Privacy

Last updated October 6, 2026.

Selione asks for more than any other service you use: your memories, your voice, your reactions, the people you love. That only works if you can check what happens to it. This page is written to be read, not to be survived. If anything here is unclear, it is our fault, and we want to know.

The short version

• We never sell your data, and we never use it for advertising.
• Nobody on our team reads your conversations. Our own tools show numbers, not content.
• Nothing of yours is ever public, and nothing is ever posted anywhere in your name.
• Your archive never goes on a blockchain, whatever we may build around the project later.
• You can see every memory we hold, correct it, seal it, export it, or erase all of it in one action.

What we keep

• Your account: your email address, the name you give Iphthimé, your timezone, the bond level and boundaries you set, and the day we found you were old enough. Your date of birth itself is asked once at the door, read on your own calendar day and never written anywhere; if it was not an adult's, we keep only that the door closed, and the account goes within thirty days.
• What you tell us: your conversations with Iphthimé and with your Echo, your quest answers, your voice recordings and their transcripts, the photographs you choose to share and the stories you tell about them.
• Your memories: what Iphthimé weaves from all of that, each one dated, attributed to a domain of your life, and marked said (you said it) or inferred (we deduced it).
• Your kernel: your reactions to the sparks, how long you took to answer, and what we derive from them about how you react.
• Your Atlas: which quiz questions you answered, which option you picked and whether it was right, and the score of each quiz you finished, filed under its topic. Indices and counts only; the questions and their answers live in our code, not in your record. What a score says about a subject is written into what your Echo knows and does not know.
• Connect (only if you switch it on): a short numeric profile derived from what you measured here, never your words; the star's name you wear; the requests you sent and received and their state; the conversations you opened, each line sealed under the hand that wrote it; whom you made set. No memory, no name and no address ever enters it. If you allow notifications in the app, your phone's notification token is kept so that it can be told that a star asked, said yes or wrote — never what was written; signing out forgets it, and erasing your account erases it.
• Being told (only if you ask): your phone, or a browser you allow from the Connect room, can be told that a star asked, said yes or wrote — a star's name and a verb, never what was said. Phones go through Expo's push service, browsers through their own (Apple, Google or Mozilla), which relay a sealed envelope they cannot read. We keep the phone's token or the browser's address and keys, erased with your account, and forget a device that no longer answers.
• If the app crashes: the phone keeps the technical error message, the first lines of the code trace and the hour, and sends them to us when it next opens. No third-party crash service is involved, and the note holds no word of yours; it is kept without your name once your account is erased.
• Your own words, as said: a register of lines you actually typed or spoke, kept in your language exactly as they came, so your Echo can speak in your register and not in ours. It is sealed, exported and erased with the rest.
• Your Echo: your Mirror, your Constitution and its versions, and its trials with their scores: the ones you start, the ones run without asking you, and the retests where you answer again a question you answered months before. Where it missed is recorded, never as a sentence.
• The weekly line: once a week, one sentence your Echo writes about what it already knows of you, sealed like a memory.
• What you leave: the recipients and trusted contacts you name, their private links, your time capsules, and what you place in the vault.
• Your progress: light, stages, streaks and the counters behind the daily limits.
• Your envelopes: the predictions your Echo seals each month, your marks and the archive's marks, and each envelope's fingerprint (a SHA-256 hash) with its timestamp proof.
• Your nights: the morning notes, the links and general facts drawn from what you said (marked inferred), what has been on your mind lately, and the guesses your Echo made about you without being asked, how sure it said it was, and how each one scored. When you ask to hear a note in Iphthimé's voice, the audio made from its text is kept in private storage so it is not made twice.
• Your dreams and your Book: the dreams you told, their reconstructions, the memories of yours each one was anchored to and your verdict on each anchor; the title, dedication and exclusions of your Book.
