes

When we make a material change to anything on this page, what we do, what we never do, what we strip, who can see what, or how long we keep what, we update the "Last updated" date at the top, add a one-line entry to the changelog below, and, where the change is significant, notify users in-product or by email. Continued use of VibeWorks after a change means you accept it.

The source of truth is the file in our repo, so the changelog and the code can never silently drift apart.