Your conversations,
your privacy.
Last updated
1. Introduction
Welcome to Calypso ("Calypso," "we," "us," or "our"). We provide AI companion chat with Calypso's voices (personas), "Decode" readings of text conversations you upload, astrology readings, shared read links, and a blog, at trycalypso.ai (together, the "Service").
This Privacy Policy describes how we collect, use, share, and protect your personal information when you use the Service. It applies to all visitors and registered users of Calypso, including visitors who chat without an account.
We have written this policy to be as clear as a legal document can reasonably be. A shorter, plainer-language summary lives at trycalypso.ai/privacy-summary and is not a substitute for this document. A separate Consumer Health Data Privacy Policy, required by the laws of Washington and Nevada, lives at trycalypso.ai/consumer-health-data-privacy and is linked separately in the site footer. Your use of the Service is also governed by our Terms of Service.
Section 16 explains how we use YouTube API Services and other social media platforms to publish Calypso's own videos to Calypso's own accounts.
By using the Service, you confirm that you have read and understood this Privacy Policy. If you do not agree with any part of it, please do not use Calypso.
2. Calypso is for adults (18+) — age requirements
The Service is available only to users who are 18 years of age or older. This includes visitors who chat without an account. We ask for your age when you create an account, and you represent that the age you give us is accurate.
We do not knowingly collect personal information from anyone under 18. Calypso is not directed to children or teens, and we do not market the Service to minors.
If we learn that a user is under 18 — from any source, including the account itself, a support ticket, or the content of a report — we will close the account and delete its personal information as described in section 8.
If you believe a minor has created a Calypso account, contact privacy@trycalypso.ai and we will investigate, close the account, and delete its associated data.
Because the Service does not accept users under 13 (or under 18), we do not operate a parental-consent flow under COPPA or analogous laws; no account requiring one is knowingly accepted.
3. Calypso is an AI — required disclosures about the nature of the Service
Several jurisdictions (including California and New York) require services like Calypso to make clear disclosures about what an AI companion is and is not. We make them here, and inside the product:
Calypso is artificial intelligence, not a human. Every Calypso voice (persona) is a computer program. When you chat with Calypso, you are not communicating with a human being. The product displays a clear notification of this at the start of your interactions and at regular intervals (at least every three hours) during long sessions.
Calypso is not therapy, medical care, or a licensed professional service. Calypso does not provide psychotherapy, mental-health treatment, diagnosis, or medical advice, and no Calypso voice is, or will claim to be, a licensed professional of any kind.
Calypso is not a crisis service. If a conversation suggests you may be in crisis, the Service will show you a notification referring you to crisis resources such as the 988 Suicide & Crisis Lifeline and the Crisis Text Line. Our safety protocol — including how we detect and respond to expressions of suicidal ideation or self-harm — is published on our Safety page at trycalypso.ai/safety.
Age check during a crisis. When a conversation shows signs of crisis, or your own lines in a chat you upload to Decode speak of hurting yourself, an automated check reads your own messages (in that conversation, or your side of the uploaded chat) for signs that you may be under 18. If it finds them, chat and Decode are restricted on your account and on the browser you used, and Calypso shows you crisis resources. If it doesn't, your read is still made, with crisis resources shown on it. If you think we got this wrong, email safety@trycalypso.ai.
We maintain and publish this crisis-response protocol as required by, among others, California Business & Professions Code §22602 and New York General Business Law §1701, and we log crisis-referral notifications in aggregate (never the content of your conversation) to meet statutory reporting duties, such as annual reporting to the California Office of Suicide Prevention beginning July 2027.
4. The information we collect
We collect only the information we need to provide the Service. This section describes what we collect; section 5 explains why.
4.1 Information you provide to us.
Account information — your name or display name, email address, a password if you choose to set one (stored as a salted hash, never in plaintext; you can always sign in with a one-time code instead), and your confirmation that you are 18 or older and agree to our Terms and this Policy, with the time you gave it. We do not collect a date of birth for age verification. You can use a name other than your legal name; we do not require government-verified identity.
Profile information (optional) — date and time of birth and place of birth, if you choose to provide them for astrology readings. You can leave these blank, and you can edit or delete them at any time.
