How Interperson handles your data

The short version

• Your messages and call history are read on your Mac and stay there. Their words are never uploaded, and they are never sent to an AI company. Interperson's AI runs on your Mac.
• Everything that travels between your own Mac and iPhone (your Today note, your sky, memory cards, photos, chapters, per-person relationship analysis, your journal, your chats with Ally, private plans, check-ins, goals, and relationship declarations) is end-to-end encrypted. Our server cannot read it.
• Shared plans, invitations, connections, introductions, Sparks and dispatches are stored on our server so the people you share them with can see them. When a web share link includes a fragment encryption key, its titles and details are decrypted locally in your browser without sending the key to our server.
• We never upload your contacts' names or photos. Contact phone numbers and email addresses are turned into blinded cryptographic tokens for matching, and the mapping back to your address book is end-to-end encrypted between your own devices.
• No ads, no trackers, no data brokers. We don't sell or rent anything about you.
• You can download what our server keeps about you, and delete your account, from Settings in either app.

What stays on your Mac

With your permission, Interperson for Mac reads Messages, your call history, Contacts, Calendar and Photos on that Mac. The reading happens on the Mac, and so does the thinking: the AI model runs locally (it is downloaded once, from Hugging Face, when you set the app up). Interperson never hands your messages to an outside AI service.

These stay on your Mac and are never uploaded:

• The text of your messages, and the search index built from them.
• Your call records (who, when, how long).
• What Interperson finds in Photos: the days and places you spent with people, and the people Photos has named.
• Ally's memory: what she has noticed, the patterns she has learned, the shared moments she has found, and what has and hasn't worked for you.
• Addresses and places mentioned in your messages, and the record of the get-togethers your messages talk about.

Two narrow things leave the Mac to turn words into places: to put an address or a shared location on the map, the Mac asks Apple's geocoder (it sends the address text or the coordinates, never who they belong to or the message around them), and to find a venue it asks Apple Maps with an activity and an area.

Interperson's AI features run only after you turn them on. If you turn them off later, the Mac stops and removes the sealed AI-written views it had synced to your iPhone (described below).

Note to Self (optional)

Off by default. If you turn on "Read my Note to Self" in Settings, Ally reads what you text yourself on that Mac, read-only, and answers in the Ally chat, never by text message.

What stays on your iPhone

Interperson for iPhone never reads Messages or call history. With your permission it reads Contacts, Calendar and Photos on the iPhone, and it runs no AI model of its own.

• Without a Mac, your iPhone builds its own daily note on the device, and the note stays on the iPhone.
• Photos are read on the iPhone for where and when they were taken. To name a place, only its rough area is sent to Apple. A photo leaves the iPhone only if you choose to post it in a dispatch or on your outward introduction card.
• Birthdays are read from your address book and used only on the iPhone.
• To suggest ideas, the iPhone sends the city you typed to Apple's geocoder, and an activity and an area to Apple Maps. It never asks for your location.

Between your own devices

When you use both apps, your Mac and iPhone keep each other up to date using end-to-end encryption.

End-to-end encrypted

Each of your devices keeps its own private key in its Keychain, and seals your personal views and notes for your other devices before they leave. Our server only ever holds sealed envelopes (for at most 14 days) and sealed blobs, and cannot read them:

• Your Today note, written by your Mac: who to reach out to and a suggested first line, replies you owe (as a short paraphrase, never the sender's words), plans coming up, ideas, and social wellbeing.
• Your sky, memory cards, photos, friend groups, chapters, year and Ally's ideas: the views your iPhone shows, including any memory-card photos you choose to sync (resized, with location and camera data stripped, and sealed before upload).
• Per-person analysis and relationship declarations: closeness scores, message counts and dates, shared group chats, interests, AI-suggested relationship tags, and the relationship labels and family roles you set.
• Your chats with Ally: what you ask and what she answers from either device. Our server sees only queue timing metadata so your Mac knows when to answer; the message text is sealed end-to-end between your devices.
• Private plans, check-ins, and goals: plans you haven't shared with others, your "How was it?" feelings and notes, and your goals and reminders.
• Your journal, eras, milestones, and "What matters" answers, plus corrections and preferences you give Ally.
• Your contact handle map, so your Mac and iPhone agree on which contact ID belongs to which phone number or email address without exposing raw contact handles on our server.
• The detailed text of notifications (such as the morning note and Ally's chat reply preview) when you have "Show details" on.