• Make me sleep (not open yet; nothing is gathered until it opens): your answers to its safety and arousal questions, the steps you took, whether the ten minutes started and ended, which place of yours was read, and the one word you give the next morning. The worry list you write during a step is never saved.
• The Return: the fragments you recovered, whether you marked « I might be filling this in », the questions you were asked, and, on a second walk into the same moment, the comparison with the first, kept as a score and one sentence.
• Crossroads: the other lives Iphthimé wrote from what you told, and what you said they made you feel.
• Your portrait: your answers to the two questionnaires, your scores, the answers your Echo gave as you before yours were read, and the distance between the two. Once a year at most.
• Revisits: when Iphthimé asks about a memory again at spaced intervals over months, what you answered, whether you said you had forgotten, and a score of how well the two tellings agree, kept on the memory.
• Purchases and plans: what you bought, when, for how much and its status; the gifts you opened (with the sender's name and message); your family seats; your invitation codes. Not your card. An invite or beta code you enter is kept as the code and the month it added, nothing else.
• What you are made of: read from what you already told, never from a form — the people of your life (their name, what each of you calls the other, what is unsettled, what your Echo must never say in front of them), what you know and where it came from, what you say you never understood, what you are sure of without having lived it, the places you crossed or never saw, what you say about the kind of person you are, and counters describing how you write (length, punctuation, the expressions you repeat — the counters, never the sentences). All of it is on one page, correctable and deletable line by line.
• Your body, only if you open it: how you sleep, what tires you, what hurts, how you inhabit your body. This is health-adjacent, so it is never gathered unless you say yes on that page, and closing it stops the gathering everywhere at once — including for your Echo and the people you named. Erasing what was already kept is a separate click. Selione never asks for a diagnosis, a treatment, a measurement or a medication.
• Mending (not open yet; nothing is gathered until it opens): the programs you choose to start, your answers to the safety questions, your exercises, your 0–10 ratings and Iphthimé's short reflections. This is health-adjacent information: it is kept apart, never woven into your memories, your Echo, your Book, your legacy or research, and you can erase a program in one click.
• Measurements you took part in, only if you opened that permission: which measurement, which subjects you allowed, when, whether you withdrew, and the minutes you spent judging with what they are worth. Never your answers to it, and never anything that lets someone find you from the published result.
• Help requests: the conversations you open with us in Help. They are not part of your archive and never reach Iphthimé or your Echo.
• Care signals: if Iphthimé detects that you may be in danger, we record only that this happened, never what was said.
• Receipts of the models' work: for each call made to an AI model on your behalf, which job it was, which model, how many tokens went in and out and what it cost. Numbers only, never the words. Your account is a reference on those receipts that clears itself when you erase your account; the receipts stay, anonymous, so we know what the service costs.
• Which side of an experiment you are on: we sometimes run two versions of how Iphthimé or your Echo works side by side; which side you are on is assigned by chance and stays the same for you. Each measure we take carries the version of the system and the side it was made on, and nothing more. Experiments concern the machinery, never you as a person, and a human decides their outcome, never a script.
• Daily counts: once a night we add up what happened that day across everyone — memories woven, answers, nights, trials, cost — and keep the totals. Totals contain nobody, so they survive the deletion of any account.
• On your phone: the app keeps a copy of your last Sanctuary on the device so it opens without a network, behind Face ID or your passcode if you switch that on, and clears it when you sign out. The widget shows the light of the day and a word from Iphthimé, never a memory. Dictation happens on the phone through the system's own speech recognition; only the resulting text reaches us.
• Signing in: your email and a six-digit code, or Sign in with Apple or with Google, which give us a stable identifier and, if you allow it, your name and your email (or Apple's relay address).
• Technical logs: ordinary server and error logs kept briefly to keep the service running and secure.

