Privacy architecture

A Libertoo account is a generated pseudonym and a passphrase you choose. No name, no email, no phone number. An email address is only ever stored if you choose to add one for receipts or account recovery, and it lives in a separate billing table, never joined to your product data.

Your journal, your conversations, your risk profile, your review notes — all of it is encrypted on your device, with a key derived from your passphrase, before it is stored. Our servers keep only encrypted blobs. There is no code path that stores this content in readable form.

The honest consequence: if you lose your passphrase and your recovery code, your encrypted data is unrecoverable. That’s the point — a recovery door for you would be a reading door for someone else.

Fully end-to-end encryption is impossible for an AI coach — the model has to read your message to answer it. We won’t pretend otherwise. Here is the actual boundary: your stored data is unreadable to us. To answer you, the coach processes messages in transit — we don’t store or log them.

In practice: your device decrypts locally, sends the current message over an encrypted connection, and we forward it to Anthropic — the company behind the Claude models that run the coach — then stream the answer back while your device re-encrypts anything you save. Every message also passes a safety check on a second Anthropic model, so a message in crisis is caught even when the coach never answers it. Our servers handle message content only transiently and store none of it. Anthropic processes it to generate the reply, does not use it to train its models, and under its API terms retains it only briefly to detect misuse.

Some minimal operational data has to be readable for the product to work, and we’d rather list it than hide it: your pseudonym, your check-in schedule and timezone (so check-ins arrive on time), your push subscription, your subscription status, and coarse event counters (an event name and a timestamp — never content). That is the whole list, and this page changes if it ever grows.

Server logs may contain event names, timestamps, and opaque IDs — never message content, never journal text, never AI prompts or responses. Platform request logging is disabled outright, which is easier to verify than a filtering rule.

Every push notification is generic — “Got a minute?”, “Check in when you can” — and is never derived from anything you wrote. Someone glancing at your lock screen learns nothing.

The app installs under the neutral brand name with a neutral icon. Your bank statement shows a neutral payment line — our payment provider’s generic prefix plus the brand name (e.g. “LEMSQZY* LIBERTOO”). No word on any system surface says what this app is for.

The same discretion applies to recommendation links: they carry an affiliate tag, are sent to the merchant with a no-referrer policy, and load zero tracking scripts — the merchant learns only that the click was ours, not which page you were on or anything about your account.

Honesty cuts both ways, so here is what you will never see in our marketing:

• “End-to-end encrypted AI.” False for any AI coach, including this one — see the boundary above.
• “Zero-knowledge.” Your stored content is unreadable to us, but the coach processes messages in transit, so the strict cryptographic term doesn’t apply and we won’t borrow its credibility.
• “Anonymous payments.” Payments run through Lemon Squeezy, our merchant of record, which sees payment identity — that’s how card networks work. Your payment identity is kept apart from your product data.

If this is the architecture you’d trust with your worst nights, you can start now — free, and with no name or email.

If anything here is unclear, or you think a claim exceeds the design, say so: hello@libertoo.com. This page is part of the product.