Last updated: November 2026
Bondroot ("the app", "we") is a mobile application that helps you stay connected with the people who matter by reminding you of important moments in their lives and suggesting messages. This policy describes the data we collect and how we use it.
We do not sell your data. We do not use it for targeted advertising.
We use the data to: provide and operate the app (account, reminders, message suggestions); send local or push notifications for your reminders (if you accept notifications); improve the service in a privacy‑respecting way; comply with legal obligations or lawful requests from authorities.
We may also produce aggregated and anonymised statistics (for example: distribution of event types, number of check‑ins completed, retention rates) for the purpose of improving the service. These statistics cannot in any way identify an individual user.
The app uses artificial intelligence to extract information from the text you enter (person, event type, date) and to suggest personalised messages. This processing is performed by a third‑party AI provider: Anthropic PBC (United States) and, depending on how the service is configured, OpenAI (United States). To produce the result, we send them the text you enter, along with your loved one's first name, the event type and date. These providers process this data on our behalf and only to deliver that result; under the terms that apply to their API at the date of this policy, they do not use it to train their models, though they may keep it temporarily under their own terms. We do not use your data to train AI models either. We may also run this processing on our own self‑hosted infrastructure. To limit the data sent, we recommend using first names or nicknames.
Sensitive data (names of your contacts, free-text descriptions you enter, suggested messages) is encrypted at rest using the AES-256-GCM algorithm before being stored in our database. The encryption key is managed separately and is never stored alongside the data.
We rely on the following providers to operate the service:
Railway, Supabase and RevenueCat have no access to your encrypted app data (names, free text). The AI providers, however, receive in clear the text needed for processing (see section 3). We take technical and organisational measures to protect your data (HTTPS, restricted access, encryption at rest).
We keep your data as long as your account is active. If you delete your account from within the app, all your personal data (contacts, events, reminders, messages) is deleted immediately and permanently from our servers, unless retention is required by a legal obligation.
Under the General Data Protection Regulation (GDPR), you have the following rights:
To exercise these rights or for any question: contact@bondroot.app.
We may update this policy. The current version is the one published on this page with the "Last updated" date at the top. We encourage you to review it periodically.
For any question about privacy or your personal data: contact@bondroot.app.