Privacy Policy

Effective date: July 21, 2026  ·  Last updated: November 2, 2026

1. What this covers

Holigram is a personal-vault application: a private place to keep, organize, and get recommendations about the things you track — collections, notes, documents, and facts about yourself. This policy explains what personal data we collect, why, who processes it on our behalf, and the controls you have.

It covers the Holigram web application (app.holigram.ai), the Holigram iPhone app, the Holigram website (holigram.ai), our API, and any optional integrations you choose to connect. It does not cover third-party services you connect Holigram to — such as your Google account, or an external AI assistant you grant access to. Those are governed by their privacy policies and by the grants you set (and can revoke) inside Holigram.

Holigram is currently offered by invitation, to users in the United States. Some features described here are available only on paid plans or only once you enable them.

2. The promises this policy is built on

These are the commitments the rest of the policy implements, stated plainly:

• We never sell your personal data. Not any entry, fact, secret, note, or document; not any profile derived from them; not at any granularity that could identify you. There are no ads and no data brokers. Your subscription is the business model — you are the customer, not the product.
• Your data never trains anyone else's AI. When Holigram calls an external AI provider to answer your request, that call is request-scoped and the provider never trains on it. Anthropic keeps nothing after it answers; Google keeps requests for a limited period to watch for abuse. Section 4 has the detail, including what either may keep for safety or legal reasons.
• Every AI read is logged and every grant is revocable. You can see what is held, see every slice any AI ever read, export everything, and delete it.
• We tell you before anything above changes. We may tighten these promises silently; we never quietly widen what we do with data you already gave us.

3. The data we collect and why

3a. Account and identity data

We collect your email address and the authentication credentials handled by our identity provider, Firebase Authentication; if you use social sign-in, the identifier that provider returns; an internal user ID; and your approval status and plan tier. We use this to create and secure your account, sign you in, and manage access. Account-verification and password-reset emails are sent by Firebase, not by us.

We also record how you found Holigram: the referral code in the link you followed to sign up, if it had one, and your answer to the optional "How did you hear about Holigram?" question at signup. We use this only to understand which channels bring people to Holigram.

3b. Vault content (the data you put in)

This is your collections and their entries; "Perception" facts about yourself; Secret Vault entries (our most sensitive class); notes; and uploaded documents and files. We use it to provide the core product — storing, organizing, and generating recommendations over the things you track. Your vault is private by default: no AI, ours or an external one, reads a collection unless you grant it, and you can revoke any grant.

Some of what you keep may be about people other than you — fact sheets about the people in your life, facts you attach to friends, and the relationships that connect them. You author it, it lives in your vault under the same private-by-default rule, and each person's sheet carries its own AI-exclusion switch that keeps everything about that person out of every AI read. Where you record someone's birthday, we process it only to generate your reminders. What you choose to record about others is your responsibility.

3c. Derived and operational data

We generate recommendations and other model outputs; keep an egress log (a record of every slice of your data any AI read — destination, purpose, and row/token counts, never the content); keep usage counters; and keep standard server logs and security telemetry. We use these to operate the service, meter usage and enforce limits, give you transparency (the egress log is a feature you can view), and protect against abuse.

3d. Data from services you choose to connect (all optional)

You may connect external services. Each is opt-in, separately grantable, and separately revocable:

• Google Gmail (read-only): if you connect it, we read message data only to extract structured items (such as reservations) into an approval queue you control.
• Google Calendar: if you connect it, we read free/busy availability and, where you enable it, event data, to give context and stage items for your approval.
• Other connectors and a downloadable reminders calendar feed you can subscribe to.

We request the narrowest access each feature needs and never read content a feature doesn't require — for example, calendar invitations authored by other people are never read or stored. Google user data obtained through these connections is used only to provide these features, is never used to train generalized AI, and is handled in accordance with Google's API Services User Data Policy, including its Limited Use requirements.

3e. External AI assistants you connect

You may connect an external AI assistant (such as Claude, ChatGPT, Gemini or Grok) to Holigram. When you do, that assistant can read your Perception facts and what Holigram remembers about you — except lines you lock — plus the collections you open to it, subject to per-collection and per-attribute controls. For each connection you choose what it may change: nothing (read only); additions that wait for your review; or entries, facts and new collections saved directly, each of which you are told about and can undo. Every read and every write is logged. What the assistant then does with what it read is governed by your relationship with that assistant, not by us — which is why the grants are visible and revocable.

3f. The iPhone app and device permissions

The Holigram iPhone app is the same application, delivered through the App Store. It adds device features that stay off until you turn them on, and each asks for permission the first time you use it:

• Face ID unlock — turning it on stores a device-specific sign-in secret in your iPhone's Keychain, protected by Face ID and never synced to iCloud or included in backups. Our servers keep only a hash of that secret, with a device label and dates, so you can revoke it from Settings at any time. Apple never shares your face data with us.
• Apple Reminders — turning it on creates a "Holigram" list in the Reminders app and mirrors your Holigram reminders into it. Holigram reads and writes only that list. The reminder titles and dates then also live in Apple's Reminders (and in your iCloud account, if Reminders syncs there), under Apple's privacy policy.
• Camera, photos, microphone, and location — used only when you tap the feature that needs them: photographing or choosing a photo for Holigram to recognize or attach, dictating instead of typing, or (once you turn it on) letting Spotlight answer with what's nearby. A photo you submit is sent to one of the AI providers in section 4, under that provider's terms; dictation is transcribed by Apple's speech recognition; your approximate location is sent only with the request you make and is not stored.

