True North Privacy Policy

Effective date: 2026-09-14 (previous version: 2026-07-06)
Who we are: True North (truenorthfamily.ai) is operated by Artilect US LLC, a US limited liability company (“we”, “us”)
Contact: truenorth@artilect.us

True North is a family-oriented AI chat service that lets you talk to multiple AI models, compare their answers, and set up supervised profiles for your children. This policy covers the True North website and apps. It explains what we collect, why, who we share it with, and the choices you have. We have tried to write it so a busy parent can actually read it.

1. What we collect

Account information. When you sign up, our identity provider (id.artilect.us) handles your login and gives us your email address and basic profile information (name, if provided). If you use Sign in with Apple or Sign in with Google, Apple or Google provides a verified identifier and (if you choose to share it) your email address. We never see your password when you sign in through the identity provider, and we never see your Apple or Google password.

Chats and messages. The messages you send, the AI responses you receive, and per-chat settings. This includes “Multi Chat” sessions where one prompt goes to several models.

Gems. Saved snippets/answers you choose to keep.

Memories. True North includes a memory feature: after conversations, an AI model automatically extracts short notes about your preferences and context (for example, “prefers metric units”) so future chats can be more helpful. These memories are stored with your account, can be viewed and deleted in the app, and can be downloaded in full at any time (Settings → Memory export, or GET /api/mem/export).

Images and files. Images and attachments you upload to chats, and images the service generates for you. These are stored on our servers.

Usage and cost records. Which models you used, token counts, and the cost of each request. We use this to show you your usage, to bill you correctly, and to enforce spending limits.

Purchase records. If you subscribe or buy credits through the Apple App Store (or Google Play, where offered), Apple or Google sends us records of the purchase: transaction identifiers, the product bought, purchase and expiry dates, subscription status, and any refund or cancellation notices. We keep these to grant and maintain your plan and to reconcile your balance. We never receive or store your payment card details from Apple or Google. For purchases on our website, Stripe processes the payment and we store the Stripe customer and transaction identifiers.

Consent records. When you accept our Terms of Service and this policy (and attest that you are 16 or older), we record the time and the version of the text you accepted. When a parent creates a child profile, we record the time of parental consent and the version of the consent text the parent affirmed.

Child profiles. A child profile stores a display name, a hashed PIN, the parental-consent timestamp and consent-text version, the child's content-filter and Voice settings the parent chose (the child's age band, which topics are blocked or sent back to the parent, how those redirects are worded, and how the AI talks with the child — a child without their own settings follows the family's), a data-retention setting, and the child's chats/messages. Child profiles have no email address — they exist only inside the parent's account. We do not collect a child's birthdate; see section 6.

Push notification tokens. If you enable notifications in the iOS app, we store the device push token Apple gives us so we can tell you when a long-running request finishes.

Logs. Standard server logs (timestamps, IP addresses, request paths, errors) kept for security and debugging.

What we do NOT collect. We do not run advertising trackers or third-party analytics on the website or in the apps. We do not sell your data. We do not build advertising profiles. The iOS app contains no third-party analytics or advertising SDKs.

2. How we use your data

• To run the service: deliver your messages to AI models and return their answers.
• To personalize: inject your memories into new conversations so the AI has context.
• To keep children safe: apply the content filters and oversight tools their parent configured.
• To bill you and prevent abuse: track usage, validate purchases, enforce rate and spend limits.
• To communicate: send you service emails (see section 3, “Email provider”).
• To secure and improve the service: debug problems, investigate abuse.

We do not use your conversations to train AI models ourselves. Prompts are sent to third-party model providers to generate responses (see section 3); their handling is governed by their own terms — via OpenRouter we route to providers under OpenRouter's data policies.

