DRAFT FOR ADMINISTRATOR APPROVAL

Buzby alpha privacy notice

Last updated: 7 October 2026. This draft describes the invite-only full Buzby alpha and requires administrator approval before inviting a friend.

What Buzby stores

Buzby stores your account identity, native assistant conversation history, Tasks records, generated-experience source and built artifacts, generated-experience configuration and instance-local storage, exact permissions, audit records, generated images and their prompts/revision lineage, private uploaded photo originals, metadata-stripped previews and separately reviewable photo metadata, deliberately submitted bounded product reports, content-free product events, owner-controlled durable memories, and rebuildable owner-scoped full-text and semantic indexes over visible conversation turns. It records operational identifiers and counts needed for security, reliability, quotas and support.

How information is used

Information is used to authenticate you, provide the task manager, requested assistant conversations, exact retrieval of earlier conversation passages, owner-controlled cross-conversation memory, synthetic image generation/editing, exact user-selected private photo understanding and generated task experiences, and execute exact Tasks operations, operate and secure the service, recover data, enforce quotas and respond to support requests. Product reports are reviewed by the Buzby administrator as informational signals and do not include copied conversation content unless a user deliberately enters it into the report. Buzby does not sell personal information or use it for advertising.

Documents and public PDFs

Text, data and text-based PDF uploads are private owner- and conversation-scoped immutable files. Buzby extracts bounded PDF text locally and preserves page boundaries for cited answers; the original PDF and derived extraction remain separate private objects. An approved alpha account may classify a document as public/synthetic or private/personal, but must not attach credentials, authentication material, health records or other secret or special-category data. Bounded extracted passages are sent to the configured conversation model only when the user asks Buzby to read or answer from that document. Public PDFs found during web research are fetched without cookies through the same public-address safety boundary as webpages, are not retained as account files, and retain their source URL and page numbers in evidence.

Generated images

When you request an image, the prompt—and for an edit, the selected Buzby-generated source image—is sent to the configured image-generation provider. Images are copied immediately into Buzby’s private storage and provider result links are not retained. The generation/editing path accepts synthetic, non-personal prompts and Buzby-generated images only. Separately, an approved alpha account may upload a private JPEG, PNG or WebP to one exact conversation. Buzby keeps the immutable original privately, creates a metadata-stripped bounded preview for analysis, and exposes EXIF fields separately for review or correction. Available orientation, capture time and camera fields are included automatically when the user asks about that exact photo. GPS remains excluded unless the user includes it once or enables the reversible always-include-location preference. TensorX receives the exact stripped image and question only when photo understanding is requested. This personal-image use is restricted to individually approved alpha accounts; it is not an open-registration or public-production permission.

Voice, dictation and speech

Dictation begins and ends only through visible controls. For longer dictation, bounded audio segments may be sent while recording to Buzby’s self-hosted transcription process so provisional text can appear for review; a final pass replaces it after Stop. Audio remains memory-only in the browser, temporary server files are deleted immediately, and text is never sent as a conversation message without review. Message and Miniapp speech playback uses the browser or device voice, remains cancellable, and creates no stored audio.

Miniapps and companion AI

The reviewed Chat companion can send only its configured context and bounded same-instance turns after a separate persistent, revocable grant; it never inherits another conversation. Other generated Miniapp AI accepts public/synthetic text only. Generated code runs in an isolated browser frame on a separate origin. It receives no Buzby cookie, connector credential or direct microphone permission. Personal information is returned only through permissions granted to that exact experience. A permitted transcription request opens trusted Buzby recording and review controls and returns approved text only; a permitted speech request uses cancellable device playback. Permissions can be revoked in the experience or Buzby Tasks settings.