Birth details you share about other people (optional) — if you give a Calypso voice someone else's name and birth date, time or place (for example, to compare your charts), we store them on your account only. They are never shown to anyone else and are not saved from incognito conversations. You can delete them at any time from People on your profile, and they are deleted with your account.
Conversation content — the text of your conversations with Calypso voices and the metadata associated with them (timestamps, thread titles, voices used). Please note: conversation content may reveal information about your emotional state, relationships, or mental health. We treat all conversation content as sensitive data under the standards described in section 6.
Memory — to carry context from one conversation to the next, Calypso keeps a short written memory about you (for example, the people you have mentioned and what you are working through), summaries of past conversations, and search indexes ("embeddings") of conversation text. These are built automatically from your conversations with an account, never from incognito conversations.
Decode uploads — the screenshots, chat exports and text you give the Decode feature, the text we extract from them, the details you add about the other person (such as a name or nickname, pronouns and the kind of relationship), and the report Calypso writes, which includes short quotes from the conversation. Uploads usually contain other people's names and messages. Please only upload conversations you have the right to share (see our Terms of Service). When you open a chat from a read, the Calypso voice you talk with can see the chat you uploaded for that read, so it can answer questions about what was said. Your other chats see one line per recent read (who it was with and its headline), never the uploaded chat itself. Deleting a read removes both.
Relationship threads — if you use them, the nickname and relationship type you give each thread and the decodes you file under it.
Shared reads and comments — if you turn on sharing for a decode, the read becomes a public page (see section 7). Comments you post on a shared read are public and show your display name.
Feedback, support and reports — messages you send through the Help center or by email, feedback you give on a Calypso response, and abuse reports you file.
Payment information — if you subscribe to Pro, our payment processor collects your card details and billing address on its own checkout page. We receive and store identifiers for your customer record and subscription, your plan, its status and billing period, and confirmation of each payment. We do not see or store full card numbers.
4.2 Information we collect automatically.
Device and connection information — IP address, browser type and version, operating system, device type, and language preference. We also use your IP address to apply the free daily message limit to visitors without an account.
A random browser identifier — if you chat without an account, your conversations are stored under a random identifier kept in your browser, not under a name or email.
Usage information — which pages you view, which features you use (Decode, Chat, voice switches), how long a decode takes, and which buttons and links you click. When you are signed in, this is linked to your account ID. It does not include the text of your messages.
Server logs — records of requests and errors, which our hosting provider keeps for a few days.
Cookies and similar technologies — see section 12.
4.3 Information from third parties.
Sign-in — Calypso does not currently offer sign-in with a third-party account such as Google or Apple. If we add one, we will update this section before it goes live.
Payment processor — transaction status and the limited billing information described in 4.1.
Place data — birthplaces are matched against a city list we keep on our own servers, so the place you type is not sent to anyone else. Place data © GeoNames, CC BY 4.0, geonames.org.
4.4 What we do not collect.
Government-issued ID, social security number, or driver's licence number.
Precise location beyond the coarse geolocation inferable from an IP address. We do not use geofencing of any kind.
Contacts from your phone or social networks.
Any data from your YouTube, Google, Instagram, Facebook, X or TikTok accounts. No part of the Service asks you to connect them (see section 16).
Audio or video from your device, unless you explicitly choose to dictate or upload an image you have already captured. We do not create voiceprints and we do not run facial-recognition or face-geometry analysis on uploaded images.
Formal health records, prescriptions, or diagnostic information. You may write about your feelings, relationships, or wellbeing in conversations; how we handle that content is governed by section 6.
5. How we use the information we collect
For each use we state the legal basis under GDPR for users in the EU/UK; in other jurisdictions the same uses are permitted under equivalent provisions, subject to the sensitive-data rules in section 6.
Provide the Service — authenticate you, render your conversations, remember context between them, run the Decode feature, generate astrology and synastry reads, deliver responses from Calypso voices, and publish a shared read when you turn sharing on. Legal basis: performance of a contract (Art. 6(1)(b)).
Maintain the Service — diagnose errors, apply usage limits, prevent abuse and fraud, secure accounts. Legal basis: legitimate interests (Art. 6(1)(f)); legal obligation (Art. 6(1)(c)) in fraud/security contexts.
Communicate with you — account emails: sign-in codes, payment receipts and failed-payment notices, replies to your support messages, and confirmations of deletion requests. Legal basis: performance of a contract (Art. 6(1)(b)).
