Privacy

Who runs this

TODO(Rom): the legal entity or person responsible, the country it operates from, and an address a person can write to.

You can reach us at TODO(Rom): a contact email address for privacy questions.

Who you are, to us

Accounts are handled by Clerk. When you sign up, CommuniGate receives two things from them: your email address and a permanent account id that identifies you and nothing else. They arrive on a signed message from Clerk, and the signature is checked before the contents are read.

CommuniGate stores no password. It never sees one. Signing in is Google or a six-digit code sent to your email, and both of those happen at Clerk.

The email address is contact information, not your identity here. If you change it, you are still the same account.

What you write, and what we keep

Your question is stored, and so is the answer. They sit in the same place, one row per turn, marked as yours or the product's. The stored answer is the real one: while an answer is being written the screen receives it in pieces, and those pieces are deleted 900 seconds after the answer finishes. They are a delivery mechanism, not a record.

Your profile is six optional fields that you type — your role, whether people report to you, your team size, your company size, your industry, and how you like to manage. Nothing in it is guessed from what you write in a chat. Every field can be emptied, and an empty field means unknown rather than false.

Inside one conversation, the product keeps short notes so that a later turn knows what you already told it. Each note is a span taken from a message you wrote and points back at that message. The product checks whether the note is word-for-word what you said and records the answer either way: your own wording and our restatement of it are stored separately and shown to the model under separate headings, so it can always tell which is which.

Those notes never leave the conversation they were made in. Starting a new chat starts from nothing but your profile. There is no memory across conversations, by design — the code has no way to ask it.

The model is never sent your whole history. A turn sends four things: your profile, the notes from this conversation, the last few turns of this conversation, and the message you just wrote.

We record what each answer cost. Per answer: how many tokens went in and out, and the price the vendor itself reported. Per day: how many answers you asked for and what they came to. That is what the daily allowance is counted from.

Book passages are not copied into your conversation. An answer stores a pointer to the passage it cited, and the text is read from the book catalogue when you open it.

Who else sees what you write

Three companies, each for one job.

• Clerk runs the accounts. They have your email address and your sign-in activity. They never see your conversations.
• xAI writes the answers, using their Grok models. Each turn sends them your message, your profile, this conversation's notes, the last few turns, and the book passages the search found.
• Voyage AI turns your question into the numbers the passage search runs on. They receive the text of the question, and nothing else.
• TODO(Rom): the hosting company, once the product is deployed. Whoever runs the servers and the database holds everything on this page, and they belong in this list.

Nothing in CommuniGate trains a model on what you write. There is no training step in this product and no copy of your text kept for one. What xAI, Voyage AI and Clerk each do with what reaches them is governed by their own terms: TODO(Rom): link each vendor's current terms and say what they state about retention and training, after reading them. Do not summarise them from memory.

There is no analytics, no advertising and no tracking of any kind in this product. Nobody is measuring what you read here.

One cookie in your browser is ours, and it holds a preference. When you collapse or reopen the list of your conversations, that choice is remembered in a cookie called cg_rail, whose value is the word open or the word closed and nothing else. It is not an identifier, it does not say who you are, and it is read for one purpose: so the screen is already in the state you left it in on the first frame rather than rearranging itself after it loads. It travels to our own server with each page request, which is how that is possible, and it reaches nobody else.

Clerk's own code does run on every page, including this one, and that is worth saying plainly rather than burying. The whole product is wrapped in their sign-in component, so opening any page — the landing page, this page, before you have an account at all — contacts Clerk and leaves a few of their cookies in your browser, alongside the one of ours above. They are what keeps you signed in. It is not tracking for anyone's benefit, and it is still a third party your browser talks to before you have agreed to anything.

How long it is kept

Your conversations are kept until you delete them. There is no automatic expiry — nothing quietly removes an old chat. Deleting a conversation deletes its messages, its answers and its source links immediately and for good; there is no archive and no recycle bin.

The pieces of an answer in flight are the one exception and are deleted 900 seconds after the answer finishes, as above.

TODO(Rom): backups: whether they are taken, where they are held, how long they are kept, and the procedure that re-applies a deletion to a restored snapshot. None of this is decided in the code and none of it may be stated here until it is.

TODO(Rom): where the servers and the database physically are, once the product is deployed.

Deleting your account

There is a button at the bottom of your profile. It is not a request that someone processes later. In order, it:

1. Locks you out first. A marker is written and the account is denied, so a session that is still open stops working immediately.
2. Deletes everything of yours, in the same moment: every conversation, every message, every answer, every run, every source link and your profile.
3. Tells Clerk to delete the account at their end.
4. Removes the account row. The small marker from step 1 stays behind deliberately — it is what refuses an old sign-in token that outlived the account, and it holds no email, no name and nothing you wrote.

If step 3 fails, the first two have already happened: your data is gone and the account stays locked while the deletion is retried. There is no order of events that gives you a usable account back. Deletion is not reversible and there is no undo.

One thing deliberately survives, and it is not about you. The daily totals of what the whole product spent — how many answers were produced and what they cost — stay. They carry no account id, no conversation, no message, no answer and no text, and there is no key in them that leads back to a person. The per-person counter, the one that holds your account id, is deleted with you.

There is no export. You cannot currently download your conversations before deleting them. That is a missing feature, not a policy, and it is written here rather than left for you to discover. TODO(Rom): decide whether an export is required before launch — the GDPR's right to data portability is likely to make this not optional.

Your rights

You can read and change your profile at any time, delete any conversation, and delete your whole account, all from the product and without asking anyone.

TODO(Rom): the rest of this section — the legal basis for processing, the rights that Israeli law and the GDPR give you, how to exercise each one, how long we take to answer, and which regulator you may complain to. ⛔ A lawyer writes this, not an engineer and not an AI.

TODO(Rom): whether anyone under 18 may use this, and what happens if they do.

TODO(Rom): how a change to this page will be communicated to people who already have accounts.

If something here is wrong

This page describes the software as it is built, and it was checked against the source on 18 October 2026. If you find something on it that the product does not do, or does differently, tell us — a privacy policy that has drifted from the code is worse than none, because people act on it.