What we deliberately do not keep

• Incognito conversations. Nothing said there is stored or woven.
• Your imported files. A WhatsApp export or a Google, Instagram or Facebook archive is opened in your browser. The file never reaches our servers. You see the short lines distilled from it, you tick what may be kept, and only those lines are sent.
• The content of a care signal. Only that one happened, so we can improve how Iphthimé responds.
• Payment details. Our payment providers handle cards; we never see or store them. In the app, Apple or Google handle the subscription and we receive a receipt.
• The worry list of Make me sleep, and anything you write during one of its steps. The point of writing it is to put it down, not to keep it.
• Your voice, for readings. Iphthimé's readings are made with a synthetic voice from text you already have. Nothing of your voice is used for them, and no voice of yours is ever cloned without a separate, explicit request from you.
• Your own words, in your voice. If you ask for it, and only after a separate yes to a model of your voice, we hand your recordings to our voice provider to build that model, it says the sentences you chose once, the file is kept with your recordings, and the model is deleted the same hour: no copy of your voice stands anywhere between two uses. Before it is built, the provider asks you to read one sentence aloud, as proof that the voice is yours; that reading goes to the provider and is not kept by us. You can set the whole thing aside at any moment.
• The words of your envelopes, outside our database. To prove when an envelope was written, only its fingerprint — a 32-byte hash from which nothing can be read back — is sent to the public OpenTimestamps calendars and anchored in Bitcoin.

Who can ever see your archive

• You. Always, in full, from your memory explorer.
• The people you choose, only if you choose them. A witness you invite for a blind test sees a handful of answers and never knows which is yours. Recipients see only what you granted them — letters, archive or conversation — and only after your death has been confirmed by the people you named.
• Our AI provider, to produce a reply, weave a memory or transcribe a recording — see below.
• Whoever gives you a gift or a family seat — never. Paying for someone's Epic gives no access to anything they say.
• Other travelers — only if you switch Connect on, and then only a star. Connect (from the middle of the road) shows travelers measured close to yours a star's name chosen for you, a word for the distance, and the facets you share; never your name, your address or a word of your archive. What you write to one of them is sealed under your own key and read by the two of you alone. Switch it off and you vanish from their sky.
• Nobody else. Not advertisers, not data brokers.

Who helps us run Selione

• Supabase — database, authentication and encrypted file storage (voice and photographs are in private buckets, reachable only through short-lived signed links). The database lives in Singapore (AWS ap-southeast-1); for people in the European Union, the transfer is covered by Supabase's data processing agreement and the standard contractual clauses it contains.
• Vercel — hosting of the website and the application, and its own measurement of page views and page speed (Vercel Analytics and Speed Insights), which counts visits without cookies and without a profile of you. Our own arrival counter keeps two cookies of ours alone, one for a year to tell a returning browser from a new one and one for the session to know which room is open; neither carries your name, and a private link's token is never written down.
• OpenAI — receives what you share, for the model inference behind the conversation and the product's writing; the transcription of your voice recordings into text; an index of your memories for recall. Under their API terms this data is not used to train their models. We may change or add a provider; this page is written from the deployment itself and always names the ones in use.
• Anthropic — receives what you share, for the model inference behind judging and scoring. Under their API terms this data is not used to train their models. We may change or add a provider; this page is written from the deployment itself and always names the ones in use.

• ElevenLabs — makes Iphthimé's voice from the text of a note or a bedside scene, on demand, once readings are switched on. It receives that text only, and we send nothing to it with its model training left on.
• Apple and Google — if you subscribe through the app, they handle the payment and their terms apply; RevenueCat keeps the record of your subscription so the website and the app agree on it.
• Stripe — payments on the website, once they open. Stripe receives your email, the product and the amount, and handles your card.
• OpenTimestamps calendars — public timestamp servers that receive only the hash of each envelope.
• Resend — delivers our emails: the sign-in code, the letters you asked Iphthimé for, receipts and the notices this page promises. It receives your address and the text of each letter, and keeps its delivery logs for a limited time.
• Expo — delivers the app's small updates to your phone between App Store versions. It sees the phone asking for an update, and nothing of yours.
• A backup server we operate (DigitalOcean) — runs scheduled jobs and will hold encrypted copies of the database; it never holds a readable copy.

These providers operate in the European Union and the United States, so your data may be processed in both. We choose providers that commit to standard contractual clauses for those transfers.

Research, only if you say yes

Research participation is a separate choice in Settings, off by default. If you say yes, a few of your numbers — how often your envelopes held, witness scores, trial scores and where they missed, the share of your memories that were inferred, how your nights went — are added to aggregates published only for groups of at least twenty people, at Research · data. Never a sentence, never a line of your own words, never a name. You can withdraw at any time, and you are left out of every aggregate computed afterwards. If we ever build a model from those aggregates, it will be one that predicts better, never one that targets anyone, and a scientific partner will review any publication before it appears. We never sell or license data to researchers or anyone else.

