Privacy

What is kept

Your account, time zone, work-session plans, edits and checkboxes, planned minutes and tick times, plus any actual minutes, pace feedback or usefulness feedback you choose to give; separate Memory facts and deadlines; uploaded originals, extracted text and source pages; and context supplied by an agent you connect. Your session notes, transcripts and optional step cues are stored with the session and used with the plan and timer observations to write its summary. If you enable agent session activity, labelled entries supplied by your connected agent are also stored with the session and used in that summary. Agent context is untrusted and becomes lasting Memory only after you confirm it. Plan edits may produce editable guesses with their source. Guesses do not replace facts you wrote.

Plans, session notes and records, original files, extracted text and Memory are encrypted with your account's data key. An unsaved timer-note draft may also be kept in this browser tab’s session storage until saved, so it can be recovered after navigation or a failed save. Our servers decrypt the material needed to make your plan or session summary. Search matches protected word tokens; search words are never sent to usage analytics.

About you Memory and recent plan progress can inform a new plan. Files are attached by your choice for each plan; the planner does not automatically select your other uploads.

Model and service providers

• OpenAI GPT-6 Luna writes plans, extracts bounded file metadata and runs web research when needed. It receives your request and relevant sources, recent progress and Memory. Web research can send a query derived from your request to a search service.
• Anthropic Claude Haiku 5.5 reviews plans with source excerpts and relevant context, and writes session summaries from your plan, timer observations and notes. It may read the lines you changed to suggest a preference; that proposal is saved only if you accept it. Remaining review warnings can appear on the plan.
• For accounts connected in an earlier version, Kernel provided managed browsers and stored the sign-in profile needed to read bounded, read-only website context. Those records remain until the account is disconnected or deleted; disconnecting removes the owned browser profile and stored context.
• Google Gemini Embedding 2 processes text chunks for semantic retrieval through its paid API configuration. AWS S3 Vectors stores the retrieval index. Word search also works independently of embeddings.
• AWS S3 stores encrypted originals. Code reads PDF text layers; AWS Textract reads selected scanned pages or images when OCR is enabled. Our AWS account opts out of using this content to improve AWS AI services.
• Supabase provides sign-in, Postgres and database backups. Vercel hosts the web app and Fly.io runs the background planner worker. Content is processed in the United States and in locations used by the model providers under their service terms.
• PostHog (usage counts and, on the test version only, a copy of plan runs) and Sentry (errors) process the data described below.
• Paid checkout is not open yet. Stripe may retain records of an earlier subscription; Soft Axiom does not receive card details.
• If you link texting, Sendblue handles your phone number and messages. The assistant uses the configured AI model to respond; when you request web research, Tavily or Firecrawl receives a public search query or page URL. Search results are treated as untrusted content.

The plan composer may use your browser's speech-recognition feature where supported, subject to your browser provider's terms. Session voice notes use ElevenLabs Scribe when you turn the microphone on. Your audio is streamed to ElevenLabs for transcription; Soft Axiom saves the resulting text, not the audio. ElevenLabs may retain audio and transcripts when provider retention is enabled, as shown by the microphone control. The microphone is off until you start it and stops when you end voice input.

This version does not connect to or read website accounts. Records from accounts connected in an earlier version remain stored until that account is disconnected or deleted. Connected content and all its derivatives are excluded from improvement traces and telemetry.

Your own Claude or Codex can also connect through MCP. With your consent, an agent can read and change tasks and work with session timers and progress. Raw files, separately stored source excerpts and Memory are not directly exposed by default. Saved tasks or plans may contain information from sources you supplied. Writer instructions and reviewer instructions are never returned. Disconnect an agent in Settings to revoke its access.

To use texting, you link your number with a one-time code. The number and message jobs are encrypted; a keyed number identifier routes messages and records opt-outs. Completed and failed message jobs are removed after seven days by the worker. Disconnecting the number removes its link and queued or saved message jobs; a keyed opt-out record may remain to honor STOP. Sendblue and your carrier handle message delivery under their own terms. Reply STOP to opt out or HELP for help.

