Privacy

Last updated 2026-09-13

The short version: you can use Untold without an account, your conversations are stored encrypted, and on the sealed tier the model provider runs your prompt inside an enclave whose hardware evidence we verify against a pinned Intel root on every request. What that proves and what it does not — including which measurements are pinned and which are not yet — is on /limits, which grades it “partly” rather than “yes”. The long version is the rest of this page, and /limits grades each of those claims against the running system rather than against our intentions.

Who we are

AIVM Technologies, S.A., a company incorporated in Panama, is the controller of the data described here. Registered address: The Century Tower, office 317, Vía Ricardo J. Alfaro, Betania, District of Panama, Province of Panama, Panama. For anything on this page, including a request about your own data, write to [email protected].

You are anonymous unless you choose not to be

No account is required and none is offered up front. Sending your first message issues an identity: a random identifier in a cookie, attached to no email, no name and no payment method. That identity is what separates your conversations from someone else’s. We do not ask who you are, and being anonymous costs you nothing — the sealed tier is on every plan including the free one.

If you later add an email and a password, they attach to the identity you already have rather than creating a second one, so nothing you made before is orphaned. Passwords are stored only as a hash. Session tokens are never stored at all: the database keeps a SHA-256 of the token, so a dump of that table yields nothing anyone could present back to us.

Why there is no cookie banner

Because nothing is set until you act. Loading any page here — this one, the landing page, even the chat page — sends no cookie at all; you can check that in your browser’s network panel before taking our word for it. The single cookie we use is the identity — issued when you send your first message, and also when you sign in, and rotated when you attach an email to an anonymous identity. One cookie, three moments, all of them something you did — and it is strictly necessary to answer you and to keep your conversations apart from someone else’s. There is no analytics cookie, no advertising cookie and no third-party tag, which is why you are not being asked to consent to any.

What is in the database

Conversations are stored as ciphertext with a wrapped key. There is no title column, no preview column and no plaintext column — the row holds the encrypted blob, how many messages it has, when it changed, and which privacy mode actually delivered it. That is a schema constraint rather than a policy we apply, so no query against our database returns your text.

Be exact about what that buys you, because the difference matters: it defeats a stolen database dump, not us. The key that unwraps those rows is held by our servers, which is how the export on your account page can hand your conversations back to you in the clear. Client held keys are not shipped yet. Until they are, the only path on which we genuinely cannot read what you sent is end-to-end encryption, and /limits grades this claim “partly” for exactly that reason rather than letting the word “encrypted” imply more than it does.

Alongside that we keep: your account row (identifier, optional email, password hash, an optional wallet address if you attach one, created date), sessions, your plan and credit balance, API keys you create, referral records if you use one, files you upload or that a job produces, your points balance, the jobs you queue, and — with one exception worth naming — the reports behind any verification you run. That table deliberately carries no user id at all, so a report you file is not linked to you and erasure has nothing of yours to remove from it. This page listed it as something held about you; it is not, and the correction is more use to you than the over-inclusion was. If you subscribe, we also keep the payment processor’s references for your subscription, which is what lets you cancel from your account page instead of writing to us.

Characters and folders are the exception to the paragraph above, and we would rather point at it than let it hide inside a list. A character’s name, tagline, backstory and system prompt are ordinary text columns, and so is a folder’s name. They are not encrypted, and a system prompt is your own writing. The reason is that a published character has to be searchable and readable by other people, which encryption at rest would make impossible — but that reason applies to the sentence above only for conversations, so the sentence should not have covered these too.

What we do with your address, exactly. Rate limiting has to recognise a repeat caller, and for sign-in and upgrade that recognition is shared between our servers, so it goes in the database. For those two, what goes in is not your address: it is a keyed fingerprint of it, salted with a server secret, from which the address cannot be recovered by anyone holding the table. On chat, the agent, the relay and the API the key is your account identifier, or a hash of the API key you used — we already hold both, and keying on them means your rate limit follows your account rather than whatever network you are on. Those rows are swept when a later request opens a new window, so in practice they go within a couple of minutes on a service receiving traffic and linger on an idle one. We would rather give you the criterion than a promise about an instant that nothing in the system actually enforces. This page previously did not mention that table at all, and until recently it really did hold the address itself.

One of those deserves naming on its own, because the section above says there is no analytics cookie and that is true about cookies rather than about counting. When you talk to a published character we record one row per character, per reader, per day so its author can be paid for reach. That is a row naming you, not an anonymous tally, and this page described it as the second thing. It records that you talked to that character on that day; it does not keep what was said, and erasing your account removes it.