Process payments — bill you for Pro, refund you, manage your subscription. Legal basis: performance of a contract (Art. 6(1)(b)).
Improve the Service — analyze usage data, such as page views, clicks and which features are used. Conversation content is not used for this analysis. Legal basis: legitimate interests (Art. 6(1)(f)).
AI model training — we do not use your conversation content to train or fine-tune AI models, ours or anyone else's, and we have not opted in to any provider training on it. One provider's own terms are different; section 7.1 explains. If we ever want to, we will ask first: it will be off by default, opt-in only, and never offered to residents of jurisdictions whose law prohibits it regardless of consent (see section 6). Legal basis, if ever offered: consent (Art. 6(1)(a)).
Safety and crisis response — detect language patterns that may indicate a user is in crisis and surface the in-product Crisis Banner with crisis-resource referrals (see section 3). This is automated detection performed as part of delivering the Service you requested. We retain aggregate counts of crisis referrals (not conversation content) for statutory reporting. Legal basis: vital interests (Art. 6(1)(d)); legitimate interests (Art. 6(1)(f)).
When a person reads a conversation — no one at Calypso reads conversations as a matter of course, and no one watches them as they happen. A member of our team reads a conversation only when our automated safety system detects signs that someone may be in crisis (to check how Calypso responded and fix what went wrong, or to review a chat restriction described in section 3), when you ask us to, for example in a support email, when someone reports it to us, or when the law requires it. What we learn is used to fix Calypso's safety checks and how its voices respond, never to train AI models. Because no one is watching in real time, this cannot get you help in an emergency. Legal basis: legitimate interests (Art. 6(1)(f)); vital interests (Art. 6(1)(d)).
Marketing communications — only if you opt in to a newsletter or product-update list. No marketing email by default. Legal basis: consent (Art. 6(1)(a)).
Promote Calypso — publish Calypso's own videos to Calypso's own social media accounts. This uses no personal information about you (see section 16). Legal basis: legitimate interests (Art. 6(1)(f)).
Comply with law — respond to lawful subpoenas, court orders, or other legal requests. Legal basis: legal obligation (Art. 6(1)(c)).
We do not engage in automated decision-making with legal or similarly significant effects on you. The Decode feature provides an editorial reading of a conversation; it does not make binding decisions about you. We do not use your data for targeted advertising, and we do not profile you for advertising purposes.
6. Sensitive data and consumer health data
Because Calypso is an emotional-support product, the content of your conversations may reveal — or allow inferences about — your emotional state or mental health. US state laws increasingly treat such information as sensitive data or consumer health data. Our commitments:
We treat all conversation content, and any inference our systems derive from it (including crisis-detection signals and the memory described in section 4), as sensitive data, regardless of which state or province you live in.
We collect and process it only as necessary to provide the Service you have requested — rendering your conversations, generating responses, running Decode, and operating the in-product safety features. This is the "necessary to provide a requested product or service" processing recognized by the Washington My Health My Data Act, Nevada's consumer health data law, and the "strictly necessary" standard of the Maryland Online Data Privacy Act.
Any processing beyond that requires your separate, explicit opt-in consent, which you can withdraw at any time. We do not currently do any such processing.
We never sell conversation content or health-related data, and we never use it for advertising. Several states (including Maryland) prohibit the sale of such data outright; our position is the same everywhere.
We do not use advertising pixels, advertising SDKs, or cross-context behavioural advertising tools anywhere on the Service. The one third-party script we run is a product-analytics tool, described in section 12.
Washington and Nevada residents: a standalone Consumer Health Data Privacy Policy with the disclosures those laws require is at trycalypso.ai/consumer-health-data-privacy, linked separately in the site footer. The rights it describes (including deletion that reaches the processors that store data on our behalf, and our backups) are available to you as described there.
7. How we share information
We share personal information only as described here. We do not sell your personal information, and we do not "share" it for cross-context behavioural advertising as those terms are defined under the CCPA/CPRA and similar laws. We have not sold or shared personal information in the preceding 12 months.
7.1 Service providers (processors). We use a small set of third-party providers. Each processes personal information under its own data processing terms; the AI inference entry below explains where one provider's terms allow it more use:
Website hosting — serves the website and passes your requests on to our servers.