Usage data

The hosted planner counts how it is used so we can fix it and keep its costs in check. This is sent from our servers (there is no analytics script in your browser and no cookie for it) and contains only ids, counts, codes, timings and costs: a pseudonymous hash of your account (not your name or email), a plan's id, its requested length and break setting, how many steps and files it had, which automatic checks failed (a code such as A3, never the text), how long each stage took, which model ran with its token counts and cost, whether a web look-up ran and how many searches, and whether a plan, upload, edit, star, trash or tick succeeded or failed with an error code. It never contains your request, a goal or step, a file name or content, Memory, a preference, or a search. PostHog stores these events and Sentry stores error reports (with the plan and job ids, never any content). Neither runs on the local review build, which writes the same counts only to a file on this computer. Timer note usage is counted separately: the browser sends whether a note was opened, its length range when saved, and whether the finished session had a note, with ranges for planned and actual minutes and how the session ended. These events never contain note text, titles, or content identifiers, and are off when Help improve Soft Axiom is off. Other operational counts have no switch; the copy of your plan runs described next does. Events carry only a one-way hash of your account, no profile; deleting your account (Settings → Delete account) asks PostHog to delete the person record for that hash and its events, if one exists, and retries if PostHog is unavailable.

Help improve Soft Axiom

We keep your requests, plans and files for 30 days to fix bugs and improve Soft Axiom, which may include improving our own prompts, checks and models. Our AI providers do not train on it. You can turn this off in Settings.

This is on by default. What is kept for each plan run: your request and the options you chose, the names, sizes, types and extracted text of the files you attached, the Memory lines the planner used, any web look-ups and what they returned, every model call (its full instructions, input, reply, token counts, cost and time), the checks that ran and what they found, the reviewer's verdict, the finished plan, your edits (before and after) and any preference the planner offered. Never your API keys or sign-in details.

Who processes it: it is stored in our database, sealed with a key held by the servers, and removed automatically after 30 days. On the test (staging) version a copy also goes to PostHog's LLM analytics so we can inspect runs; that version says so in Settings. In the hosted product PostHog and Sentry never receive these contents, only the counts described above.

Your controls: Settings → Help improve Soft Axiom turns it off, which stops keeping new runs. Settings → Delete my shared data removes what is kept now. Deleting a plan removes its saved run. Deleting a file or forgetting Memory also removes saved runs that could contain copies; an in-progress run cannot restore those copies. On staging, removal of PostHog copies is requested and retried if unavailable. Ordinary saved plans and files remain available when sharing is off.

Your controls

• Edit a plan, tick work, star it and copy its text. Move a plan to the trash from its More menu. In Settings → Trash you can restore it or delete it now, which removes the plan, progress and searchable plan chunks. Trashed plans are removed automatically after 30 days.
• Memory (the button at the top of your plans) lists what the planner has learned with where each line came from (your upload, your edit, a guess or something you wrote). Keep turns a guess into a fact you confirmed; Forget removes it; Add writes a new one. Settings → Forget all Memory removes facts, pace/feedback observations and searchable plan/file excerpts; saved plan documents and original files remain until you delete them separately.
• Files → Delete removes that reference, searchable chunks and derived Memory facts. When references share an original, it is removed after its last reference is deleted. Vector removal is retried if unavailable. Saved plans lose copied source excerpts, and captured plan runs are removed.
• Guessed lines are labelled with their source in Memory; you can keep, edit or forget them. Personal pace calibration is not enabled.
• Agent progress changes are attributed and can be undone unless later edits conflict.
• Settings → Delete account removes plans, folders, Memory and originals. Original deletion is retried if storage is temporarily unavailable. Anonymous model-cost totals may remain for spend accounting; prompts and file text are not in that ledger.

Ordinary content is kept until you delete it, with the Trash and captured-run limits above. Database backups age out after seven days; a backup made before deletion can contain earlier encrypted data until it expires. Legacy product data is retained separately while archived and verified; no automatic deletion date is scheduled for that archive. Requests to access, correct, export or delete your information can be sent to privacy@softaxiom.com.

We do not sell personal information or use it for advertising. We use account content to provide the planner and, when Help improve Soft Axiom is on, for the improvements described above. Providers may retain data for abuse prevention or legal obligations under their terms. Soft Axiom is for adults 18 and older. This page is updated when practices change, with notice of material changes.