HiddenPrism — Privacy Policy

• You're not the product. We do not sell your data, we do not use it to advertise to you, and we do not use your content to train models — and neither do the providers who process it for us.
• What we collect is mostly what you choose to put in: your Core (how you think), the facets you build from it, your Sources, and your conversations — plus the basics needed to run an account.
• Where it goes: to run HiddenPrism and generate your voices, your content is processed by a small set of infrastructure and model providers (Cloudflare and Anthropic), and payments by Stripe. Each is named in §6.
• How it's protected: encrypted when stored; a Private Vault option locks chosen content so only you can open it. Honest limits are in §7 — this is not end-to-end encryption.
• Your control: see it, correct it, export it, and delete it. How, and what deletion does and doesn't reach, is in §8–§9.

This Privacy Policy explains how HiddenPrism LLC ("HiddenPrism," "we," "us"), a New Jersey limited liability company, collects, uses, shares, and protects personal information when you use the HiddenPrism website at hiddenprism.app, its subdomains, the web application, and the remote API/MCP server (the "Service"). It is incorporated by reference into our Terms of Service. For the Service, HiddenPrism is the data controller (GDPR) / business (CCPA/CPRA).

2.1 Information you provide.

• Account data: email address; authentication data (magic-link tokens, and, if you enroll, passkey/WebAuthn credentials); and your acknowledgment of our Terms and this Policy (recorded with a version and timestamp).
• Identity content — "the Core" and facets: the self-description you provide (typed or dictated), the structured Core we distill from it, the facets (configurable perspectives) you build, their names and settings, and any avatars you upload. This is the most sensitive information the Service handles — see §4.
• Sources: documents, text, and files you upload or add for retrieval, and anything derived from them.
• Conversations & feedback: your messages and prompts, roundtable discussions, feedback labels, and support requests you send us.
• Publishing: if you publish a facet, the public profile, blurb, and facet content you choose to make discoverable, and messages exchanged with visitors.
• Payment data: handled by Stripe — we receive limited billing metadata (plan, status, last four digits) but do not store full card numbers. See §6.

2.2 Information collected automatically.

• Usage & device data: log and event data (actions taken, timestamps, errors), IP address, and general device/browser information, used to operate, secure, and debug the Service.
• Cookies / local storage: used for sign-in sessions and essential functionality. See §10.

2.3 Voice input. If you use press-to-talk dictation and your browser lacks on-device speech recognition, the recorded audio is sent to our processor (Cloudflare Workers AI) to transcribe it. See §6.

2.4 We do not intentionally collect payment card numbers, government IDs, or precise geolocation.

Where GDPR/UK-GDPR applies, we process personal data on these bases: performance of a contract (to provide the Service you sign up for); consent (for special-category/health data per §4, and non-essential cookies — withdrawable at any time); legitimate interests (to secure, debug, and improve the Service, and prevent abuse, balanced against your rights); and legal obligation (to comply with law).

The Core, and facets derived from it, can reveal or infer mental-health, emotional, and other sensitive characteristics. We therefore treat identity content as sensitive personal information (CCPA/CPRA), special-category data (GDPR Art. 9), and consumer health data (e.g., Washington's My Health My Data Act and similar laws).

• We collect and process it only with your consent, which you provide before you begin (the acknowledgment recorded at onboarding), and to provide the Service to you.
• We do not sell it, share it for advertising, or use it to train models (§5).
• You can withdraw consent and delete this content at any time (§8–§9); withdrawing consent for processing that is essential to the Service may mean you can no longer use it.
• [VERIFY / counsel]: confirm whether MHMD (and analogous laws) require this to be a separate, distinctly linked Consumer Health Data Privacy Policy and a separate authorization before any sharing. If so, split this section into that standalone document and link it prominently.

We use personal information to: operate the Service and generate your voices, facets, roundtables, and retrieval answers; maintain and improve the Service (diagnostics, reliability, and product improvement — see the limits below); secure the Service and prevent fraud, abuse, and harm, including safety interventions; process payments; communicate with you about your account and support; and comply with law.

What we will not do — our commitment:

• We do not use your content to train, fine-tune, or improve machine-learning models — not ours, and, under our agreements with them, not our providers' (§6). "Improve the Service" means engineering and diagnostics on our own systems, not training models on your content.
• We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising (as those terms are defined under CCPA/CPRA).
• We do not use your identity content to advertise or market third-party products to you.

We do not sell your data. We share it only with service providers who process it on our behalf, under contract, for the purposes above — never for their own purposes:

• Model processing is inherent to the Service. To generate a response, the relevant content (your message and the context needed) is transmitted to the model provider. This is true of every generative feature, including for Private Vault users (vault content is decrypted momentarily on our servers to serve your request). Under the applicable Anthropic (commercial API) and Cloudflare (Workers AI) terms, this content is not used to train their models — verified 2026-07-22 against their published terms (Anthropic Privacy Center; Cloudflare Workers AI data usage). Providers may retain content briefly for security and abuse-prevention as described in their terms. (Drafting note: confirm against HP's account-level agreement before publishing.)
• Other disclosures: we may disclose information to comply with law, enforce our Terms, protect rights and safety, or in a business transfer (merger/acquisition), in which case we will notify you and this Policy will govern until updated.
• We do not share your identity content with data brokers, advertisers, or for any advertising purpose.

