Twelve kinds of information.
Everything Ridgeback writes down about a household falls into one of these. The table says where each one sits, who can see it, and whether the AI ever reads it.
| What it is | Where it sits | Who can see it | Does the AI read it | How long it is kept |
|---|---|---|---|---|
| Your login Your email address and a scrambled copy of your password. | Ridgeback's own database. | Only you. Nobody in your household can see another member's login. | No. It is never part of a question sent to the AI. | Until you close your account, then gone within 30 days |
| What Bobby knows about you Your name, how you like to be spoken to, and anything you have told it about yourself. | Ridgeback's own database. | People in the households you belong to. | Yes, so it knows who it is talking to. | Until you change or erase it, then gone within 30 days |
| Which houses you belong to Your place in each household and what you are allowed to do there. | Ridgeback's own database. | People in the same household. | No. What you are allowed to do is never shown to the AI. | While you are a member. |
| Messages in the house thread Everything anyone types, and everything Bobby says back. Each way in keeps its own thread, so a message stays where it was written. | Ridgeback's own database, plus a short queue that delivers them to everyone's phone. | Everyone in that household. | Yes. Recent messages are what it answers from. | Until deleted, then gone within 30 days |
| Photos The pictures themselves and the smaller copies made for browsing. | A storage bucket your household picks. Your phone sends the picture straight there, so it never travels through Ridgeback's own servers. | People in the household the photo went to. | decision Reading pictures is not built yet. | Until deleted. It sits in your household’s own bucket |
| A calendar subscribed to from another app When a member subscribes Apple Calendar, Google Calendar, Outlook or any other calendar app to a Ridgeback calendar, that calendar's event titles, times and locations are sent to that app's provider. | Outside Ridgeback, with whichever company runs the calendar app: Apple, Google, Microsoft or another. Ridgeback keeps only a scrambled copy of the link that lets the app fetch it. | That provider, and anyone holding the link. It is made on a member's own choice and never by default; rotating or removing the link in the app stops it. | No. The feed is a copy read by the other app, not something the AI is shown. | Until the link is rotated or removed. What the other provider keeps after that is governed by that provider, not by Ridgeback. |
| Who is online Which people are connected right now, and from which app. | A short-lived store that forgets on its own. | People in the same household. | No. | Until you close the app. |
| Reading text and speech When Bobby reads words out of a photo, or turns what you say into text. | Your own phone does this work. | Only you, until you send the result. | Only if you send the result into a thread. | Ridgeback keeps nothing unless you send it. |
| How the apps are used A count of something happening in an app: it was opened, a registration finished. The name of the thing, never what was said or typed. | Ridgeback's own service. A count carries a random number made on your device and nothing that names you. | The people who run Ridgeback. Nothing in it points at you, so it cannot be shown back to you as yours either. | No. | retention Decided at 30 days for the raw counts, with the totals left behind kept. Nothing removes anything on that schedule yet, so today it is all still here. |
| Fault records Notes the service writes down when something breaks. | location | access | decision | retention |
| Sharing your location with a home Which home or homes you have turned location sharing on for, when you turned it on, and, in safe mode, who turned it on for you. | Ridgeback's own database. | People in the home you share it with. A different home you belong to sees nothing unless you turn sharing on there too. | No. Whether you are sharing is checked by the server before Bobby is asked anything. | While sharing is on. Turning it off, leaving or closing the home, or being forgotten ends it. |
| Where you last were One spot: your phone's latest reported position, gathered in the background while sharing is on. | Ridgeback's own database. Only the latest report is kept; each new one replaces it. | People in the home or homes you share it with, on that home's tracker. | Only to say you are home or how far away. Bobby never reads or says coordinates. | Until sharing ends, then cleared: the position itself, not just the record of it. |
Why the photo row names no company
Your pictures go straight from your phone to a storage bucket, without passing through Ridgeback on the way. That means the bucket is a setting rather than a part of the plumbing, so each household points Ridgeback at storage it chooses.
