EmpathySign in

Privacy Notice

Last updated 1 October 2026

Empathy is a place for personal conversations, so this notice tries to be plain about what happens to them. It explains what we collect, why, who helps us, how long we keep it, and how you can see or delete it.

1. Who is responsible

Jorge Mager, operating under the name Tyrell, [Business postal address — to be added], is the controller of your personal data. For anything about your data, write to privacy@shadowly.ai.

We do not offer Empathy in the EU/EEA, the United Kingdom or Switzerland, and we block new sign-ups and the demo from those regions. To do that we look at the country your connection appears to come from, which our host works out from your IP address; we do not store it or your IP address for this. If you already have an account and you are travelling, you can still sign in.

2. What we collect

  • Account: your email address, your password (stored only as a secure hash by our sign-in provider), when you confirmed your email, and a record of the consent you gave when signing up (what you agreed to, that you confirmed you are 18 or over, and when).
  • Conversations: what you write to Daimon and its replies; the notes Daimon keeps about what you've shared (for example, recurring themes, and details like your age or where you live if you mention them); and search vectors made from those notes.
  • Usage: how many exchanges you've used, your plan and balance, and technical records of each AI request (time, model, size), which we use to run limits and understand our costs.
  • Payments, once paid plans are available: your plan, subscription status, when it renews or ends, and Paddle's customer and subscription references. We also keep a log of what each payment or refund did to your balance (Paddle's transaction reference and the number of exchanges, never any payment details). Paddle collects your payment details; we never see your card.
  • Technical data: IP addresses, which we store only as one-way hashes to limit sign-ups and demo use per network, and our hosting provider's short-lived server logs.
  • Your browser: Empathy itself sets no cookies. Your sign-in session is kept in your browser's local storage, and, after a crisis card has been shown, a note of that (with your country) is kept there for 24 hours so the card is still there after a reload. When paid plans are available, the conversation screen loads Paddle's checkout script, and Paddle's domain sets one cookie, __cf_bm: Cloudflare's bot-protection cookie, which lasts about 30 minutes and is used for security, not tracking. We use no advertising or analytics cookies and no third-party trackers.
  • The demo on our home page: what you write there is processed to reply to you. Like any message, it goes through our automatic safety check, and Daimon makes short notes on it to show you what it noticed. It is deleted automatically, normally within a few days, unless you create an account to keep it, in which case it becomes part of your account.

3. Sensitive information, and your consent

What you tell Daimon may include details about your health, your relationships or your inner life. Under the GDPR some of this is “special category” data. We process it only with your explicit consent, which we ask for with a separate box when you create an account (the same box confirms you are 18 or over). You can withdraw consent at any time by deleting your account; Empathy cannot work without processing what you share, so withdrawing ends the service for you. Withdrawing does not affect processing that happened before.

4. Why we use your data, and on what basis

  • To provide Empathy (replies, memory across sessions, your balance): performing our contract with you, and your explicit consent for sensitive information.
  • To send account emails(confirmation, password reset): performing our contract. We don't send marketing email.
  • To notice when someone may be in danger: every message, in the app and in the demo, is checked automatically by our AI provider (Anthropic) for signs of a crisis. If it finds one, we show crisis lines for your country, based on your IP address, and Daimon's reply does not count against your exchanges. The event is recorded only as a count, not linked to you or to what you wrote. To stop these free replies being misused, we also keep, for 24 hours, a note that one was given, filed under a one-way code derived from your account (or, in the demo, your IP address), never your account id, your IP address or your words; after ten in a day the crisis resources are still shown but Daimon's reply is replaced by a short fixed message. The message itself stays in your conversation history like any other, until you delete it, and is not added to Daimon's long-term notes about you. Basis: your explicit consent, and the vital interests of the person concerned.
  • To keep Empathy secure and prevent abuse (rate limits, logs): our legitimate interest in running a safe service.
  • Billing, tax and accounting records: our contract with you and our legal obligations.

We don't sell your data, use it for advertising, or use your conversations to train general AI models. We don't make decisions about you by automated means that have legal or similarly significant effects.