Cloud infrastructure — hosts the application and database in the United States, and holds the screenshots you upload until they are deleted (section 8).
AI inference providers — run the large-language-model inference powering the Calypso voices, Decode, astrology readings and memory, including reading the screenshots you upload, turning conversation text into search indexes, and the age check described in section 3. They process conversation content, including incognito conversations, to generate responses. Our primary AI provider's terms prohibit it from training its models on the data we send. Another provider, which we use for some features (parts of Decode, memory, conversation summaries, astrology readings, a safety check on messages in languages other than English, and chat replies when our primary provider is unavailable), does not make that commitment in its published terms and keeps data under its own retention rules. We have not opted in to any provider training on your data.
Payment processing — collects and processes your billing information when you subscribe; we do not store full card numbers on our systems.
Email delivery — transactional email only; processes your email address and the content of the emails we send you, including replies to your support messages.
Analytics — usage events such as page views, clicks and feature use, linked to your account ID when you are signed in; no conversation content (see section 12).
This list of provider categories is maintained on this page and updated when providers change. You can request more detail about our current providers at privacy@trycalypso.ai.
7.2 Business transfers. If Calypso is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, your information may be transferred as part of that transaction. We will notify you (by email and in-product) before your information becomes subject to a different privacy policy.
7.3 Legal requirements. We may disclose personal information when we believe in good faith that disclosure is necessary to comply with a subpoena, court order, or lawful government request; enforce our Terms of Service; detect, prevent, or address fraud, security, or technical issues; or protect the rights, property, or safety of Calypso, our users, or the public. We require legal process for non-emergency requests, and we notify users of legal requests for their data unless legally prohibited.
7.4 With your consent. We may share information for purposes not covered here with your explicit consent.
7.5 Aggregated and de-identified data. We may share aggregated or de-identified data that cannot reasonably be used to identify you. We commit to maintaining such data in de-identified form and not attempting to re-identify it, and we require the same of recipients.
7.6 What you choose to make public. A shared read is a public page that anyone with the link can open. It includes the full read, with short quotes from the conversation, but not the other person's name, your screenshots, or your relationship details. Comments on a shared read are public and show the commenter's display name. You can turn sharing off at any time, and the link then stops working.
7.7 Social media platforms. We do not share your personal information with YouTube, Instagram, Facebook, X, TikTok, or the scheduling service we use to post to them. Section 16 describes what our publishing tool does.
8. How long we keep your information
Account information — retained while your account is active.
Conversation history — retained while your account is active, unless you delete the conversation sooner. Incognito messages are not stored by us: they are sent to our AI inference providers to generate each reply (section 7.1 describes their own retention) and are gone from Calypso after the session.
Conversations without an account — stored under the random browser identifier described in section 4 until you ask us to delete them. Because they are not tied to a name or email, tell us roughly when you chatted when you email privacy@trycalypso.ai, so we can find them.
Memory, summaries and search indexes — retained while your account is active and deleted with it. Deleting a conversation deletes its summaries and search indexes; anything already carried into your written memory stays until you ask us to clear it or delete your account.
Decode uploads — screenshot images are deleted from our servers about 24 hours after the decode finishes (or fails for good). The extracted text, the details you added, the quotes and the report are retained while the decode is on your account; deleting the decode deletes them.
Shared reads — public until you turn sharing off or delete the decode.
Usage events — events we store ourselves are deleted after 90 days; our analytics provider keeps them for 12 months.
Usage-limit records (which include IP addresses) — deleted with your account; for visitors without an account, kept until you ask us to delete them.
Support messages and deletion requests — kept for two years, including after an account is deleted, so we can show that a request was handled.
Backup copies — database backups are kept for up to 90 days after deletion from active systems.
Billing records — our payment processor keeps billing records for as long as financial regulations require (typically seven years after the last transaction). When your account is deleted, we delete the billing identifiers we hold.
Abuse and safety records — retained for up to two years after the last related event.
Crisis-referral statistics — aggregate counts only (no conversation content, no user identities), retained as required for statutory safety reporting.
Marketing list membership — retained while subscribed; removed within 30 days of unsubscribing.
Data handled by our publishing tool — see section 16.
When we no longer need information for a permitted purpose, we delete or anonymize it.
9. Your rights — and how to exercise them
Wherever you live, we honour the following core rights:
Access / right to know — request a copy of, and information about, the personal information we hold about you.
