Athena Privacy Policy

Effective date: 14 August 2026 (updated 1 November 2026)

Questions: privacy@athenaos.net

Athena exists to help you keep your attention where your life needs it. That only works if you can trust it with context about your life. This policy explains — in plain language — what we collect, what we do with it, and what we will never do with it.

Who your data belongs to

Everything you give Athena — and everything Athena writes back to you — is yours. Your notes, your memories, your briefings, the picture Athena builds of your life: you own all of it. We hold it only to run the service for you, and you can take all of it with you or have all of it deleted, at any time, directly in the product.

Our infrastructure providers gain no rights to your data. When Athena sends context to an AI model to compose your briefing, the inputs (words, voice, files and anything that goes in) and the outputs belong to you — the provider processes them to serve your request, does not use them to train its models, and does not use them for any purpose of its own.

What we collect

Account information. Your email address, used for self-serve sign-in and for the occasional email described under 'Emails from us'. We use one-time codes and magic links; we never see or store a password.

What you choose to record. Notes you type or dictate, questions you ask, answers you give during onboarding, files you upload, and feedback you provide. This is the heart of Athena — and it is yours. Athena extracts structure from it (commitments, context, things worth remembering) solely to serve it back to you.

Phone shortcut (optional). If you set up a Siri shortcut or an Android automation, the text it sends arrives as an ordinary note, over a personal capture token you can revoke in Settings at any time; the token itself is stored only as a hash.

Voice. Athena stores no audio. When you dictate a note or talk to Athena in voice mode, your speech is sent to a speech-to-text provider and the transcript comes back; Athena keeps the transcript, never the recording. Speech is processed by ElevenLabs and OpenAI under their terms (which provider handles a given request is listed under 'Who processes data on our behalf'). Athena's spoken replies are generated from text by the same providers and are not stored either. What you said and what Athena said in a voice conversation are kept as ordinary conversation messages marked as spoken. For each voice session we also keep counts only (how long it lasted, how many turns and interruptions) and no words.

Files. When you upload a file, Athena reads it once to propose what's worth keeping. Nothing from a file enters your record unless you explicitly confirm it, item by item. Content you reject is not stored.

Calendar (optional). If you connect a calendar, access is read-only. Athena keeps a short rolling window of upcoming events to give your briefing context. Calendar events are never converted into your long-term record, and disconnecting removes the cached events immediately. Connection credentials are stored encrypted.

Google Calendar (optional, opt-in). You can connect Google Calendar from Settings. Athena asks Google for read-only calendar access only (the scope named calendar.readonly), reads event times, titles and locations from the calendars you choose, and uses them for one purpose: to shape your briefing and answer your questions about your day. Athena never creates, changes or deletes events, never stores calendar events as part of your long-term record, and never passes Google data to advertising, model training or any other party. Disconnecting revokes Athena's access at Google and removes every synced event at once. Athena's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Service data. Basic operational records — such as whether a note was saved, a briefing was generated, a task was completed, or a connection was configured — and how much AI processing your account used. These records do not contain the words you write, file names, task titles, contact details, or other personal content. We use them to run the service reliably and understand whether Athena's core features work. This is product telemetry, not behavioral profiling, and it is never used to target, rank, or advertise anything to you.

When analytics are enabled for Athena, these product events are also processed by our hosting provider's built-in analytics service (Replit). It sets no cookies and does not use identifiers that track you across sessions; visitor counts are approximated from network and browser data. None of this is your name or email, and none of it is linked to your account content or anything you have written in Athena.

What we do with it

One thing: we operate Athena for you. Your data is used to generate your briefings, answer your questions, resurface what matters, and improve the reliability of your own experience.

Emails from us

Besides the notifications you choose, you may now and then hear from Athena's founder: a welcome when you join, a short personal note if signing in or setting up didn't go smoothly, a question about what would make Athena useful to you, and news when Athena reaches a real milestone. The welcome and two short notes at moments you cause are automated; everything else is written by hand, one message at a time, never a sequence. These emails are rare and carry no tracking. To choose who to write to, the founder uses only your email address and basic service data, such as whether you finished setting up; never anything you have told Athena. Reply "stop" to any of them and you will not receive them again.

What we never do

• We never sell your data, in any form, to anyone.
• Athena has no ads. We never share your data with advertisers or data brokers.
• We never use your content to train foundation AI models, and we contractually rely on processor terms that prohibit our processors from doing so.
• We never read your content except as needed for security reasons, to address a specific issue reported by you, or to comply with law.
• Athena never sends notifications to win back your attention. Its notifications are only the ones you agreed to: your morning briefing, an evening question, and reminders of commitments you anchored to a time. Emails from the founder are described above, and one reply stops them.

