Privacy Policy
Northwind exists so founders can say things they can’t say anywhere else. That only works if what you say is genuinely private. This policy describes exactly what is collected, where it goes, and what is kept — in the same plain language as the app, and matching what the app actually does.
There is no account
Northwind has no sign-up, no login and no password. We do not ask for your email address and we do not have one for you. Nothing you say is associated with an identity on our side, because there is no identity on our side.
What is stored, and where
- On your phone, encrypted. Your conversations, the memories Northwind keeps, and your profile are stored on your device, encrypted with a key held in the iOS Keychain. They are excluded from unencrypted backups.
- Not on our servers. There is no cloud copy of your conversations or memories. We do not have a database of them to search, hand over, or lose.
- Nothing follows you to a new phone — unless you choose it. By default, the encryption key never leaves your device, so no backup anywhere can open your conversations; if this phone is lost, they are gone, and even we cannot recover them. An optional setting, Restore on a new iPhone (You → Privacy & data, off by default), lets the key ride in your own encrypted iCloud backup so a new iPhone can restore them. Apple holds that backup under your Apple ID — we still hold nothing, and there is still no Northwind database. You can also export a copy any time from the same screen.
- Subscription status. Purchases run through Apple. We never see your payment details.
- The usage meter. Plans include a monthly conversation allowance, so our server keeps one small record per subscriber: a one-way hash of the subscription’s Apple transaction number, the minutes used this period, and when the period started. No name, no email, no device identifier, and no conversation content — a hash and two numbers, deleted automatically after 90 days of inactivity.
- What is never collected: no advertising identifiers, no cross-app tracking, no analytics on the content of your conversations.
What leaves your phone, and why
Northwind cannot answer you without sending something. Being precise about this matters more than sounding reassuring, so here is all of it:
- Each turn goes to our server to be answered. That means what has been said so far in the conversation, the memories you have let Northwind keep, and your profile. It is used to write the reply and is not stored.
- Your replies are written by an open-weights model (Gemma) served by Cerebras, under Northwind’s own instructions — not by a general-purpose assistant product from another company.
- Your speech goes to Mistral to become text. The audio is sent for transcription and is not stored by us.
- The reply goes to Fish Audio to be spoken aloud.
- When a conversation ends, the transcript goes to Cerebras to produce the title, the summary you see, and the memories worth keeping — the same processor that wrote the replies, so ending a conversation introduces no new company.
Each of those companies processes what it receives in order to do that one job. We do not retain any of it, and none of it is used to train any model — ours or theirs. Their own handling is governed by their policies as processors, and we will name any change to this list here before it takes effect.
Never training data
Your conversations are never used to train models — ours or anyone else’s. Northwind’s model was trained before you arrived, on material we wrote ourselves, and nothing you say is added to it.
No human review
No person at Northwind reads your conversations. There is no review queue and no sampling programme. This is not only a policy: there is no server-side copy for anyone to read.
How long anything exists
Conversations and memories exist on your phone until you delete them. There is no retention timer, because there is nothing on our side that a timer would apply to.
Deleting everything
You can forget any single memory, or delete everything, from inside the app under You → Privacy & data. Deleting everything removes your conversations, memories and profile from the device and destroys the encryption key, so any copy that might survive in a device backup cannot be opened. Because there is no account and no server-side copy, that is genuinely all of it.
Legal requests
We can only produce what exists. Your conversations and memories are on your device and not in our possession, so we cannot produce them, and no legal process served on us can compel us to. For anything that does exist on our side, we require valid legal process and will notify you where we are able to.
Security
Data is encrypted in transit, and encrypted at rest on your device using Apple’s own cryptography with a key that never leaves it. Northwind is not a healthcare provider and your use of it is not covered by HIPAA.
Your rights
Export and deletion are available to everyone, from inside the app, without asking us. If you are in the EU/EEA, UK, or California you have additional statutory rights; because we hold no account and no copy of your conversations, most of them you can exercise yourself in the app, and you can contact us for the rest.
Age
Northwind is for adults building companies, and you confirm you are 16 or older when you first open it. It is not directed at children.
Changes
If we change this policy we will say so in the app before the change takes effect, in plain language. We will never weaken these commitments retroactively.
Contact
Alan Yang, trading as Northwind · New South Wales, Australia · hello@meetnorthwind.com