Privacy Policy

Information we collect

We collect only what we need to run Sivella for your household:

• Account information — your name, email, and authentication details (for example, when you sign in with Google).
• Household content — the tasks, calendar and availability, budget context, notes, decisions, and messages you and your household members add to Sivella.
• Usage and device information — basic technical data such as log data, device and browser type, and interactions needed to operate and secure the service.
• How you found us — if you arrived from a campaign link, the campaign parameters in that link, the site that referred you, and the page you landed on. We keep these in your browser until you create an account, then store them with the account so we know which channel it came from.

How we use your information

We use your information to deliver the features you use — and nothing more. We do not use your household content for advertising or to train AI models.

• To provide and operate Sivella — coordinating tasks, availability, budgets, and decisions for your household.
• To respond to your requests and provide support.
• To keep the service secure, prevent abuse, and meet our legal obligations.
• To improve the product through aggregate, non-identifying operational metrics — never by training AI on your content.

AI models and your data

Sivella uses AI models to help your household plan and decide. We use these models to generate responses for you in the moment — we do not use your data to train them.

Your content is never added to any model's training data. We do not fine-tune models on your household's information, and we do not allow our model providers to train on it.

Across every tier, Sivella is designed to keep household data out of training pipelines. On the free tier this is handled by in-house, non-training models; paid tiers add stronger models under the exact same no-training commitment.

Where we rely on third-party model providers, we use them under terms that prohibit training on your data and limit them to processing requests on our behalf.

How we share information

We do not sell your data. We share it only in these limited cases:

• Service providers — vetted processors (such as hosting, infrastructure, and model inference) act strictly on our behalf to operate Sivella, under contracts that require confidentiality and prohibit using your data for their own purposes, including training.
• Google Analytics — we use Google as our analytics processor for the measurement described under "Cookies and analytics" below. It receives page views and basic device and country-level location data. It never receives your household content, your account identifiers, or anything else that names a person or a home.
• Cloudflare — Cloudflare delivers and protects this site, so every request to it passes through them. They also run a separate, cookieless count of that traffic for us. Like Google, they never receive your household content or your account identifiers.
• Within your household — content you add is visible to members of your household according to the visibility and permission settings in the product.
• Energy check-ins — your household sees the level you log (low, steady, or high), how overwhelmed you said you felt, and the date you last checked in. The notes you write and any burnout indicators stay private to you.
• Legal and safety — we may disclose information if required by law or to protect the rights, safety, and security of our users and the public.

Data retention and deletion

We keep your information for as long as your account is active or as needed to provide Sivella.

You can request deletion of your account from My profile inside the app. Deleting the household as well requires being its owner or an admin. Your account stays active for 24 hours after you ask, so you can cancel if you change your mind, and is deactivated once that window passes. You will receive confirmation that your account has been deleted within 30 days. You can also email [email protected] instead, and we will process the request within 30 days of contact.

When we process a deletion, your account is deactivated and made inaccessible. We retain the underlying data for a 120-day recovery window in case the deletion was a mistake. After that window, the personal and identifying information tied to the account or household is irreversibly anonymized, and any stored access tokens are removed.

We remove data from active systems and from backups within a reasonable period, except where we must retain it to meet a legal obligation.

Security

We use industry-standard measures — encryption in transit, access controls, and tenant isolation — to protect your data. No system is perfectly secure, but we work to keep household data scoped to your household and out of the wrong hands.

Your rights and choices

You stay in control of your information. You can:

• Access and export your data — email [email protected] and we will send a machine-readable archive within 30 days, scoped to you and excluding other household members' private information.
• Correct or update your information.
• Delete your content, your account, or your entire household from My profile in the app, or by emailing [email protected] — an in-app request is cancellable for 24 hours before it takes effect, an emailed one is handled within 30 days, and either way a 120-day recovery window follows before personal data is irreversibly anonymized. Deleting the whole household requires being its owner or an admin.
• See or remove how we found you — the campaign parameters recorded when your account was created are included in your data export, and you can email [email protected] to have them removed while you keep the account. They are deleted along with the account when you delete it.
• Exercise additional rights you may have under laws such as the GDPR or CCPA, including objecting to certain processing. We honor these requests.

Cookies and analytics

We use essential cookies to keep you signed in and to operate the service.

We use Google Analytics 4 to understand how people find Sivella and which parts of it get used. It runs with consent denied by default. Until you tell us otherwise, it sets no analytics cookies and stores no analytics identifier on your device, and the measurement it sends is cookieless: it cannot recognize you on a later visit or follow you to another site. There is no cookie banner today, so in practice this is how it runs for everyone.

Analytics runs on the marketing site and inside the app. Inside the app, the page address is reduced to its route template before it is sent: a page about one task is reported as the shape of that page, never with the identifier in it, and a page we have no template for is reported only as "somewhere in the app". The only query parameters that survive anywhere are the campaign tags in a link you clicked; everything else in the address, including the part after the # symbol, is dropped. No household identifier, task or record identifier, member name, or account identifier reaches Google.

We do not turn on Google's advertising features, Google Signals, remarketing, or demographic reporting. We do not send Google an identifier that links measurement to your Sivella account, and we do not use analytics to profile you or to target ads. IP addresses are handled under Google Analytics' own anonymization, and we do nothing to undo it.

A second, simpler count runs alongside Google Analytics: Cloudflare, who delivers this site, measures traffic to it for us. That measurement is cookieless. It sets nothing on your device and stores no identifier, so it cannot recognize you on a later visit or follow you anywhere else. It counts page loads and reports them in aggregate — which pages, roughly which country, which kind of browser — and it identifies nobody. We keep it because it is an independent count we can check the Google numbers against, and because it asks nothing of you to work.

Some of what runs on our pages is loaded by Cloudflare at the edge rather than shipped in our own code. Everything in this section applies to whatever runs there too: it is held to the same rules, it never receives your household content or your account identifiers, and it is never used for advertising or profiling.

Separately from Google, when you arrive from a campaign link we keep the campaign parameters from that first visit in your browser's local storage. If you go on to create an account, they are sent with the sign-up and stored against it, so we can tell which channel a household came from. If you never sign up, they never leave your browser. This is not advertising and it is not profiling: it is a first-touch record attached to one account, and it is deleted when the account is.

Children's privacy

Sivella is not directed to children under 13 (or the equivalent minimum age in your jurisdiction), and we do not knowingly collect their personal information.

International users

Sivella may be operated from, and your data processed in, countries other than your own. Where we transfer data across borders, we take steps to ensure it remains protected under this policy.

Changes to this policy

We may update this policy as Sivella evolves. If we make material changes, we will update the date above and, where appropriate, notify you.

Contact us

Questions about privacy, or want to exercise your rights? Reach us at [email protected].