what you bring into a room is sensitive. here is exactly where it goes, who can see it, and how you get rid of it.
the fine print
disclosures & your rights.
the plain-language summary lives here. the full legal text sits behind the two links, the privacy policy effective 17 september 2026 and the terms 1 september 2026.
documents
the versions that actually bind us. worth reading before you sign up.
everything you write is encrypted on the way to us and while it sits in the database. passwords are kept only as salted hashes, and one account cannot read another's.
used to hold the room, and to draw your arc
your sessions are read to hold the conversation, produce your resolution cards, and build the arc and recall that belong to you. both are automated, and you can ask us to stop generating them.
never sold, never trained on
we do not sell your data, share it with advertisers, or run ad tracking. your conversations train no model of ours, and our contract with anthropic means they train none of theirs.
who sees what
what is shared, and what is only yours.
kept between you
—the full transcript of a room you both attend
—resolutions you both acknowledge
—the display name you chose for that room
kept to yourself
—your journal, always separate
—solo sessions and rehearsals
—your private vibe checks
a shared room holds two people's words, so we cannot erase half of it. delete your account and your solo content goes out of reach immediately, then is erased for good within 30 days. in a shared room your name is stripped and your words stay in the other person's copy, unattributed. ask us and we will put it to them, and if you both agree the whole room goes. export your full history at any time, no questions asked.
handled with care
the seriousness you are trusting us with.
stored in canada
your account and your sessions sit in montréal. session content still goes to anthropic in the us.
encrypted
in transit and at rest, always.
never trained on
your conversations are not our model's data.
essential cookies only
enough to keep you signed in. nothing to opt out of.
oplos is a structured conversation tool, not professional care, and not a crisis service. if you or someone else is in danger, close oplos and contact an emergency service.
a question about your data?
we'd rather you ask. reach a real person, not a ticket, and always within 30 days.
deodatum inc. is the controller. every provider below is bound by contract to use your information only on our instructions, and to protect it to a standard comparable to our own.
what leaves for the model
to hold the conversation, the text of your session is sent to our model provider, anthropic pbc, and processed on their infrastructure. we send only what is needed to respond. your email address, your billing details and your account identifiers never go with it. under our commercial agreement your content trains none of their models, and is kept by them only as long as needed to return a response and meet their trust and safety obligations. we train nothing of our own on it either.
who processes what
supabase, database, authentication, and the transactional email behind sign-ins, password resets and email changes. canada, ca-central-1.
vercel, application hosting and delivery. global edge network, primarily united states.
anthropic pbc, processing of session content. united states.
stripe, payments and subscription billing. we never receive or store your full card number. united states, with global processing.
resend, delivery of the emails oplos sends itself, which today is the confirmation that your account was deleted. it receives your email address and nothing you wrote. united states.
that list is complete. we update it here and in the privacy policy at least 30 days before adding any new provider that would handle personal information.
why we process at all
to run the service, to produce your arc and recall, to handle billing, to keep oplos safe from abuse and misused invite links, to answer your support messages, to meet legal obligations, to improve oplos using aggregated or de-identified information only, and to send marketing solely where you separately opted in. a new purpose means we tell you first, and ask again where the law requires it.
automated processing
your arc and recall themes are produced by software reading what you wrote, with no person reading it first. they describe, they do not decide. they have no effect on your access, your price, or anything outside the product. ask how a particular output was produced and we will tell you. there is no switch for this inside the product yet, so write to privacy@oplos.co to have them stopped or their outputs deleted, and we will act within 30 days.
crossing the border
your account, your sessions and everything you write sit in canada, in the ca-central-1 region in montréal. some of it still crosses the border, and we would rather name it than let "stored in canada" carry more weight than it should. session content goes to anthropic in the united states each time the room responds. hosting runs on vercel's global edge, payments go to stripe, and the email we send ourselves goes through resend, all primarily in the united states. while information is in another country it falls under that country's laws, and may be reachable by its courts, law enforcement and national security authorities through their own legal processes. that holds whatever safeguards we and our providers apply. we assessed these transfers, and we stay accountable to you for your information wherever it sits.
how long it is kept
account records while your account is open; on deletion access ends at once and the record is erased within 30 days. solo session content on the same 30 days, backups included. shared rooms kept while at least one participant's account is open. guest access ends 7 days after a session resolves. arc and recall outputs deleted within 30 days of you asking us to stop. technical and security logs 12 months, support mail 24 months, billing records 7 years. backups roll over within 30 days. when a period ends we delete the information or irreversibly de-identify it.
the one thing that outlives deletion
the free mediated session and the 7 day resolve trial are offered once per person, so after you delete we keep a scrambled, one way version of your email address and two yes or no flags about what it has used. it cannot be turned back into your address, it holds nothing you wrote, and if you never used the free session nothing carries over. only actual use carries, never the fact that you deleted.
when we would disclose
only where you tell us to, where the law compels us and we will say so unless prohibited, where there is an imminent risk of serious harm to an identifiable person, where we are legally required to report content involving the sexual exploitation of a child, or in a sale or merger where the recipient must keep protecting it under this policy and we would notify you first.