The iPhone app uses no advertising identifier and does not track you across other apps or websites.

4. External AI providers and what they keep

To generate recommendations and to extract items from connected sources, Holigram sends the relevant slice of your data to an external AI model provider. We use two today. Which one handles a request depends on the feature and your plan, and neither trains on what we send:

• Google (Gemini API) handles most free-plan requests, and work such as suggestions and drafting records on every plan, under Google's paid-tier Gemini API terms. Google does not use those requests or its responses to improve its products. It logs them for a limited period, solely to detect and prevent abuse, keep its service safe and secure, and make any disclosures the law requires.
• Anthropic (Claude) handles premium-plan answers and photo recognition, and anything that searches the web, under zero-data-retention terms: Anthropic does not store the request or its response once it answers. The exceptions are a request its automated safety systems flag, and anything the law requires it to keep.

We send only the minimum needed for the request and log the fact of the send, including which provider received it (never the content), in your egress log. Structurally excluded surfaces — including Secret Vault content and privacy-locked lines — are never sent.

5. How your data is stored and secured

We host Holigram on Google Cloud Platform in the United States. Your vault lives in a managed PostgreSQL database; your files live in Google Cloud Storage; and credentials to any services you connect are encrypted at rest. Every row is owner-scoped and enforced at the database layer, so one user's data is not reachable in another user's context, and all traffic is over HTTPS/TLS. No system is perfectly secure; if we ever discover a breach affecting your personal data, we will notify affected users without undue delay.

6. Sub-processors

We use these third parties to process personal data on our behalf:

Sign-in and account creation are protected against automated abuse by Google reCAPTCHA Enterprise, which evaluates signals from your browser to tell people from scripts. It runs under Google's own privacy policy and terms (linked from the sign-in page itself), and Google Cloud is already listed above.

We will give notice on this page before adding or changing a sub-processor that touches personal data.

7. What we do — and never do — with your data

• Your personal data (anything tied to you) is used only to operate the service and answer your requests. It is never sold, rented, licensed, or shared for advertising, at any granularity.
• Our own recommendation models may, in the future, learn general patterns from the overall dataset — but anything they learn never leaves Holigram, is never sold or exported, and never includes Secret Vault content, privacy-locked lines, data shared to you by others, or your document contents. Today our models train on zero user content; any future use of real vault content would require an explicit, off-by-default choice we would tell you about, in plain language, first.
• We do not produce or sell any aggregate data product. If we ever chose to publish high-level, de-identified trends that cannot be traced to any individual, we would describe that here in plain language before it began.

8. Sensitive data

You may choose to store sensitive information — for example, health-related notes, or secrets in the Secret Vault. Where you do, you consent to our processing it to provide the service, and it receives our strongest handling: it is excluded from external AI reads unless you explicitly grant it, excluded from any model training, and excluded from any future aggregate trends. Holigram is not a healthcare provider and does not create any covered-entity relationship.

9. Your controls and rights

Holigram gives you direct control from the Data & Privacy and Connections screens in the app:

• See what's held — a summary of your vault.
• See what was shared — the egress log of every AI read.
• Manage grants — per-collection and per-attribute AI access, and the list of connected apps and assistants, each individually revocable.
• Export — per-collection export (CSV) and a full-account export (JSON) covering your collections and entries, what Holigram remembers about you, and your connection surfaces and capture history (safe fields only, never credential material). Notes, documents, Perception facts and Secret Vault entries are not in that file today; the contact route below reaches them.
• Delete — delete individual entries, whole collections, or your entire account (Settings → Danger zone).

You may also ask us to access, correct, or delete your personal data by contacting us at support@holigram.ai; we will respond within 45 days. Because we do not sell or share your personal data, there is nothing to opt out of on that front, and we will never discriminate against you for exercising a privacy right.

10. Data retention

We keep your personal data for as long as your account is active. When you delete data or your account, it is removed from our live systems promptly and purged from routine backups within 30 days. We may retain limited records where the law requires it or to resolve a dispute or enforce our agreement.

11. Children

Holigram is not directed to children. You must be at least 18 years old to use it. We do not knowingly collect data from anyone under 18; if we learn that we have, we delete it.

12. Changes to this policy

We will post any change on this page and update the "last updated" date. For any material widening of what we do with data you already gave us, we will notify you before it takes effect and, where required, obtain your consent. A change that only tightens your privacy may be made without prior notice.

13. Contact

Questions or requests: support@holigram.ai.