Pick your own and the storage bill, the country the files sit in, and the company holding them are all yours. The trade is that you are the one choosing a provider you trust, and Ridgeback cannot make that choice for you.
Ridgeback will also offer a bucket it holds for you, at a price, for households that would rather not choose one. Whose hardware sits underneath it, and what it costs, is not decided yet. The export has to work the same either way, or the convenience is a trap.
Why location sharing keeps only one spot
Turning sharing on tells your phone to report its position in the background until you turn it off. The server keeps only the latest report, and three separate things have to hold for any of it to exist at all: your phone has to be told to gather it, the server has to accept it, and the server has to go on keeping it.
Without permission, background location data for sharing location is not stored. A report sent with no active share is refused and nothing is written. And when your last share ends, whether you turned it off, left or the home closed, or you asked to be forgotten, your stored spot is cleared in that same step. Only the latest spot ever exists, so there is no history sitting behind it to leak.
Nothing in the list matches that filter.
What the AI sees when it answers you.
Bobby reads the recent messages in the thread you asked from and what it knows about you, then asks an AI to write a reply. That question is the only thing the AI receives.
Three things are never in it. Your password. The settings that decide what each person in the house is allowed to do. And anything belonging to another household. The third one is worth separating from the other two, because it does not depend on anyone remembering a rule.
Every question Ridgeback asks its database carries the name of one household, and there is no version of the question without it. If the name were ever left off, the answer would come back empty rather than coming back with another family's information.
Ridgeback also checks for duplicate photos only inside your own household. Checking across every household would save space. It would also mean Bobby could tell you that a picture you just uploaded already exists somewhere else, which is something about a stranger you should not be able to learn.
Answering is not the same as learning
When the AI writes your reply it reads the question and then forgets it. It holds nothing between one question and the next. Nothing in the way Ridgeback is built today copies your household's messages into the material an AI gets trained on.
That describes how it works now. It is not a promise about later.
One promise, one exception, and one still open
Ridgeback never trains anything another household uses on what you say to Bobby. Not the model, not a shared adapter, not a test set, not a search index somebody else can query. Not pooled, and not anonymised and then pooled. Your household’s conversations are about named people in a house, and we do not accept that such writing can be stripped of the house it came from.
That is an undertaking, not a description. It binds what we may build.
The exception, put here rather than somewhere you would have to find it. When Bobby uses one of his tools, both halves are captured: what the tool was called with, and what it sent back. The thing you added to a list, the date you asked him to put in the calendar, the answer he got. This is the telemetry that tells us whether Bobby is working, and it is on unless you turn it off.
Nothing there trains anything unless you say so. That is a second switch and it starts off. Leave it off and your household’s tool calls are used to run the service and for nothing else, ever. Turn it on and they may also be used to make the product better for everyone, which is the only circumstance in which anything from your house helps another one.
Two switches rather than one, because they are two different questions. Whether we can see that a tool failed is not the same question as whether your family’s calendar entries should improve somebody else’s Bobby, and a household should not have to answer both to answer either. Turning either one off changes nothing about what Bobby can do for you.
And what a tool was called with is kept for thirty days, then removed. What stays after that is the shape of what happened: which tool ran, whether it was allowed, how long it took, whether it failed. Not the words. A switch protects the household that finds it, and this protects the household that never opens settings, which is most of them. Thirty days because a specific argument stops being useful for fixing anything within days, and because this is the half that matters most if we are wrong about anything else on this page.
Both switches and the thirty days now run on the service. The switches are saved and honoured, and a sweep every fifteen minutes removes what a tool was called with once it is thirty days old. What is missing is the screen: nothing in any app shows a household its switches or lets it touch them. So “you cannot yet stop it” is still true, for a different reason than before — not because the switch does not exist, but because nothing puts it in front of you. Until a screen does, changing either one is a request to us.
If your household ever chooses to have Bobby learn its own way of asking for things, what comes out of that is yours: trained on your household alone, kept in your storage, used for you, and never serving another household.