Who else sees your prompt

This is the part most notices leave vague, and it is the part that actually matters. What happens to your prompt depends on the mode the answer was delivered at, and every answer is labelled with the mode it actually got — never the mode you hoped for.

• Anonymized. We strip your identity and forward the prompt to a third-party model provider. That provider reads the text and applies its own retention policy. This is the weakest mode we offer and we label it as such.
• Sealed (TEE). The model runs inside an Intel TDX enclave. We verify its hardware evidence against a pinned Intel root before a sealed request is dispatched, and a request we cannot attest is refused rather than quietly served one rung weaker. A streamed answer is a separate case worth being exact about: the enclave signs its receipt only once the answer is complete, so text reaches you before its proof does. Turn on “prove before showing” in the composer if you would rather wait for the proof first.
• End-to-end encrypted. Your prompt is encrypted on your device to a key published out of a verified enclave quote. We relay it without being able to read it — which also means we cannot moderate it and do not save the conversation. This is the only mode where the sentence “we cannot read it” is about us rather than about our database.

Sealed answers carry a signed receipt. The receipt contains salted commitments to the prompt and the response — never the text, and never a bare hash of it, because a bare hash would let anyone holding a filed receipt confirm a guess from a candidate list. The salts needed to open a commitment are handed to you and are not kept, which is why we can publish a real receipt on our own landing page without publishing anything that was said.

Sub-processors

Three companies are in the path of a chat request, and one more is in the path of a payment. This page used to say two. The one it left out was the edge our host serves through, which is where TLS terminates and therefore the company that sees the most:

• Phala Network. Confidential inference. Runs the models inside Intel TDX enclaves, and routes anonymized requests to the model vendors below. Your prompt, unless you use end-to-end encryption. Inside the enclave in the sealed tier.
• Cloudflare. The edge our host serves through. TLS terminates here, in front of everything else. Your IP address and the full request, including your prompt on any path except end-to-end encryption.
• Render. Application hosting and the managed Postgres database. Encrypted conversation blobs, account rows, request logs.
• Stripe. Payments and subscription billing. Only involved if you buy a plan. Your email, card details, billing country and IP address at checkout, plus your Untold account id — which is how a payment is matched to an account, and which means Stripe can link the card to the otherwise anonymous identity. Never your prompts.

And on the anonymized tier only, the model vendor itself. That tier forwards your prompt through the gateway to a third-party model, which reads the text and applies its own retention policy — it is the weakest mode we offer and this is what makes it weak. The model families currently reachable that way are deepseek, google, meta-llama, moonshotai, qwen, z-ai — read from the model identifiers themselves, so the list cannot quietly fall out of date when the catalogue changes. Two caveats we would rather state than let you infer: those are namespaces rather than legal entities (you will see the same company under two of them), and every request we make leaves here for a single gateway, Phala, which selects among them. Whether Phala runs these open-weight models itself or forwards to a vendor’s own API is not something we can see from our side. Sealed and end-to-end encrypted requests do not appear on this list: the model runs inside the enclave, and the vendor’s own infrastructure is not in the path.

One more, only if you press the button. The connect dialog can search the public MCP registry for a tool server by name. When you press that button, and not before, your search words go to registry.modelcontextprotocol.iofrom our server; nothing else about you goes with them, and nothing is connected by a result until you choose it and approve its tools.

Why we are allowed to do this

Every use of your data has to rest on something, and naming which is a legal requirement rather than a courtesy. Ours:

• To do what you asked. Taking your prompt, routing it and returning an answer is performance of the agreement you entered by using the service. So is running a plan you paid for.
• To keep the service standing up. Server logs, rate limiting and abuse investigation rest on our legitimate interest in operating and defending the service. You can object to this, and the section below says how.
• Because the law says so. Credit-ledger rows are a financial record and are kept to meet accounting obligations. They survive erasure, which is why the erasure section says so plainly rather than promising a clean sweep.

How long we keep it

Conversations persist until you delete them or erase your account — the criterion is yours, not a clock of ours. Credit-ledger rows outlive all of it because a financial record has to, and they stop naming you the moment you erase your account. Sessions carry an expiry and stop working when they reach it; uploaded files carry their own. Studio sessions, and the pictures, clips and sound you make or add in the Studio, are kept encrypted at rest until you delete them from the Library or erase your account — only you can open them, and nothing we run looks inside. A post you share on the Feed stays until you unshare it or erase your account, and every vote, save, reaction, follow and report you make there stays until you undo it or erase your account; a shared file may sit in a browser or edge cache for up to five minutes after that.

