Privacy Policy

Last updated: 14 March 2026

Scotty is a personal relationship manager operated by Kane Lo. This policy explains what data we collect, how we protect it, and your rights.

The short version: Your contact data is encrypted with a key unique to you. We store the minimum needed to run the service. You can export or delete all your data at any time.

1. What We Collect

Data	Purpose	Stored Where
Email address	Authentication (Google sign-in)	Firebase Auth
Contacts & interactions	Your contact data	Encrypted SQLite in Google Cloud Storage
Subscription status	Billing & tier enforcement	Stripe + Firebase custom claims
Audit log	Security (login, export, deletion events)	Firestore

We do not collect analytics, tracking cookies, usage telemetry, or any data beyond what is listed above.

2. How Your Data Is Protected

Encryption at rest: Your contact database is encrypted with AES-256-GCM using a per-user data encryption key (DEK). Each user has their own isolated database file.
Encryption in transit: All connections use TLS 1.3, enforced by Google Cloud Run.
Key management: Your DEK is wrapped with a server-side wrapping key stored in Google Cloud Secret Manager. The wrapped key is stored in Firestore.
No shared database: Each user has a separate encrypted file. There are no shared tables or cross-user queries.

3. Security Model — Honest Disclosure

The operator (Kane Lo) has access to the server wrapping key in Google Cloud Secret Manager and could theoretically unwrap any user's encryption key to access their data. This is the same model used by WhatsApp, iCloud, and most SaaS products.

We mitigate this through:

Audit logging of all access events
Open-source code (you can inspect the server)
Minimal data collection
No reason or incentive to access your data

4. Your Rights

Right	How
Export all your data	Use the `export_my_data` tool in Claude. Returns a JSON download link.
Delete your account	Use the `delete_account` tool in Claude. Permanently removes your encrypted database, Firestore profile, Firebase Auth record, and Stripe customer.
View your data	All your data is visible through Scotty's tools (search, get_contact, etc.)

Deletion is immediate and irreversible. There are no soft deletes or retention periods for contact data. Audit log entries are retained for security purposes.

5. Third-Party Services

Service	Purpose	Data Shared
Google Cloud Platform	Hosting, storage, authentication	Encrypted database files, email for auth
Firebase Auth	User authentication	Email, OAuth tokens
Stripe	Payment processing	Email, payment details (handled by Stripe)
Anthropic (Claude)	AI interface	Tool call parameters flow through Claude's conversation; Anthropic's privacy policy applies to conversation data

6. Data Retention

contact data: Retained until you delete it or delete your account.
Audit logs: Retained indefinitely for security. Contain only event type, user ID, and timestamp — no contact content.
Stripe records: Governed by Stripe's retention policy.

7. Changes to This Policy

Material changes will be communicated via Scotty (Claude will inform you). The "last updated" date at the top reflects the most recent revision.

8. Contact

For privacy questions or data requests: kane@kanelo.nz