What a rented AI service is allowed to keep of the questions sent to it is still open. That one is a term in somebody else’s contract and we will not promise it on their behalf. A household that wants the question closed today can run its own AI, which closes it completely.
Where the AI runs
Bobby can talk to an AI running on a computer in your own house, or to a rented one somewhere else. It speaks to both the same way, so swapping them changes nothing else.
Which one your household gets
Whether a household runs its own AI or uses a rented one, and which company runs the rented one, is not decided yet.
Deleting is three different things.
Bobby keeps three separate records about you: how you sign in, what it knows about you, and your place in each house. You can remove any one of them without removing the others.
That is what lets a grandmother who never signs in still be part of the household. It also means "delete me" has three possible answers, so pick the one you actually want.
Leave one household
You stay yourself. You stop being part of that house.
What goes
- Your place in that household
- What you were allowed to do there
- Your name in its list of members
What stays
- Your login
- What Bobby knows about you
- The other households you belong to
- The messages you wrote in that house thread
That last one is the uncomfortable part. A house thread is a conversation several people had, and your messages are part of what the others remember of it. Taking your key back does not rewrite their copy.
Whether leaving should also erase your messages is not decided. Erasing them takes pieces out of other people's record of their own conversation. Keeping them means your words stay in a house you have left. Both cost something.
Be forgotten
Bobby stops knowing anything about you personally.
What goes
- Your name and how you like to be spoken to
- Everything you told Bobby about yourself
- Your date of birth
- The words of the messages you wrote
- Any of it being read when Bobby answers
What stays
- Your login, so you can still sign in
- Your place in each household, and what you may do there
- Where your messages sat in the thread, without their words
- Safe mode, if it was on
What Bobby knows about you and how you prove who you are are kept apart on purpose. Erasing the first leaves the second working, so you can carry on using the house without Bobby holding a picture of you.
It reaches every household you have ever been in, including ones you have left. A record you can no longer see is still a record about you, and walking out of a house does not put it beyond your own request.
Your messages keep their place and lose their words, so the conversation the others had stays a conversation with the right number of turns in it. And safe mode is the one setting this deliberately does not clear: if being forgotten lifted it, asking to be forgotten would be the way out from under it, and the person most likely to work that out is the child it is there for.
Close your login
You can no longer sign in. Read the right-hand column before you do this.
What goes
- Your email address and password
- Your ability to sign in at all
What stays, unless you ask otherwise
- What Bobby knows about you
- Your place in each household
- The messages you wrote
Most people expect closing a login to remove everything, and here it does not. The same design that separates the three records is what lets a grandmother exist in the house with a name and a place and no password at all. The cost of that flexibility is that closing a login is not the same as disappearing.
Whether closing a login should pull the other two with it is not decided. If you want everything gone today, use all three options.
Where deleting gets slow.
Pressing delete removes something from the place Bobby reads. Four other places hold copies for a while, and this is usually where deletion promises quietly fail.
Backups
Copies kept in case something breaks. A deleted message can sit inside one until that copy ages out, which takes at most 30 days.
The delivery queue
Recent messages wait in a short queue so a phone that was switched off can catch up when it wakes. That queue is measured in days rather than weeks, and sits inside the 30.
Smaller copies of photos
Bobby makes reduced versions for browsing, and every one has to go when the original does. That is wired up now. Each browse copy is recorded against the picture it came from, and deleting the picture writes down an obligation to remove the copy, which a sweep then discharges rather than leaving it to whoever wrote the delete to remember. Deleting a photo is in the apps, so this is a promise a household can actually test.
The obligation only covers the copies. The other kinds it was built to carry — a closed login, an expired export — are named in the same place and are not wired yet.
Fault records
If a message was written into a fault record, it has to be taken out of there too. Whether those records are searched on deletion is not decided yet.
One place it is already clean
Whatever the AI held while writing your reply is gone. It keeps nothing between one question and the next, so there is no pile of old conversations sitting inside the model.
Your rights, and what they can do today.