• Encryption at rest. Identity content and related data are encrypted when stored on our infrastructure.
• Private Vault (optional). You can enable a Private Vault that locks chosen content with a key derived from your passphrase or passkey, so that only you can unlock it — we cannot read vault-locked content while it is locked. If you lose your key, we cannot recover that content.
• Honest limits — what this is not. This is not end-to-end encryption and not "zero-knowledge." Specifically: (a) content must be decrypted to generate responses and is transmitted to our model provider (§6); (b) the mathematical representations ("embeddings") that power your search are encrypted at rest under your own key, as are the names of the wiki pages they point to; a small amount of search bookkeeping stored alongside them — internal record identifiers, and whether an item is shared or belongs to a particular facet — is not encrypted; and (c) certain other limited metadata is stored unencrypted. We describe these plainly rather than overstate our protections.
• No method of storage or transmission is 100% secure; we cannot guarantee absolute security. Notify us at info@hiddenprism.app of any suspected compromise.

• While your account is active, we keep your information to provide the Service.
• Deletion. You can delete individual content, reset your identity, or delete your account at any time from the app. When you delete your account, we delete your identity content — your Core and its version history, facets, conversations, Sources, uploaded files and avatars, and the derived search indexes. (Drafting note: this statement is true only once PR #181 ships; publish together.)
• What we retain, and why. We may retain limited information after deletion where we have a legal or legitimate need: billing and transaction records (for tax/accounting, for [D-2 RETENTION WINDOW, e.g. 7 years]) and security/abuse logs (for [D-2 RETENTION WINDOW, e.g. 12–24 months]). Retained records are limited to what those purposes require.
• Provider retention. Our providers may retain content briefly under their own terms (§6); our deletion does not reach copies held transiently by a provider beyond our contractual controls.
• Backups are cycled on a rolling basis and overwritten in the ordinary course.

Depending on where you live, you may have the right to: access the personal information we hold about you; correct it; delete it; export/port it; withdraw consent (including for health-data processing, §4); opt out of sale/share/targeted advertising (note: we do not do any of these); and to be free from discrimination for exercising these rights.

• How to exercise them: most rights are self-serve in the app (edit, export, reset, delete). Otherwise, contact info@hiddenprism.app. We will verify your request and respond within the time required by law. You may use an authorized agent where permitted.
• EEA/UK: you may lodge a complaint with your supervisory authority; our legal bases are in §3.
• California (CCPA/CPRA): you have the rights above; we do not sell or share personal information and do not use sensitive personal information for purposes requiring a right to limit. Categories collected and disclosed are in §2 and §6.
• Washington/Nevada/health-data laws: you may withdraw consent and request deletion of consumer health data (§4).
• We will not charge you or deny service for exercising a right, except where the data is essential to providing the Service.

We use cookies/local storage that are strictly necessary for sign-in and core functionality. [If you add analytics or any non-essential cookies, disclose them here and provide a consent mechanism for EEA/UK users — OPEN-ITEMS B4.]

If you publish a facet, the content and profile you choose to publish become publicly discoverable, and conversations visitors have with it are processed to provide that feature. Published content is not private and is not covered by Private Vault. You can unpublish at any time, which stops new public access.

We operate in the United States; our providers may process data in the US and other countries. Where we transfer personal data from the EEA/UK, we rely on appropriate safeguards such as Standard Contractual Clauses. [Confirm mechanisms with counsel; name an EU/UK representative if required — Art. 27.]

The Service is for adults. You must be at least 18. We do not knowingly collect personal information from anyone under 18; if we learn we have, we will delete it.

We may update this Policy. For material changes we will provide notice (in-app or by email) and, where the change concerns sensitive/health data or otherwise requires it, obtain renewed consent. The "Last updated" date reflects the current version.

HiddenPrism LLC · Privacy & security contact: info@hiddenprism.app (all reach-outs centralized to one inbox) · Mailing address: [Mailing address — not set]. [If GDPR applies: Data Protection Officer / EU representative contact.]

1. ◐ Entity + governing law — DECIDED 2026-07-26: HiddenPrism LLC, New Jersey (filled). Residual: [ADDRESS].
2. Ship PR #181 (accountDelete completion) BEFORE publishing — otherwise §8's deletion statement is false. Gate them together.
3. Provider terms — no-training VERIFIED 2026-07-22 (Anthropic commercial API + Cloudflare Workers AI both no-train by default, per their published terms). Remaining: confirm at HP's account level (+ zero-retention / DPA), and the provider retention windows (§8).
4. D-2 retention windows — billing (default 7 yrs) and security/abuse logs (default 12–24 mo) in §8.
5. MHMD / Consumer Health Data — counsel confirms whether §4 must be a separate, prominently linked Consumer Health Data Privacy Policy + separate authorization, and that the consent_acks gate meets the "separate consent" bar.
6. Cookies/analytics — if any non-essential cookies/analytics are used, complete §10 + add a consent mechanism (OPEN-ITEMS B4).
7. International — confirm transfer mechanism (SCCs) and whether an EU/UK Art. 27 representative is required (§12).
8. ◐ Contact inbox — DECIDED 2026-07-26: all reach-outs centralized to info@hiddenprism.app (filled throughout). Residual: provision the inbox (OPEN-ITEMS C7).
9. Attorney review — GDPR bases (§3), CCPA/CPRA disclosures (§9), and MHMD (§4) especially.