Privacy and safety

• Your conversations, facts, promises and questions are stored in Nirvaana's database. They are not deleted when a conversation ends, which is the point.
• The app reads them as you. The rule is enforced in the database, not in the app's code, so a bug in a page cannot leak somebody else's rows.
• Nirvaana asks Anthropic's models to write its replies, so the words in your conversation go to a model to be answered. That is how it works, and it is worth knowing.
• Only addresses on the list can sign in at all. An invite code puts one address on the list, the one typed with it. Take an address off the list and that account stops working on its next page load.

• A private fact cannot be moved into a shared world behind your back. Sharing needs your yes, and the card asks you before it happens.
• What Nirvaana keeps about you is never repeated to another user, never proposed to a group on its own, and never used as leverage.
• Nirvaana never asks you for secrets. It does not want your passwords, and it should never draw something out of you that you did not choose to say.

We record that things happened, never what was in them. An event carries an identifier, a type and an outcome. It cannot carry a sentence: anything longer than a short code word is dropped before it is sent, and email addresses are dropped too.

Screen recording is on for the app, with every piece of text and every input box blacked out. We can see that a button was pressed. We cannot read what you wrote.

Every reply takes real work to run. So there are hard limits, checked before anything runs, not after:

• A limit on how much one account can use in a day, and in a calendar month.
• A limit across everybody, per day, so one problem cannot drain the whole thing.
• A limit on one answer: how long it can run, and how many steps it can take.
• A limit on how fast you can send messages, and on how long one message can be.
• A switch that stops all of it at once, if something is going wrong.

You will know a cap was reached because Nirvaana tells you plainly:

• “I've done a lot with you today. Let's pick this up tomorrow.” — your day's limit.
• “I've used this month's time. I'll be back at it on the 1st.” — your month's limit.
• “Nirvaana is resting.” — everything is paused for now. Nothing is lost.
• “One moment. Let's take that a little slower.” — too many messages too fast. Wait a few seconds.
• “That's more than I can read at once. Could you send it in smaller pieces?” — the message was too long. Break it up.

The messages never quote a number, on purpose. Pacing it is our job, not something you should have to ration yourself against.

Nirvaana cannot send, post, pay, sign or delete anything today. When it can, it will ask first and wait for you to say yes in that same conversation, and your yes will cover only the thing it asked about.

It will not get around anyone's lock. If a door is yours to open, it asks you to open it. If a door is somebody else's, it stops and says exactly where it stopped.

It is not meant to be your only person to talk to. When somebody you know has already solved the thing, it should say so and suggest you call them. If you are carrying something heavy, it will be warm about it and point you toward real people and real help. If you or someone else may be hurt, it names real help first: emergency services, a crisis line, a doctor, someone nearby.

This page explains how privacy works in practice. The Privacy notice and the Terms are the formal versions. If the two ever disagree, those are the ones that count, and the disagreement is a mistake worth telling us about.

Nirvaana is in a private test. There is no support desk. Ask Benicio directly, and say what you saw on screen. If you want everything Nirvaana holds about you, or you want it deleted, ask him and it will be done.