Correction — ask us to correct inaccurate or incomplete information.
Deletion — ask us to delete your account and associated personal information (some records are retained as described in section 8, e.g. billing records required by tax law).
Portability — receive a machine-readable copy of your conversation history and account data.
Objection / opt-out — object to processing based on legitimate interests. We do not sell personal data or process it for targeted advertising, so there is nothing to opt out of on those fronts; where you use an opt-out preference signal such as Global Privacy Control, we honour it as a valid opt-out of sale/sharing in the states that require it.
Restriction — ask us to limit processing in certain circumstances.
Withdraw consent — for any consent-based processing (such as a public shared read, which you can turn off at any time), as easily as consent was given.
No discrimination / no retaliation — you will not lose access, pay more, or receive degraded service for exercising any right.
Appeal — if we decline a request, you may appeal by replying to our decision or emailing privacy@trycalypso.ai with the subject "Appeal." We respond to appeals within the timeline your state's law requires (typically 45–60 days). If your appeal is denied, you may contact your state Attorney General.
How to exercise your rights: you can delete a conversation, a decode, or a person's birth details yourself at any time in the app. To delete your whole account, choose Delete account on your profile; this sends a request to our team, who carry it out within 30 days and email you when it is done. For access, export, correction, or anything else, email privacy@trycalypso.ai.
We will verify your identity before fulfilling a request (typically by confirmation link to the email on file). An authorized agent may submit requests on your behalf with written authorization we may verify. We respond within 30 days in most cases (45 days under most US state laws, extendable once; 45 days extendable to 90 under CCPA). We do not charge for the first request in a 12-month period; for excessive or manifestly unfounded requests we may charge a reasonable fee or decline, as permitted by law.
10. US state-specific rights and disclosures
10.1 California (CCPA/CPRA). California residents have the rights to know, delete, correct, opt out of sale/sharing, limit use of sensitive personal information, and non-discrimination. We do not sell or share personal information and have not done so in the preceding 12 months; we do not use or disclose sensitive personal information for purposes other than providing the Service, so there is nothing to opt out of or limit. We honour Global Privacy Control as an opt-out of sale and sharing.
Categories of personal information collected (CPRA categories): identifiers (email, account ID, IP address, a random browser identifier); customer records (name, billing data); internet or other electronic network activity (usage data, IP address); commercial information (subscription history); sensitive personal information (conversation content that may reveal health-related information; account log-in credentials); inferences (crisis-detection signals used only for in-product safety, and the memory used only to personalize your conversations). Sources, purposes, and recipients are described in sections 4, 5, and 7. Retention criteria are in section 8.
Shine the Light (Civ. Code §1798.83): we do not disclose personal information to third parties for their direct marketing purposes.
California SB 243 (companion chatbots): the disclosures and crisis protocol described in section 3 are provided pursuant to Business & Professions Code §§22601–22605. Our published crisis protocol is at trycalypso.ai/safety.
10.2 Other US states. If you are a resident of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Florida, Montana, Iowa, Delaware, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, or Rhode Island — each of which has a comprehensive privacy law in effect as of August 2026 — you have rights substantially similar to those in section 9, including access, correction, deletion, portability, opt-out of sale/targeted advertising/profiling (we do none of these), and appeal. Residents of Oklahoma and Louisiana (laws effective January 1, 2027), Alabama (May 1, 2027), and Vermont (January 1, 2028) will have equivalent rights when those laws take effect.
Sensitive data. Every state law listed treats health-related information — in several states including anything used to infer mental health status — as sensitive data. Our handling is described in section 6: processing only as necessary to provide the Service, opt-in consent for anything more, and no sale ever.
Universal opt-out signals. We honour the Global Privacy Control signal as an opt-out of sale/sharing/targeted advertising in every state that requires it (including California, Colorado, Connecticut, Texas, Montana, Nebraska, New Hampshire, New Jersey, Minnesota, Maryland, Delaware, and Oregon).
Maryland. We comply with MODPA's data-minimization standard: we collect personal data only as reasonably necessary and proportionate to provide the Service you request, we process sensitive data only where strictly necessary, and we do not sell sensitive data (we sell no personal data at all).
Washington and Nevada. See the standalone Consumer Health Data Privacy Policy at trycalypso.ai/consumer-health-data-privacy.
