privacy, plainly.

Your typed telling goes to Colours and its configured confidential-AI processor so it can be read into bounded facets and placements. The deterministic Colours engine—not the model—then makes the Colour.

Your telling and transcript are used for this request, then discarded. An accepted Send keeps a receiver-safe Colour behind an unguessable bearer link, not the words used to make it or an identity link.

If the page says your browser is hearing, Colours receives only the resulting text; the browser vendor may process speech under its own terms. If the page says secure transcription, one recording is sent through Colours to the single configured transcription processor—Cloudflare Workers AI by default, or OpenAI or Meta only when explicitly selected—and is discarded when the transcript returns. A failed turn is not replayed automatically to another provider.

Send can contain sensitive information. Do not include medical records or anything you do not want processed to make the Colour.

Only when you deliberately save a Colour may it persist privately with a Profile. You can sign in by an available method and restore what that Profile holds on another device.

Managed sign-in identity, the durable account and the random subject used by private rows are separate keys. This reduces routine attribution and prevents browser-visible saved rows from carrying sign-in identity. The application operator and restricted service processes can resolve the seam when necessary to provide account access, security, support, deletion or legal compliance. It is not a promise that the database owner can never make the link.

Plan and entitlement records belong to the account plane and do not join to a Send. Stripe processes Checkout, subscription and invoice data when you choose a paid plan; Colours receives provider ids and subscription state, not card details. No charge starts merely because an option is described.

The contact form keeps the message and any reply address you choose to supply so the operator can answer it. The address is contact-only, not a sign-in method or account lookup source, and the inbox record has no join to account, Sky or Send data.

Colours also processes content-free security and reliability data: signed install and session cookies, coarse admission counters, random operation or reconciliation identifiers, response outcomes and deployment evidence. Immediate-danger wording may receive a fixed care response before an AI request; that check is not an account flag, score or report.

The first-party __Host-colours_interview_v1 abuse-prevention cookie is HTTP-only, SameSite=Lax and Secure on HTTPS. It lasts for up to one year so a browser cannot reset finite Send limits simply by restarting. It is not written onto an accepted Colour.

Account and operator session cookies are HTTP-only and finite. Colours does not use advertising cookies or sell personal data. Private-beta pages are marked not to be indexed.

The UK GDPR basis depends on the feature. Colours processes a telling to provide the Colour you request, and relies on the operator’s legitimate interests for content-free security, abuse prevention and reliable operation. Optional uses may rely on consent where Colours separately asks for it; legal obligations apply where required.

The Send notice and the act of sending are not treated as explicit consent to process special-category data. Do not include medical records or other information you do not want processed as part of a telling. If a use requires an Article 9 condition, Colours must establish that condition before the use begins. Where processing does rely on consent, you may withdraw it for the future without changing processing already lawful.

Processor categories are: Vercel for hosting and edge delivery; Supabase for database and managed authentication; Phala for confidential AI inference on typed Send; Cloudflare Workers AI, or explicitly selected OpenAI or Meta, for hosted transcription; Resend for application mail and Supabase sign-in mail when custom SMTP is enabled; and Stripe for subscriptions and payment processing. A browser vendor may separately process speech when you use its speech feature.

Some providers may process data outside the UK. The operator selects providers and uses the applicable UK transfer mechanism or another lawful safeguard where required. Ask through contact for current provider and transfer-safeguard details.

• contact messages: no more than 30 days;
• the abuse-prevention install cookie: up to one year;
• unfinished operations, reconciliation records, account attempts and admission counters: short finite windows measured in hours or days;
• hosted voice recordings: one transcription turn only; Colours does not retain the audio after text returns;
• an account and its privately saved Colours: while the account is active, then deletion or de-identification subject to necessary security, legal and backup schedules;
• receiver-safe Colours: retained for the beta unless the Send is withdrawn; the words used to make them are not retained;
• send stamps: a stamp is 32 random bytes kept by your browser, and we store only its one-way hash with the hour it was spent. Nothing links a stamp to you or to what you sent, in either direction. That is deliberate, and it has a cost both ways: clearing your browser destroys stamps you paid for and we cannot return them, and deleting your account cannot revoke stamps already minted — they simply expire at the end of the quarter the period they were bought for ends in, which is a date everyone on that plan shares rather than one of yours.
• the free send: your first send needs no account and no stamp, and to keep it to one we store a one-way hash of this browser’s own identifier with the day it was claimed, for two years. It carries no account, no send and no network, and there is nothing on it to join to anything else.

Local browser data remains until you clear it or the application replaces it. Export anything you need before clearing a browser or device.

UK data-protection law may give you rights to access, correct, erase, restrict or object to processing, receive portable data, and withdraw consent. Ask through contact. We may need to verify the request and will explain any lawful limit, including where the requested data is no longer held.

You can complain to the UK Information Commissioner’s Office, or to your local supervisory authority if another applies. You do not have to contact Colours first.