Installation and offline use

Installed Tasks and Miniapps do not cache Tasks records, signed runtime documents or authentication responses. The installed Assistant caches only its reviewed static shell plus a bounded owner-scoped device projection of previously loaded conversation names and visible user/assistant message text. Cached conversations are labelled stale and remain read-only while offline. Authentication, cookies, capability values, hidden tool activity, signed URLs, files and image bytes are excluded. The projection is cleared on sign-out or account change and can be cleared in Settings without deleting server conversations. Operating systems retain ordinary installed-app metadata such as the app name and icon.

Conversation continuity and memory

Buzby keeps native Pi conversation files as the authority. It derives a private search index over visible user and assistant text so an earlier conversation can be located and its exact original turns read when relevant. Thinking, tool payloads, files, images and audio are excluded from this index; secret- or special-category-shaped turns retain only an exclusion marker and are not embedded or searchable. A private credential-free embedding service may create semantic vectors locally inside Buzby infrastructure; the initial open model is US-origin but receives no data outside Buzby. It also derives invisible bounded topic segments and structured focus capsules from ordinary visible turns so a restarted or reopened chapter can carry current intent forward without becoming a second message history; URLs and excluded sensitive text are omitted. Stable ordinary memories include source provenance and can be viewed or forgotten in Settings. Secrets, credentials, health and special-category information are excluded from automatic durable memory.

Operational diagnostics

Buzby sends content-free service and browser reliability events to an independently hosted European diagnostic system. These events may include time, deployed build, component, generic failure family, duration, retryability, browser family, connectivity state, sanitised route family, random correlation ID and opaque thread/run identifiers. They do not include prompts, conversation text, tool arguments or results, page addresses, raw errors or stack traces, DOM or form values, files, images, audio, credentials, cookies, authentication headers, capabilities, signed links or provider bodies. Operational logs are retained for 14 days.

Optional alpha diagnostic sharing

Diagnostic conversation sharing is off by default and can be enabled only for one conversation. It begins with new visible messages after consent; earlier messages and hidden tool activity are not copied. Before activation, Buzby shows the scope, authorised readers and automatic deletion time. A persistent indicator remains visible while sharing is active. Sharing can be stopped, exported or immediately deleted, and access history remains visible. Captured messages use a separate per-capture encryption key and are automatically deleted after no more than seven days in the current alpha. Credentials, secret-shaped values and special-category data are excluded; detecting such content automatically deletes the entire capture and destroys its key.

Processing and infrastructure

Buzby uses self-hosted and European infrastructure where reasonably possible. Model inference receives the conversation material necessary to answer or generate a task experience. For exact selected photo understanding, TensorX Limited receives only the selected approved-alpha account's necessary conversation, configured Chat companion context/turns, requested private file passages or metadata-stripped photo and question; photo GPS is excluded unless deliberately allowed once or by the reversible preference. TensorX states EU inference in Dublin and Helsinki, transient prompt/completion processing without retention or training; its published DPA covers application end users. Its subprocessor list includes US-owned Cloudflare, AWS and Google entities with EU processing, and some US-based support/transactional processors under transfer safeguards. AKI.IO GmbH receives only the bounded synthetic prompt and generated source image needed for an explicitly requested image operation, acts as processor under its published DPA, and names Berlin-based AIME GmbH as its current inference-infrastructure subprocessor. Service providers and exact retention arrangements will be listed in the approved notice before a broader release.

Retention, export and deletion

You can request an account export or deletion. Active account data, durable memories and derived conversation-search records are removed on deletion. Account export includes memory records and authoritative native conversations but omits rebuildable embeddings. Encrypted checkpoints, object versions and backups may remain inaccessible for up to 30 days before expiry. Security audit records retain identifiers and outcomes rather than conversation or connector content.

Your choices

You can deny or revoke experience permissions, inspect and forget durable memories, search or delete conversations, stop using an installed experience, export your account, request deletion, or contact support. Buzby registration remains closed and invitations are issued manually.

Contact

Email support@buzby.ai with privacy or data-rights questions. Do not send passwords, passkeys or sensitive record contents by email.