Privacy Policy

This policy explains what the Tridente SI apps for iPhone, iPad and Mac and the Tridente SI service behind them ("the Service") collect, why, and what you can do about it. Seahorse is the Super Intelligence (SI) assistant in the Service. The Service is operated by Latte Computer, under Bekje ("we", "us"), which is responsible for your data under this policy. We aim to collect as little as possible.

1. Account

• Continue with Ghostee: Ghostee signs you in and tells us your Ghostee user ID and handle. From these we derive an opaque Tridente account ID. We do not receive or store an email address, and we never receive your Ghostee passkey or password. To connect your Lyre Cloud account, we tell Lyre Cloud your Ghostee user ID and your Tridente account ID. Lyre Cloud uses the Ghostee user ID to find your account there.
• Sign-in is Ghostee only. One Ghostee ID, secured by the Ghostee Protocol. We use Ghostee for sign-in and the security events below, and for nothing else. There are no email and password accounts and no invite codes. Each sign-in is also checked with Apple's App Attest (see section 4).
• Security events from Ghostee: Ghostee tells us about security events on your Ghostee account, such as a new sign-in, a newly linked app or a signed-out session. If Ghostee ends your sessions, we sign out your Tridente SI devices too. We keep a short record of the last 20 such events per account (the event type, a short reason code and the time, with no IP address, location or content) for account security.

2. Conversations

• When you are signed in, your conversations (titles and message text) are stored on our servers so your history is available on any device once you sign in with Ghostee. They are encrypted at rest (AES-256-GCM) with a key held on our servers.
• Not end-to-end encrypted: the Ghostee Protocol covers sign-in and account security only. It does not protect your conversations. Because we hold the key, the Service can decrypt your conversations and saved memory facts. It does so only in memory, while handling a request that needs them (for example syncing your history to a device), and never writes them to storage unencrypted. The messages you send for a reply also reach our servers in readable form so that Seahorse can answer them (see section 3).
• Your stored conversations and saved memory facts are deleted when you delete your account (see section 6).
• Images you attach are resized and re-encoded on your device, which also removes photo metadata such as location. They are sent with that one message for analysis and are not saved in your synced history.
• Memory: if you explicitly tell Seahorse something about yourself ("remember…", "my name is…", "I prefer…"), up to 25 short facts are saved with your account so Seahorse can remember them in later chats. Saved facts are encrypted at rest in the same way as your conversations, with a separate key held on our servers.
• Searching your chats happens on your device, and search terms are never sent to us.

3. How your messages are processed

• To answer you, your message, recent turns of the conversation, any saved memory facts and any attached image are sent through our secure SI gateway (operated by Latte Computer) for Super Intelligence processing. That processing is done via a cloud provider, Amazon Web Services, in the United States. The provider does not store your messages or use them to train models.
• International transfers: because this processing takes place in the United States, your data is transferred outside the UK and the European Economic Area. Transfers from the UK are protected by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses. Transfers from the European Economic Area are protected by the EU Standard Contractual Clauses.
• Modes: Quick and Think answer in the app. Savvy researches a question in several steps, searching and reading public web pages, and Code works on code tasks. Every step of a mode is processed as described in this section, and none of it is used to train models.
• Code tasks: when Seahorse runs code or works on code for you, that code runs in an isolated, temporary sandbox provided by E2B in the United States. The same international transfer safeguards apply. The task itself is coordinated on Cloudflare: its progress is kept in Cloudflare Durable Objects, and what you asked it to do is stored encrypted in Cloudflare R2 only while it runs. That input is deleted when the task ends, at the latest after 40 minutes, and any copy left behind is removed by a daily clean-up. If a simple task is interrupted, it may be run again automatically. An interrupted code task stops instead, and the app offers you the option to retry it.
• GitHub: if you connect GitHub for code tasks, we can access only the repositories you grant. We read files and push changes or open pull requests only when you ask for it in a task. Your GitHub token and task grants are stored encrypted. You can disconnect GitHub in the app, or revoke access at any time in your GitHub settings, which deletes or invalidates the stored token. GitHub acts as an independent controller of your data under its own terms and privacy statement.
• When Seahorse decides a question needs current information, a search query based on your message is sent to a web search provider, and the Service may fetch the public web pages it found.
• We do not use your conversations to train SI models, and we do not sell your personal data. There are no ads.
• Don't submit information you would not want processed by an automated system or by these third-party providers.

4. Device security

• Your sign-in token is stored in the Apple Keychain on your device, and only on that device. The app does not use cookies.
• App Attest: the app uses Apple's App Attest to prove that requests come from a genuine copy of the app. Your device creates a key, and Apple certifies it. We store that key's public part and a counter. No personal data is involved.
• Face ID / Touch ID / passcode lock: this is checked by your device's operating system. We never receive biometric data.
• The app hides your chats in the app switcher. Text you copy from a message is cleared from the clipboard after 60 seconds, and on iPhone and iPad it is not shared with your other devices.

5. Operational data

To run the Service and prevent abuse we process request metadata such as IP address, time and requested endpoint. We keep IP-based rate-limit counters (they expire within minutes to hours) and per-account daily usage counters. The Service runs on Cloudflare, which processes this traffic for us. Our logs do not contain your messages, the web searches or addresses made for you, or the links in an answer.

6. Your choices

• Delete any conversation in the app, or share or copy a conversation or message.
• Sign out at any time. Signing out also revokes your session on our servers.
• Delete your account in the app under Settings → Delete Account. This removes your synced conversations, memory, account links (including your GitHub connection and its stored token), Ghostee security-event records and usage counters, and signs out every device. We also tell Ghostee that this Tridente SI account was deleted (we send only your Ghostee account ID and the reason) so it can remove the link on its side. We keep only a minimal deletion marker (your opaque account ID and a session counter) so old sign-in tokens can never work again. Deleting your account removes our stored copy of your GitHub token only. To revoke access at GitHub itself, use your GitHub settings.
• If you delete your Ghostee account, Ghostee tells us and we delete your Tridente SI data straight away (synced conversations, saved memory, your GitHub connection and its stored token, the account link, security-event records and usage counters), sign out every device, and keep only the minimal deletion marker described above. This happens when Ghostee's signed notification reaches us, and Ghostee retries if it cannot reach us. If your Ghostee account is unlinked for any other reason, we remove the link and sign you out, and we keep your data. For 30 days you can still delete it using your old sign-in. Nothing is deleted automatically in that case.
• For any other request (access, correction, deletion), email us at the address below. Our support page explains the common steps.

7. Retention

We keep account data and synced conversations while your account exists. Deleting your account removes them as described above. One-time sign-in codes and attestation challenges expire within minutes. Ghostee security-event records are limited to the latest 20 per account and are removed with your account.

8. Children

The Service is not directed to children under 13 (or the minimum age in your country), and we do not knowingly collect their data.

9. Changes

We may update this policy. The "last updated" date above shows when it last changed.

10. Contact

Privacy questions and data requests: enquiries@bekje.com.