Council
Privacy notice

What stays
between you and the page.

Plain-English summary first, full notice below. Council is built local-first: your entries live on your phone, and Council sends the minimum to the cloud to generate replies. Council doesn't sell anything to anyone.

Council is a private notebook, built to keep being one even when it talks to the cloud.

§ 01The short version

  • Your journal entries stay on your device. There's no account to create and nothing to sign in to.
  • When you summon the council, the text of your current entry — and only that entry — is sent to Council's inference provider to generate the replies.
  • Council doesn't sell data and never trains models on what you write. Anonymous analytics (page views and crash reports, via PostHog) are the only thing measured — never the content of your entries.
  • Delete an entry on your phone and it's gone. Nothing is sitting on a server with your name on it.

Council has no cloud sync and no account system — and that's a deliberate choice, not a missing feature. The moment a journal lives on someone else's server, it stops being only yours: it can be subpoenaed, breached, or quietly mined. Keeping your entries on the phone means the safest place for what you write stays the place it already is — with you.

§ 02What Council collects

On your device

Your entries, your council sessions, and an optional first name all live on your phone. None of it reaches Council's servers, because there's no account and no server holding your notebook.

Sent to Council's servers, only when you ask for a council session

  • The single journal entry you're consulting on.
  • Which voices you selected.
  • The configuration (custom names, tone) of those voices.

Anonymous analytics

  • In the app: page views and crash reports, via PostHog. No journal content, no PII, no ad identifiers.
  • On this website (council.artiomleo.com): page views via Google Analytics. An anonymous visitor ID (in a _ga cookie) lets returning visitors be distinguished and basic engagement measured. No advertising signals, no behavioural targeting, no cross-site tracking, and never journal content.

Council never collects

  • Your contacts, calendar, photos, or location.
  • Voice memos are transcribed locally on your phone. Both the recording and the transcript stay on the device until you delete them. Nothing is uploaded.

§ 03Why Council collects it

The main reason is to make the product work. Your entry has to leave the device to be read by a language model; voices have to be configurable to feel like yours. That's the entire list.

Under the GDPR (Art 6), the legal basis for sending an entry to the inference provider is performance of the service you've asked for. The anonymous analytics rely on legitimate interest — keeping the app stable and crash-free — and never touch the content of what you write.

§ 04Your rights

You can, at any time:

  • Export every entry and every council session as plain text or a JSON archive.
  • Delete any entry, or everything at once, straight from the app. Because it all lives on your device, deletion is immediate and complete.
  • Object to specific processing — write to privacy@artiomleo.com and Council will act within a week.
  • Take it elsewhere. The export is human-readable. Council doesn't consider your writing its own.
  • Complain. If you're in the EU or UK, you have the right to lodge a complaint with your local data-protection supervisory authority.

§ 05Age & children

Council is intended for people 13 and over, and you must be at least 13 to use it. It isn't directed at children under 13, and it doesn't knowingly collect anything from them — there's no account, and the only data that ever leaves the device is the single entry you choose to consult on. If you believe someone under 13 has used Council, write to privacy@artiomleo.com and we'll help. If you're under 18, the note on our safety page is worth a read.

§ 06Retention

Entries stay on your device until you delete them. When you summon a council session, the entry is held in memory just long enough to generate the replies, then dropped. Beyond that, Council's proxy server retains no copy of what was sent — request and response bodies are stripped from the logs, and there's no metadata table linking your device to the things you wrote.

§ 07Subprocessors

Council is independent, and the list of vendors involved is intentionally tiny.

  • Inference — a commercial LLM provider under a no-training agreement. Each entry sent for a session is held for the duration of the request and discarded. Where this provider processes data outside the EU/UK, transfers are covered by Standard Contractual Clauses or an equivalent safeguard.
  • Distribution — the Apple App Store. Council never sees your Apple ID or any payment information.
  • App analytics — PostHog, hosted in the EU (Frankfurt). Anonymous device ID, page-view counts, crash captures. Never your journal content. No PII. No behavioural targeting. No ad SDKs.
  • Marketing-site analytics — Google Analytics 4 (Google LLC), on council.artiomleo.com only. Anonymous visitor ID stored in a _ga cookie, page-view counts, and basic engagement metrics. No advertising signals, no behavioural targeting, no cross-site tracking. Never journal content.

§ 08Reach us

The fastest way is privacy@artiomleo.com. Replies come within a few business days. Council is independent — no parent company, no data broker.