Request logs are a different thing and we would rather be exact than reassuring. We do not run a log store. Two companies see and record ordinary web-server request lines, including source addresses: Cloudflare, where TLS terminates, and Render, which runs the application. Each holds them under its own retention, which is theirs to set and not something we can shorten from our code. An earlier version of this page named a number of days. We removed it, because nothing in this system would have enforced it, and a retention period nothing enforces is a sentence rather than a limit.

Where your data goes

We are a Panama company and our servers and sub-processors sit outside the European Economic Area and the United Kingdom. Panama has no adequacy decision, so transfers out of the EEA and the UK rest on the European Commission’s standard contractual clauses together with the UK addendum, and the destinations are the United States, where our host and our edge run, and wherever the gateway executes a model. That basis is our position rather than a completed file we can show you today: no lawyer has yet reviewed these pages, which the banner at the top says, and the same applies here. Write to [email protected] and we will send you a copy. Support lists everything you can do without asking us, and how to reach a person for the rest.

What we do and do not screen

Nothing inspects your prompt before it is sent. There is no filter standing between you and the model, no pattern check, and no queue a human reads. What exists is narrower and worth stating exactly: we prepend an instruction to the model asking it to decline illegal requests and anything sexualising a minor. That instruction goes on every plan including the uncensored one, and on the agent as well as on chat — what a paid plan removes is the topic filter, never that line. This page previously said “on the moderated tiers”, which understated the one control the uncensored tier actually carries. That is an instruction the model may follow or fail to follow — it is not a gate, and nothing is blocked or discarded on our side.

We also do not make automated decisions about you in the sense the law means: nothing here profiles you or decides anything with a legal or similarly significant effect. Rate limiting refuses a request when it arrives too quickly, and that is the whole of it.

End-to-end encryption is the one mode where we could not screen even if we wanted to, and we say that literally rather than as a boast: we cannot see the text, so no instruction can be added to it and no check could run over it.

Children

This service is not for children. You must be 18 to use the uncensored models, and old enough to enter a contract where you live to use anything else. We do not knowingly collect data from a child, and if you tell us we have, we will delete it — write to the address above. Be clear about what that sentence is: a rule, not a gate. There is no age field in this product and nothing checks, so we rely on you and on being told.

If you are in California

We do not sell your personal information and we do not share it for cross-context behavioural advertising. There is no advertising tag on this site to do it with. The categories we collect are the ones listed above — identifiers, your conversation contents, payment information handled by Stripe, and internet activity in the form of server logs — collected to run the service and for no other purpose. You have the right to know what we hold, to delete it, to correct it and to limit how it is used; the export and erase controls on your account page do the first two immediately and without asking us.

Your rights, and how to actually use them

You can export everything we hold about you and you can make us forget you, from your account page. Both work for anonymous identities as well as signed-up ones, because an anonymous user is a real user here and not a lesser one. Erasure removes the account and everything attached to it — the full list is in the next paragraph.

Erasure cascades to conversations, characters, folders, sessions, API keys, uploaded files, queued jobs, your plan, your referral records and the payment processor’s reference for your subscription — the whole list, because a shorter one reads as complete.

Two things are kept rather than deleted, and this page named only one of them. Credit-ledger rows survive because a financial record has to. Points rows survive because other people’s creator earnings are computed over them — your reading of a published character is part of what pays its author, and destroying it would change what somebody else is owed. Both stop naming you: the link to your account is severed, and for points we also rewrite the reference that had your identifier inside it, so no row anywhere can be traced back. The message you get when you erase says both; this page used to say one, while calling its list complete.

Depending on where you live you may also have rights to correction, restriction, objection, portability, and to complain to a supervisory authority. For a complaint, that is the data protection authority of the country where you live — you do not have to come to Panama to make one. Our representative in the European Union under Article 27 is [EU representative], and in the United Kingdom [UK representative]. Write to any of them, or to the address above, and we will answer.

What we have not finished

The honest gap on this page is no longer the retention period — that is stated above — it is that client-held keys for stored conversations are not shipped, so “encrypted” here means encrypted against a stolen database and not against us. /limits lists the other places where the system does less than the marketing sentence would suggest — most of it computed from the running code, and the rows that are our word rather than a measurement are labelled there. It is the page to read if you want to catch us out.