New York. The AI-companion disclosures and crisis-referral protocol described in section 3 are provided pursuant to General Business Law Article 47.
Texas. Calypso does not accept users under 18 (section 2); the Service is not directed to minors.
10.3 European Economic Area, United Kingdom, and Switzerland (GDPR / UK GDPR). You have the rights in section 9. Legal bases are in the table in section 5. Data Controller: Calypso; contact details in section 14. Data Protection Officer: we have not appointed a DPO; you can reach our privacy team at privacy@trycalypso.ai. Complaints: your local supervisory authority (edpb.europa.eu; ico.org.uk). International transfers: your information is stored in the United States and processed by our providers in the countries where they operate. Where personal information leaves the EEA/UK/Switzerland for a country without an adequacy decision, we rely on the Standard Contractual Clauses (with UK Addendum / Swiss equivalent) included in our providers' data processing terms where they offer them.
11. Canada (PIPEDA and Quebec Law 25)
If you are in Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) governs our handling of your personal information; if you are in Quebec, the Act respecting the protection of personal information in the private sector (as modernized by Law 25) also applies.
Accountability / Privacy Officer. Our person in charge of the protection of personal information is our Privacy Officer, reachable at privacy@trycalypso.ai.
Express consent for sensitive information. Conversation content that reveals emotional or intimate information is sensitive; we obtain express consent at signup for the processing needed to provide the Service, and we would ask for separate express consent for anything beyond it (we do not currently do anything beyond it).
Cross-border transfers. Personal information about Canadian users is transferred to, stored, and processed in the United States (and the countries where our service providers operate). While there, it is subject to the laws of those jurisdictions and may be accessible to their courts, law enforcement, and national security authorities. We use the contractual safeguards our providers' terms offer, and our own technical measures (section 13), to protect it. For Quebec residents, we conduct the privacy impact assessment Law 25 requires before communicating personal information outside Quebec.
Profiling and technology disclosures (Quebec). The Service personalizes conversations using your conversation history, memory and profile, and uses automated detection of crisis-related language to show the in-product Crisis Banner. These functions operate as described in sections 3, 4 and 5. We do not use your conversations to train AI models.
Portability (Quebec). You may request your conversation history and account data in a structured, commonly used technological format (section 9).
Breach notification. We report breaches of security safeguards presenting a real risk of significant harm to the Office of the Privacy Commissioner of Canada and affected individuals, maintain the 24-month breach register PIPEDA requires, and notify the Commission d'accès à l'information for Quebec incidents presenting a risk of serious injury.
Complaints. Office of the Privacy Commissioner of Canada (priv.gc.ca); in Quebec, the Commission d'accès à l'information (cai.gouv.qc.ca).
Minors. The Service is 18+ everywhere, including Canada (section 2).
12. Cookies and similar technologies
Calypso stores small pieces of data in your browser (cookies, local storage and session storage) for three purposes:
Strictly necessary — a sign-in token keeps you signed in (and, without an account, ties your chats to a random identifier); text you paste into Decode is held in your browser until you submit it; and if chat has been restricted for safety reasons (section 3), a cookie keeps the restriction in place on that browser.
Functional — remembering small things, such as when you last visited and which decode reads you have already rated.
Analytics — our product-analytics provider's script sets its own cookies and local storage to count page views and clicks and to tell visits apart. It runs for every visitor and, when you are signed in, is linked to your account ID. It records each page's address and title (for a shared read, the title is its public headline), which parts of a page you scroll to, and, outside the app and shared reads, the buttons and links you click. It does not record clicks inside the app or on shared reads, and it never records the text of your messages.
We do not use cookies for advertising, and we do not use cookies to track you across third-party websites. No advertising network or other third party serves content or ads through the Service.
13. Security
Encryption in transit (TLS 1.2+) everywhere, and encryption at rest for our database, which holds your account, conversations and decodes.
Short-lived uploads — screenshots are deleted from our servers about 24 hours after the decode finishes.
Access controls — staff access to personal information is limited to the people who need it to run the Service.
Authentication — sign-in uses a one-time code sent to your email address, and passwords, where set, are stored as salted hashes (bcrypt).
Updates and reporting — we keep our software up to date, and you can report a security problem to security@trycalypso.ai.