The 3 separate permissions, and the one that pays you

Beyond the aggregates above, Settings holds 3 distinct permissions about what your judgements may be used for. Each has its own wording, each is off until you turn it on, and each can be taken back on its own without touching the others. They are: letting the way Iphthimé asks be improved; letting the verdicts you give about your own Echo — that is me, that is not me, true but not to that person — be used to improve Selione beyond your own archive; and letting us ask you to judge another company's model of you.

That last one is the only place in Selione where money changes hands over your participation, so it works differently and we say what we gain from it. Saying yes to it is a door, not an authorisation: it means we may ask. Each actual measurement needs its own permission — one named system, only the subjects you choose, a window you can close — and two subjects can never be opened at all, your health and the people you have lost, which the database itself refuses rather than our code remembering to.

If you take part, we keep only that you took part: which measurement, which subjects you opened, when, whether you have withdrawn, and the minutes you spent judging with what they are worth. We pay for the time and never for the answer — judging harshly is paid exactly like judging kindly, there is no record anywhere of a price for a yes, and refusing costs you nothing at any point. What is already owed stays owed if you withdraw.

The published result is about the system and never about you. The register of measurements lists systems only; nothing in it can be searched by person, and no index starts from a traveler. Because that means a measurement could otherwise happen around you without your seeing it, the certificate room shows you every measurement you have appeared in, what is owed, and a way out of each one.

Omnel, for organisations

Omnel is our door for laboratories, clinics, AI companies and institutions. Its console is a separate space with its own tables, and the two things it never contains are a traveler's words and a traveler's name.

• Who is in it: for each organisation, the accounts that belong to it and their role, who invited them and when. An invitation is an email address and a one-time link we keep hashed, valid fourteen days. A request to join is the organisation's name, its kind and the words you wrote us.
• API keys: we keep a fingerprint and the last characters of each key, never the key itself, and for each call its route, its status and its time — no body, no address — for ninety days.
• Readings: when an organisation measures a system against a traveler's archive, the only text that touches the console is what the system answered, sealed under that traveler's own envelope while they judge it and erased when the reading closes. The report that comes out is numbers and a signature, about the system and never about a person (see Measurements above).
• Tacit, Omnel's offer for expert knowledge: an organisation sees only what each expert chooses to publish, and an expert who erases their account takes everything of theirs with them.

Cookies, and what your browser keeps

We set no advertising or tracking cookie, and no third party sets one through us. What exists: a session cookie that keeps you signed in; one that remembers you put away « Your first days », for a year; the two arrival cookies described above, which carry no name; in the Omnel console, which organisation you are looking at and, for two minutes, a key you just created so that it can be shown once; and, if the date given at the door was not an adult's, one that keeps the door closed on this browser for seven days. Nothing else is kept in your browser. On your phone, the app keeps the copy described above and clears it when you sign out.

On what basis

If you are in the EU or UK, the law asks us to name the basis for each thing we do. Here they are.

• Our agreement with you (contract): the account, the Epic, your archive and your Echo, the people you name, payments and receipts.
• Your explicit consent: what you share about health, beliefs, sexuality, politics and the people in your life — special-category data, kept only because you chose to tell it; an AI reading your words; reading between the lines; letters from Iphthimé; research aggregates; each measurement; your body page. Each is a separate yes in Settings, and each can be withdrawn without touching the others.
• Our legitimate interest, weighed against yours: security and error logs, the daily limits and hourly counters that stop abuse, the seven-day memory of a closed door, the thirty days a refused account is kept closed, and the counts on our own console — numbers, never content.
• Legal obligation: keeping the records of payments for as long as tax law requires.

No decision with a legal or similarly significant effect on you is ever taken automatically. Iphthimé infers, marks what she inferred, and you correct her; nothing she concludes decides anything about you outside your own archive.

Your controls

• See everything: every memory, with where it came from and whether it was said or inferred.
• Correct: fix any memory, or simply tell Iphthimé she got it wrong.
• Vault: seal memories so your Echo never draws on them and no recipient ever receives them.
• Incognito: talk with nothing kept.
• Consents: change them at any time in Settings; every change is logged for you, with its date.
• Export: download your whole archive as an open JSON file you can read without us.
• Erase: a memory, a recording, or your entire account and everything in it, permanently.