Account & presence metadata on our server

To operate your account, route encrypted messages between your devices, and support features you share with other people, our server stores minimal account metadata:

• Your profile: your name, verified phone number, the interests you entered, sharing settings, notification settings (with your time zone, for quiet hours) and whether AI features are on.
• Whether your Mac is awake: its app version and heartbeat times, so the iPhone can tell you if Ally can answer immediately. Nothing about people or content.
• Device public keys and sync receipts: the public keys your devices use to seal data for one another, and digest-only idempotency receipts.

Sharing with Ally

When you share a photo, link or a few words to Ally from your iPhone's share sheet, it is sealed end-to-end on the iPhone for your own Macs. Our server holds only the sealed envelopes, plus the usual chat-queue timing metadata, for at most 14 days, and deletes each one once its Mac has received it. The Mac that answers deletes its temporary copy once Ally answers; any other Mac on your account deletes its copy within about two weeks. Nothing is sent to a third party for Ally: your iPhone fetches a link's preview straight from that link, as Safari would, and your original photos are never touched.

Your contacts

To recognise the same person on your Mac and your iPhone, and to know when a friend also uses Interperson, each app turns the phone numbers and email addresses on your address-book cards into blinded cryptographic tokens (keyed HMAC-SHA256) and receives a contact id for each person. Names, photos, and raw phone numbers or email addresses for your contacts are never stored in plaintext on our server: each device puts names back from its own Contacts and syncs the raw handle mapping end-to-end encrypted with your other devices.

Nobody can browse these entries. Your account can see only the entries linked to your own contacts, and nobody can see which tokens belong to Interperson users. If the same person is in two users' contacts, both are linked to one shared entry, but neither can see the other's link.

Your own verified phone number is what lets the people who already have it in their contacts find you. If you and another Interperson user each have the other's number, your accounts are connected automatically. You can remove a connection at any time.

What other people can see

Some features exist to share with other people, so what you put into them is stored on our server for them. Each person sees only what the feature shows, and only through checks on our server:

• Your name. Your connections and the people you invite see the name you gave at sign-up, usually only the first name.
• Shared interests and Sparks. When you connect with a friend and allow sharing with connections, you can see interests you have in common. If you post a Spark (an aspiration or interest you'd like to do with friends), connections in the audience you choose can see it and reply.
• Friend introductions and 2nd Degree discovery. You can optionally create an outward friendship card (your first name, a short bio you write yourself, curated interest tags, and an optional photo and city you choose). Nothing from your messages or Ally's analysis goes onto this card. Your card is shown only when a mutual friend introduces you to someone they know, or when you opt into 2nd Degree discovery (available to users 18 and older) to browse and exchange invitations with friends of friends across two accepted connections. Neither side sees the other's contact details unless both accept.
• Busy days. If sharing is on, connections in the audience you choose see which days and parts of days you're busy. Never what, where or with whom. Plans Ally found in your messages are never included. You can turn it off in Settings.
• Plan invitations. When you share a plan invitation link, the plan's title, place, and days on offer are shared with people who hold the link (and when the link carries a URL fragment key after the #, which browsers never send to our server, encrypted details are decrypted locally in the browser). Anyone with the link sees the days on offer and the first names of the people who answered. Someone without the app can answer on the web with a first name they type.
• Dispatches. A short daily post you choose to send (a line, a mood, a place without a street number, an optional photo with its metadata stripped). Connections in your audience see it for 24 hours after it's delivered. You can mention people only if they allow it.
• Year nods and "Our story" heads-ups carry only who sent them, to whom, and for which year or card. A heads-up link can also encrypt its display details in the URL fragment for whoever holds the link.
• Initials. If you ask to appear as initials on other people's shared cards, their apps can check whether a given phone number belongs to someone who asked.

What Ally learns from your messages is never shown to anyone else.

Notifications

Notifications reach your iPhone through Apple's push service. Our server keeps your device's push token while notifications are on, and sends each notification itself. By default a notification has a fixed, neutral wording ("Ally replied"). With "Show details" on, detailed lines from your Mac (such as the morning note and the preview of Ally's reply) are end-to-end encrypted for your iPhone and decrypted on your device when the notification arrives. For multiplayer notifications (such as when a friend votes on your shared plan), our server erases the notification line as soon as it is sent or expires, and deletes the record after 7 days.

Services we use

We keep this list short on purpose. None of these receives your messages.