Who can see your data

Your data is read by Athena's systems to serve you — never by a person as a matter of routine. No one browses it or reads it as part of normal operations; human access happens only in the specific circumstances below.

In practice, access to the production database is limited to one person: Athena's founder. There is no team with database rights, no support staff reading accounts, and no third party that can log in. That access exists only for emergencies — a genuine security or technical issue, helping you directly with your own account at your request, or when a regulator or the law requires it. That is the complete list.

Our processors (listed below) see only the data in motion that serving your request requires — an AI provider receives the context needed to compose your briefing, holds it briefly under its own safety and retention terms, and gains no rights to it. None of them can browse Athena's database.

One honest limit: Athena is not end-to-end encrypted, and no product that thinks about your data on a server can be — a system that composes your briefing must be able to read what you told it. We compete on being provably fair with your data, not on claims that can't survive scrutiny.

Who processes data on our behalf

Running Athena requires a small number of infrastructure providers ("processors"). This is the complete list of the ones in use, each with its job and the data it sees:

• Supabase (Frankfurt, Germany): the database, sign-in and file storage. Holds your account email, everything you record, and the files and briefing audio you choose to keep. Encrypted at rest and in transit.
• Anthropic: the AI models that read your context and compose your briefings and answers. Receives the text context a request needs (notes, memories, tasks, calendar context, conversation history). Under Anthropic's commercial terms API data is not used to train its models and is deleted within 30 days.
• OpenAI: speech-to-text for dictated notes (Whisper), the backup speech-to-text in voice mode, and a standby voice for spoken replies that is not used unless we switch to it. Receives the audio of a dictation and, in voice mode, the live audio when the primary provider is unavailable. Under OpenAI's API terms this data is not used to train its models and is deleted within 30 days.
• ElevenLabs: the primary speech-to-text in voice mode, the backup for dictated notes, and the voice that reads your briefing, acknowledgments and answers. Receives the live audio of a voice conversation, the audio of a dictation when the primary provider fails, and the text it turns into speech, under ElevenLabs' terms linked above.
• Resend: email delivery. Receives your email address and the content of each email Athena sends you (sign-in codes, the welcome, and the briefing, evening question and milestone notes if you choose email), and the replies you send to those emails.
• Cloudflare (R2): encrypted off-platform backups. Receives a weekly copy of the database tables, kept for four weeks on a rolling basis, encrypted at rest.
• Replit: application hosting. Runs the server that handles every request, and the cookie-free analytics described above.
• Microsoft (Outlook calendar API), only if you connect an Outlook calendar, under a read-only permission you grant directly. Athena reads upcoming events and stores the connection credential encrypted.
• Google (Google Calendar API), only if you connect Google Calendar, under a read-only permission you grant directly and can withdraw at any time. Same treatment as Outlook.

We share with each processor only what the job requires, and nothing else. Anthropic and OpenAI process API data without training on it and delete it within 30 days under their published terms; speech sent to ElevenLabs is processed under ElevenLabs' terms. No processor acquires rights to your content through our use of it.

Security

Athena's database runs in the European Union (Frankfurt, Germany). Data is encrypted in transit and at rest. Calendar credentials are encrypted at rest with modern authenticated encryption. Deleted content is erased from live systems immediately and ages out of rotating backups within four weeks.

Retention and deletion

Your data is kept while your account is active, because remembering is the service. Some content expires automatically by design — Athena deliberately forgets what is no longer relevant.

You can, at any time:

• Delete your account and all associated data directly in the product (Settings → Delete account). Your account and data are permanently erased immediately. Encrypted backups rotate out within four weeks. This cannot be undone. Aggregate, non-personal deletion statistics (such as how long the account existed and how far onboarding got — never your email, name, or any content) are kept so the service can be improved.
• Export a complete copy of your data directly in the product (Settings → Export my data) — a single portable file containing your notes, memories, tasks, conversations, briefings, and reflections. Not a summary: everything Athena holds for you.
• Correct anything Athena has wrong — directly in the product, or by email.

If you would rather make any of these requests by email, write to privacy@athenaos.net and we will handle it.

Your rights

Depending on where you live (including under the EU/UK GDPR and the UAE Personal Data Protection Law), you may have legal rights to access, correct, export, delete, or restrict the processing of your personal data, and to complain to a supervisory authority. We honor these requests for all users, wherever they are, via the contact below.

Children

Athena is not intended for anyone under 18, and we do not knowingly collect data from minors.

International transfers

Athena's processors operate globally; your data may be processed outside your country of residence, safeguarded by the processor terms described above.

Changes

If this policy changes in a way that matters, we will tell you directly — in the product or by email — before it takes effect. We will never quietly downgrade a promise made here.

Contact

You can reach us at privacy@athenaos.net.

Athena is free while it's small. This policy applies in full to every account, however you signed up.