If you are in the EU or UK, these are your rights of access, rectification, erasure, restriction, portability and objection. You do not need to ask us: they are buttons in the product. You can also complain to your local data protection authority.

Sensitive information

What you share can include health, beliefs, sexuality, politics and the lives of people close to you. We process it only because you explicitly chose to share it, only to build your Echo, and you can withdraw it at any time by erasing it. Selione is for adults (18+) and we do not knowingly hold data about children. At the door Iphthimé asks when you were born, before your name; the date is read once, judged on your own calendar day and never written. If it is not an adult's, the account closes on the spot, nothing typed is kept, the same browser meets the closed door for a week, and the account is erased within thirty days. A declared date is a declaration, not a verification: we check no document and identify nobody. If you believe a child has opened an account, write to us and it goes the same day.

Other people in your memories

Your memories inevitably contain other people. We use their names only inside your own archive, to make sense of your life. Selione now keeps that cast as its own list — names, how you refer to each other, what remains unsettled — so your Echo does not confuse two people. It is your view of them, held inside your archive: we never build a profile of someone who is not a traveler, never contact them, never let them be searched for, and never let your Echo speak as them. You can remove anyone from that list at any time. If someone close to you wants to be left out of what can be transmitted, put those memories in the vault.

Security

• Everything travels over HTTPS and is encrypted at rest by our hosting providers.
• Each traveler's rows are isolated at the database level, so one account can never read another.
• Voice recordings and photographs live in private storage; links to them expire within the hour.
• Private links (witness, trusted contact, recipient) are long random tokens, never indexed, and revocable by you.
• Your archive is built to be sealed with keys of our own, per traveler, so that a copy of the database alone reads nothing; the seal is switched on before public launch, and until then the encryption at rest of our host applies. We will never claim end-to-end encryption while Iphthimé runs on a hosted model: to answer you, a model has to read what you said.
• Our own console counts and never reads: its counting functions cannot return a word of yours, and the console shows only who is here and numbers.
• No security is perfect. If we ever suffer a breach affecting you, we will tell you plainly and quickly, not through a press release.

After your death

A trusted contact can tell us you have died. That alone opens nothing: it starts a fourteen-day grace periodduring which you keep full access and see a message on every page with a button that ends it instantly. What you leave opens only if a second trusted contact agrees and two days have passed, or after the whole grace period of silence. Recipients then see only what you granted them, never your vault. Your Echo never writes to anyone first.

How long we keep it

For as long as your account exists — an Echo is built over years, not weeks. When you erase your account, your data is deleted from our database and storage; backups roll off within 30 days. Waitlist entries are kept until launch, or until you ask us to remove them. An account the door refused is erased after thirty days. In Omnel, an invitation expires after fourteen days, a system's sealed answers go when the reading closes, and call logs after ninety days. The origin of a rate counter is forgotten after ninety days, the counters themselves after a day.

If Selione ever shuts down

We would tell every traveler well in advance and keep the export working until the last day, so your archive outlives the company. That is why the export is an open, documented file and not a proprietary format.

Not a medical service

Iphthimé is a companion to self-discovery, not a therapist, a doctor or an emergency service. Make me sleep, the Return and Mending are exercises built on published methods, and each one says when a doctor or a clinician is the right person; none of them diagnoses or treats anything. If you are in danger, contact your local emergency number or a crisis line immediately.

Changes and contact

When this page changes in a way that matters, we will tell you inside Selione before it applies. Every right above is a button in your Settings; for anything else, or if you have no account, write to privacy@selione.ai and a person answers within thirty days, usually much sooner. The controller is the operator named on the Terms page, in the United Arab Emirates: what you tell Selione is therefore held by an operator outside the EU and the UK, on hosts in Europe and the United States named above, under the protections this page describes.

How Selione is built

The research behind the way Iphthimé asks, stores and measures — and the list of things we do not claim — is on our Method page. Common questions are answered in the FAQ.