• Supabase hosts our database, sign-in, file storage and server functions in the United States (Ohio). Everything described on this page as "on our server" lives there.
• Twilio sends sign-in codes by text message for our server, and receives your phone number and the code to deliver it.
• Apple delivers notifications (Apple Push Notification service) and answers place lookups (Apple Maps and its geocoder). Weather for ideas comes from Apple's WeatherKit through our server: Apple sees our server, not you, and only a point rounded to about 11 km and a time zone.
• Ticketmaster supplies events for ideas, through our server: it sees our server, never you, and only a city, a few event categories and a date range.
• Cloudflare hosts this website, the Mac download and the Mac app's update feed.
• Hugging Face hosts the AI model files the Mac downloads once at setup. Nothing about you is sent.
• Microsoft 365 handles email sent to [email protected].

No ads, no tracking, nothing for sale

The apps contain no advertising, no ad or tracking libraries and no third-party measurement tools, and never ask for Apple's advertising identifier. We don't sell, rent or trade any of your data, and we don't use it to target ads anywhere.

We count two things, without names: which kind of share link (a card, a plan, an invite) brought each new account in, and how many times each kind of link was opened per day.

If you choose to send us setup notes from Settings, Mail opens with a draft of ids and times; nothing is sent until you press Send.

This website

• The home page uses Cloudflare's visit counter, which counts page views without cookies and without identifying you. No other page runs it.
• Invitation, heads-up and plan pages ask our server about the code in their link, decrypt any fragment-encrypted details locally in your browser without sending the key to our server, and keep the code out of the page title and your browser's storage.
• The plan page keeps one random key in your browser per plan, so it can show your earlier answer if you come back.
• The Mac download page asks for your email address, stores the email address with the release name and time in our private Cloudflare download bucket so we know who has the app, counts completed download starts by release name without any cookie, IP address or browser identifier, and sets one cookie (holding only a signed time, never your email) so you don't have to enter your email again for 7 days.
• The site loads no fonts, scripts or images from anyone else.

How long we keep things

Your account and what it keeps are stored until you delete them. Some things go sooner on their own:

• Encrypted relay envelopes between your devices: at most 14 days.
• Dispatches: deleted 72 hours after delivery.
• Plan invitations and their answers: 30 days after the last day on offer, or after the plan is cancelled.
• Friend introductions and 2nd Degree invitations: unanswered requests expire after 7 days; closed requests clear their note after 30 days and are deleted after 90 days.
• Notification records: 7 days; their detailed line is erased once sent.
• Year nods: 1 March of the following year.
• "Our story" heads-up requests: 30 days if unanswered.
• Counts of calls to our idea services: 2 days. Daily counts of link opens: about 13 months.
• Your sealed Today note and AI-written views: removed when you turn AI features off.
• Standard security and sign-in logs kept by our hosting providers (such as IP addresses and request times): rotated automatically by Supabase and Cloudflare according to their platform retention schedules.

Deleting your account

In either app, Settings has Download my data, a copy of what your account keeps on our server as one file, and Delete my account.

Deleting your account erases, on our server, your profile and sign-in, your contacts' entries that nobody else is linked to, your contact links and close marks, shared plans, check-in and goal sync records, chat queue metadata, sealed blobs and encrypted relay messages, connections, introductions, 2nd Degree cards and requests, Sparks, invitations, dispatches, encryption keys and notification settings. Our server keeps a list of every place it stores your data, and deletion works through that list; our tests refuse any new kind of stored data that isn't on it. Where your data sits on someone else's record (you voted on their plan, or they mentioned you), your part is removed and theirs is left alone.

On the Mac you can also choose Also erase this Mac's copy, which removes everything Interperson keeps on that Mac (Ally's memory, your relationships, the search index and settings). Your Messages, Contacts and Photos are not touched. The iPhone erases its own copy when you delete your account.

Friends who have you in their contacts keep their own entry for you. Nothing of theirs changes.

Questions, your rights and changes

Interperson is operated by Ally AI, Inc., 100 S 9th St, Brooklyn, NY 11249. Write to [email protected] with any question, or to ask us to access, export, correct or delete your data. We'll answer within 30 days.

Depending on where you live (including under the GDPR, UK GDPR and California privacy law), you have the right to request access to, a portable copy of, correction of, or deletion of your personal data, to object to or restrict certain processing, and to withdraw consent for optional features at any time in Settings. We do not sell or share your personal information for cross-context behavioral advertising, and we will never discriminate against you for exercising your privacy rights.

Interperson is not directed to children under 13 (or under 16 where required by local law, such as in the European Economic Area and the United Kingdom), and we do not knowingly collect data from them. Participating in 2nd Degree discovery requires confirming that you are 18 or older.

If we change how we handle your data, we'll update this page and its date, and for a significant change we'll tell you in the app first.