3. Who processes your data (processors and subprocessors)

To run True North we share data with the following providers, each only for the stated purpose:

Provider	Purpose	What they receive
OpenRouter (openrouter.ai)	AI model inference. OpenRouter is a routing layer that forwards your prompts to the third-party model providers you select (e.g. OpenAI, Anthropic, Google, Meta and others).	Your messages, conversation context, injected memories, and any images/attachments in the conversation.
fal.ai	Image generation (default image provider).	The image prompt you submit.
OpenAI	Image generation (for OpenAI-routed image models) and automated content moderation of prompts, images, and outputs, where enabled.	Image prompts and, for moderation, the content being checked.
Apple	Sign in with Apple; push notifications (APNs); App Store purchases (subscriptions and credit packs), including Apple's server notifications about renewals, refunds, and cancellations.	Sign-in tokens; push tokens and minimal notification payloads (e.g. “your Multi Chat round finished” — not message content); purchase transaction records. Apple handles the payment itself; we never see your card.
Google	Sign in with Google (through our identity provider); Google Play purchases where the Android app offers them, including Google's notifications about renewals and refunds.	Sign-in tokens; purchase transaction records. Google handles the payment itself.
Stripe	Payments made on our website (credit top-ups, subscriptions), where offered.	Payment details, email. We never see or store your full card number.
id.artilect.us	Identity provider — sign-up, sign-in, session management (operated by us).	Email, password (held by the identity provider, not by the True North service), profile basics.
Email delivery provider	Transactional email, sent through a third-party email delivery service. Currently this is limited to waitlist/invite emails containing your email address, name (if given), and an access code.	Recipient email address and the message content described.
DigitalOcean (hosting)	Hosting (infrastructure processor) — our servers and database run on infrastructure rented from DigitalOcean in the United States; they store data on our behalf and do not access it for their own purposes.	All service data, at rest on their machines, under our control.

Important: when you chat, your prompt content necessarily leaves our servers and goes to the AI model provider that generates the response. Do not put anything in a chat that you would not send to those providers.

4. Encryption, including the optional encrypted-conversations mode

All traffic to True North is encrypted in transit (TLS).

True North also offers an optional encrypted-conversations mode for individual chats. When enabled, messages are encrypted on your device with per-conversation keys, and encrypted copies of the conversation key are issued to each of your registered devices.

An honest caveat — this is not “end-to-end encryption”, and we deliberately don't call it that. The True North server is itself one of the “devices” that receives a copy of the conversation key. This is by design: the server must be able to read your message in order to send it to an AI model and get you an answer. So this mode protects your messages at rest (a stolen database backup, or a compromise that only reaches stored data, yields ciphertext without the server's separately-stored key file), but the server operator can technically decrypt conversation content while the service is running — unlike strict end-to-end-encrypted messengers such as Signal. We say this plainly so you can make an informed choice.

Child PINs are never stored in plain text — only a cryptographic hash.

5. Sharing you control

You can create a public share link for a chat, a gem, or a round. Anyone with that link can view the shared content without logging in. Shares are off by default, are only created by your explicit action, and can be revoked at any time (revoking disables the link). Share links cannot be created from a child session. Think before sharing content that contains personal information.

6. Children

True North is built for families, and we treat children's data with extra care:

• Only adults hold accounts. Account holders attest at sign-up that they are 16 or older. We do not knowingly let anyone under 16 create their own account; if you believe a child has, email us and we will delete it.
• Child profiles are local to the parent's account. A child has a display name and a PIN — no email address, no phone number, and no direct relationship with our identity provider or any third-party sign-in.
• Parental consent is required. The parent who creates a child profile is a signed-in adult account holder (verified through their email, Apple, or Google identity) who must affirmatively check a consent box that points to this section for exactly what is stored and how it is protected. We record when consent was given and which version of the consent text the parent affirmed. A parent can withdraw consent at any time by deleting the child profile.
• Parents stay in control. A parent can read every one of their child's chats from the Family dashboard (the default; a parent may instead choose to see only the safety log). Parents choose each child's filter settings and age band (a preset can fill them in; every setting shows exactly what it changes), can turn on pre-approval of a child's messages (off by default; when on they see and can edit each pending message before the AI answers), can review the safety log of filter events, and decide whether a child may sign in independently on their own device (off by default). A child's picture ideas and generated pictures each wait for parent approval by default.
• One exception: a child who tells us they are being hurt. While the Safety filter is on (it is on by default for every child account), if a child tells us an adult or older person is hurting them, touching them sexually, grooming them, or that they are not safe at home, that conversation is kept private from every adult on the account — including the parent — and the child is given the Childhelp National Child Abuse Hotline (1-800-422-4453). It is not shown in the chat list, the safety log, the approvals queue, or the data export, and a parent cannot unhide it; a pending-approval hold never applies to it. We tell parents about this rule here and in the app’s settings, never when it happens. The conversation stays in our systems under our staff-access controls. Detecting a disclosure is part of the Safety filter, so if a parent turns the filter off, this protection is off too.
• Content filtering. Messages in child sessions pass through configurable safety filters; blocked attempts are redirected and logged for the parent.
• No public sharing, no purchases, no ads. A child session cannot create share links, cannot see or make purchases, and never sees advertising. We do not use children's data for advertising, profiling, or model training.
• Retention. Child profiles carry a data-retention setting (default 90 days); where the automatic purge is enabled, child chat data older than the retention window is deleted on a schedule. Parents can delete a child's chats at any time regardless.
• Export and deletion. A parent can download everything we hold about a child (GET /api/family/children/{id}/export), except a conversation kept private under the exception above, and can delete the child profile and all its data at any time.
• Age. We do not collect a child's birthdate; the parent chooses an age band that tunes the safety filters. Parents are responsible for ensuring their use of child profiles complies with the age rules that apply to them.