5. Who helps us run Empathy

These providers process personal data on our behalf, under contracts that limit them to doing so for us:

  • Supabase: Our database and sign-in service. Stores your account, conversations, memories and usage records.
  • Vercel: Hosts the website and app, and keeps short-lived server logs, including IP addresses.
  • Anthropic: The AI model that writes Daimon’s replies and picks out what to remember. Receives your messages and relevant past context.
  • OpenAI: Turns text into search vectors (embeddings) so Daimon can recall the right memories. Receives the text of each thing Daimon remembers and, every time you send a message, that latest message, which is used to search your memories. OpenAI never writes anything you see.
  • Resend: Delivers account emails, such as confirming your address and resetting your password. Receives your email address.

Our AI providers (Anthropic and OpenAI) do not use our API traffic to train their models, and may keep it for a limited period for abuse and safety monitoring under their own terms.

Paddle sells our paid plans as Merchant of Record. For purchases, Paddle is an independent controller of the data it collects at checkout (such as your name, email, country and payment details) under its own privacy notice. When you open the checkout, we send Paddle your email address (so you don't have to type it again) and an internal account reference, so your purchase is credited to your account. We receive from Paddle only what we need to give you what you bought: your plan, its status and billing period, and Paddle's customer and subscription references. Our server also contacts Paddle, using only those references, to open your billing page when you ask for it, to cancel a subscription (when you delete your account, or when a payment is refunded), and once a day to check that every payment and refund Paddle recorded has been applied to the right account. If you have dealt with Paddle and delete your account, we also look up, by your Paddle customer reference or your email address, any subscription of yours that we have no record of, so that it is cancelled too. If you have never bought anything, nothing about you is sent to Paddle.

We may also disclose data when the law requires it, or to protect someone's safety.

6. International transfers

We are based in Israel. Some of our providers process data in the United States and other countries. Where we send personal data to another country, we rely on safeguards such as contractual protections with those providers. Write to us for details.

7. How long we keep it

  • Your account, conversations and memories: until you delete your account. When you ask us to delete it, we do so within 30 days. Deleting it in the app happens straight away.
  • Backups: deleted data rolls off our database backups within a further 30 days.
  • Usage cost records (which AI model was used, how much, and when; never what was said): kept for accounting after your account is deleted, with every link to you and to your conversations removed, so they are anonymous.
  • Demo conversations: deleted automatically, normally within a few days.
  • Accounts whose email address is never confirmed: deleted automatically, with everything in them, 7 days after sign-up.
  • Billing log(Paddle's transaction references and what each payment or refund did to a balance; no name, email or payment details): kept for accounting after your account is deleted, with every link to you removed.
  • Payment records: Paddle keeps transaction records as its own legal obligations require.

8. Deleting your data

You can delete your account and everything in it yourself: on your Home page, choose Delete my accountin the Account section. You'll be asked to confirm twice. This deletes your account, your conversations, Daimon's notes about you and their search vectors, straight away. You can also email privacy@shadowly.ai and we will do it within 30 days. If you have an active subscription, we cancel it for you first, immediately, so you are not charged again. If we cannot cancel it (for example, Paddle is not answering), we do not delete anything and we tell you, so you are never left paying for an account that no longer exists; try again later, or ask us and we will do both.

9. Your rights

Depending on where you live, you may have the right to access your data, correct it, delete it, restrict or object to how we use it, receive it in a portable format, and withdraw consent at any time. Write to privacy@shadowly.ai; we answer within one month. We may need to confirm it's you first.

You can also complain to the data protection authority where you live, or to Israel's Privacy Protection Authority. We'd appreciate the chance to help first.

10. Security

Data is encrypted in transit, access to production systems is restricted to the people who need it, and IP addresses are stored only as hashes. No system is perfectly secure; if a breach affects your data, we will tell you and the authorities as the law requires.

11. Age

Empathy is for people aged 18 and over, and you confirm that you are when you create an account. We don't knowingly collect data from anyone younger; if you believe we have, write to us and we will delete it.

12. Changes

We will update this notice when our practices change, and tell you by email or in the app before a significant change takes effect. The date at the top shows the latest version.

13. Contact

Jorge Mager, operating under the name Tyrell, [Business postal address — to be added].
Privacy and data requests: privacy@shadowly.ai
Everything else: support@shadowly.ai