The General Data Protection Regulation, and the UK version of it, give you six rights over information a company holds about you. Having a right and having a button are different things, so here is the honest state of each one. The plain name comes first because that is the thing you want; the legal one is beside it because that is the thing you may need to quote.
One of the six has buttons behind it now. The other five fall into two different kinds of missing, and the difference matters enough to say once here rather than five times below: the service can do it and no screen asks is not the same as nothing does it. The first is a right a household cannot reach; the second is a right nothing honours. Each is a line on the roadmap in the same three states, so what is missing is tracked in public rather than only admitted here. Where there is no screen, asking means asking a person, and who that person is is not decided.
See what is held about youRight of access, Article 15
You can read your own thread and your own profile in the app today. A single file containing everything, which is what the law calls a subject access request, is built: the service assembles it across every household you are in or ever were, and hands it back. No screen reaches it yet, so for a household it still takes a request to us rather than a button. Your login and your stored keys are deliberately not in it, for the reason the portability row gives.
Correct something wrongRight to rectification, Article 16
Your own details — the fields on your person, every one of them optional — can be edited in all three apps today. That is the half of this right that has a button.
What Bobby has remembered about you from a conversation is a different store, and nothing anywhere edits it. Being forgotten clears it; correcting one thing in it is not built yet, on the service or anywhere else.
Have it deletedRight to erasure, the right to be forgotten, Article 17
All three of the options above are built and working, and the two unresolved questions are still marked where they sit. Being forgotten, leaving a household and closing your login are each in all three apps, with a screen for each. Each one works without the other two: leave a household and you can still sign in, be forgotten and you keep your place, close your login and you are still in the member list.
A fourth thing is in the apps now too: closing a household outright. Everyone’s place in it ends at once, which is what lets the last adult out of a house they otherwise could not leave — leaving is refused when it would leave nobody who can run the place, and closing is the way out of that. It takes the same standing as managing groups, on the reasoning that somebody who can remove every other member and revoke every permission can already make a house uninhabitable, and one honest act with a record beats the same thing by attrition. There is nothing to configure and no reason to type.
Pause what is done with itRight to restriction of processing, Article 18
There is no way to ask that processing of your own data be frozen while the data itself is kept. Nothing on the service does it and no screen asks for it. Not built.
Something else exists that could be mistaken for it, so it is named here rather than left to be discovered. A Creator or a Manager can hold a member back. Somebody held back can still read, can still be exported and can still sign out, and every write they attempt is refused. Nobody may hold themselves back. That makes it a household control over a member rather than a right a person holds over their own data, which is the opposite direction from Article 18. It is on the service and no screen reaches it either.
Take it somewhere elseRight to data portability, Article 20
A household that has set up its own storage can have everything that makes it itself written there as it happens, in a published format any tool can read without us. Not an export somebody has to remember to run before they leave. It is a switch a household turns on, and it needs storage of your own first.
And it reads back. A household can be re-created from what it wrote, which is how the writing is tested: an export nobody has restored is worse than one nobody has taken, because the day it is found broken is the day it was needed. Two things deliberately do not travel. Your login, because nobody should be able to restore their way into somebody else’s account. And your stored keys, because a backup carrying working credentials would be a backup worth stealing.
A household that has not set one up has nothing being written, and for them the household’s own way out is not built yet. A person in that household is not left with nothing: the Article 15 export above runs on the service and returns their own data in a format a tool can read. It is an account’s data rather than a household’s, and no screen reaches it, so it is a request to us rather than a button.
Object to it being heldRight to object, Article 21
An objection gets weighed against the reason the data is held in the first place, and that reason has not been written down for any of the twelve kinds above.
Still open
What this page cannot tell you yet.
Nine things stand between this document and a privacy policy, and they are tracked beside the product roadmap rather than repeated here. Keeping one list means it cannot drift from the other. Eight are undecided. The ninth, how long the usage counts are kept, has its answer and nothing enforcing it yet, which is why the policy still cannot state it.
The open questions, and the privacy policy draft they are blocking.
No lawyer has reviewed this page. It describes how the software behaves today and what has not been decided, not a legal undertaking.