Backups — our database provider keeps managed backups (section 8).
No system is perfectly secure. If a breach creates meaningful risk to you, we will notify you and the relevant authorities as required by applicable law (72 hours under GDPR; state-specific timelines, generally 30–60 days, in the US; PIPEDA's "as soon as feasible" standard in Canada). Because conversation content may be treated as health-related information under several state breach-notification laws, our incident-response plan classifies it accordingly.
14. Contact us
General privacy questions and requests: privacy@trycalypso.ai.
Security: security@trycalypso.ai.
Safety and abuse: safety@trycalypso.ai.
California requests: privacy@trycalypso.ai (subject "California Request").
Privacy Officer (Canada/Quebec): privacy@trycalypso.ai (subject "Privacy Officer").
We aim to respond to every privacy request within 30 days (extendable as permitted by applicable law).
15. Changes to this Policy
When we make a material change, we will update the "Last updated" date at the top of this page, notify you by email and in-product notice at least 30 days before the change takes effect, and, where required by law, obtain renewed consent. Past versions are archived and available on request at privacy@trycalypso.ai.
16. Our social media accounts and YouTube API Services
Calypso uses YouTube API Services. We use them for one thing: to upload and publish Calypso's own videos to Calypso's own YouTube channel.
We do this with an internal publishing tool. The same tool posts the same videos to Calypso's own accounts on Instagram and Facebook (through Meta's APIs), X (through X's API) and TikTok (through a scheduling service). It is not part of the website or the app, and it is used only by the Calypso team.
What the tool accesses. It acts only on Calypso's own accounts, using access that we granted to ourselves. On YouTube, it uploads our video, checks that the upload went through, and reads our own channel's name. It does not access, collect or store any information about the visitors or users of trycalypso.ai, about the people who watch our videos, or from anyone's YouTube, Google or other social media account. Nothing in the Service asks you to connect such an account.
What the tool stores. The access credentials for our own accounts, kept as private configuration, and the IDs and links of the videos we publish. We do not share any of it with anyone else, and we do not use it for advertising.
Google and YouTube. Your use of YouTube is governed by YouTube and Google, not by us: see the Google Privacy Policy and the YouTube Terms of Service. Access granted to an app through a Google account can be revoked at any time on Google's security settings page, at myaccount.google.com/permissions.
Deletion. If you ask us to delete data we have stored through YouTube API Services, we will delete it within 7 days of your request. If access granted to us is revoked through Google's security settings page, we will delete any data we stored through YouTube API Services within 30 days of the revocation. Neither affects data stored by YouTube itself, such as videos published on YouTube, which YouTube holds under its own terms.
The same applies to the other platforms: to have us delete any data we hold from Instagram, Facebook, X or TikTok, email privacy@trycalypso.ai and we will delete it within 7 days of your request. As described above, our tool holds no data about you from any of them.
Other platforms. Each platform handles your data under its own policy: Meta Privacy Policy (Facebook), Instagram Privacy Policy, X Privacy Policy, and TikTok Privacy Policy.
Questions or complaints about any of this: privacy@trycalypso.ai.
17. The plain-language summary
Calypso is for adults — you must be 18 or older to use it.
Calypso is an AI, not a human, and not therapy or a crisis service. If you're in crisis, our Safety page connects you to real people (988, Crisis Text Line) — and the product will point you there too.
We collect what we need to run Calypso for you — your account, your conversations, your uploads, your usage, your billing info — and as little else as we can.
Your conversations are private to your account, and we treat them as sensitive data everywhere, because what you share here is personal. Incognito mode doesn't save them.
We never sell your personal information and never use your conversations for advertising. No ad pixels, no ad trackers.
We don't use your conversations to train AI models, and we have not opted in to any AI provider doing so. One provider's own terms are different; section 7.1 explains.
We share information only with the small set of providers needed to run the Service, under their data processing terms, or when the law requires.
We post our own videos to our own YouTube, Instagram, Facebook, X and TikTok accounts. That tool never touches your data.
You can delete conversations and decodes yourself, ask to delete your account from your profile, and email privacy@trycalypso.ai to access, correct or export your data. We honour Global Privacy Control as an opt-out of sale and sharing, and we'll never penalize you for exercising your rights.
Questions about your data?
Email privacy@trycalypso.ai. A real person reads it.