A child's chats are processed by the same AI model providers described in section 3, subject to the parent's filter settings. Those providers act as our processors and are not permitted to use the content for their own purposes beyond what their published terms allow.

7. Retention and deletion

• Chats, gems, memories, images: kept until you delete them. Deleting a chat removes its messages and attachments from the live system (this is deletion of the stored records, not merely hiding them); copies in backups age out as described below.
• Child data: subject to the per-child retention setting (default 90 days) where the automatic purge is enabled, plus the export/delete controls in section 6.
• Usage, purchase, and billing records: kept as long as needed for billing, accounting, tax, and abuse prevention, then deleted or anonymized.
• Account deletion: you can delete your account yourself in the app (Settings → Delete Account, or DELETE /api/me); this permanently erases your account, your children's profiles, and their data. You can also email truenorth@artilect.us and we will delete your account and associated data within 30 days of a verified request. Deleting your account does not cancel an App Store subscription — cancel it in your Apple Account settings.
• Data export: you can download your memories (section 1) and a full account export (GET /api/me/export) at any time. If you have trouble, email truenorth@artilect.us for a manual export.
• Backups: deleted data may persist in backups for a limited period before those backups age out.

8. Your rights

Wherever you live, we extend you these rights over your personal data:

• Access — ask for a copy of what we hold about you.
• Correction — fix inaccurate data.
• Deletion — have your data erased (see section 7).
• Portability — receive your data in a machine-readable format.
• Objection / restriction — object to or restrict specific processing.
• Withdraw consent — where processing is based on consent (e.g. a child profile), withdraw it at any time; withdrawal doesn't affect processing that already happened.

To exercise any of these, email truenorth@artilect.us. We may need to verify your identity first. If you are in the EU/EEA or UK you also have the right to complain to your data-protection authority. We will not treat you differently for exercising any of these rights.

9. Cookies

We use only essential cookies: session cookies that keep you signed in (including separate, more limited cookies for child sessions) and remember whether the current session is a child session. There are no advertising cookies, no third-party analytics, and no cross-site tracking. Because we use only strictly-necessary cookies, we do not show a cookie banner.

10. Security

We use TLS in transit, hashed credentials (PINs and, at the identity provider, passwords), scoped and audited access controls between family members (a child session cannot reach parent-only areas), spend/rate limits, server-side validation of every purchase, and the optional encrypted-conversations mode described in section 4. No system is perfectly secure; see section 11.

11. Data breaches

If we learn of a breach that affects your personal data, we will notify affected users without undue delay — and where a supervisory authority must be informed, within the timeline the law requires (e.g. 72 hours under GDPR) — describing what happened, what data was involved, and what we are doing about it.

12. International transfers

Our servers are hosted on infrastructure in the United States. The AI model providers and other processors listed in section 3 may process data in other countries, including the United States. If you use True North from outside the United States, your data is transferred to and processed there. Where the law requires a transfer safeguard, we rely on our providers' data-processing terms, which include standard contractual clauses where they apply.

13. Changes to this policy

We may update this policy. For material changes we will notify you in the app or by email before they take effect, and we will always show the effective date at the top. Continued use after the effective date means the updated policy applies.

14. Contact

Questions, requests, complaints: truenorth@artilect.us
Controller: Artilect US LLC, a US limited liability company. We accept privacy requests and legal notices by email at the address above.