Privacy Policy

Upstream holds conversations about things people mostly don't say out loud. The honest summary of how that is handled:

• Your conversations are private to your account. No one else using Upstream can see them, and they are not published, shared or sold.
• To write a reply, your messages are sent to Anthropic's Claude. That is how the product works, and it is named here rather than buried.
• We do not sell your data, run advertising, use your conversations for ad targeting, or train any model on them.
• We keep as little as the product can function on, and the most sensitive thing stored — a duress phrase — is encrypted in a way that means nobody can read it, including us.

The rest of this page is the detail behind those four lines.

Only what a conversation and an account need.

• Account. Your email address and a password, handled by Firebase Authentication. We never see or store your password.
• Profile. A display name, an age band, how direct you want Upstream to be, and anything you choose to write in “What I know”. All of it optional, all of it editable in Settings, and intake can be skipped entirely.
• Conversations. The messages you send and the replies you get.
• Memory. Short notes Upstream derives from conversations — patterns, insights, and open steps — so it doesn't start from scratch each time. You can see all of it on the Memory page and retire any of it.
• Safety. If you choose to set them: trusted contacts, and a private phrase. Both are encrypted before they are stored. See The safety features.
• Billing. Whether your plan is free or paid, and a Stripe customer reference. Card details never reach us — they go to Stripe directly.
• Technical. Ordinary server logs. These deliberately record identifiers and error messages, never the content of a message.

There is no analytics package, no advertising pixel, no session recording, and no third-party tracker on the app or this site.

• We do not sell or rent your personal information to anyone.
• We do not use your conversations for advertising or ad targeting.
• We do not use your conversations to train a language model, ours or anyone else's.
• We do not report your use, your content, or your absence to any facility, program, officer, employer or funder. Upstream is not provisioned by an institution and is not tied to a case file.
• We do not produce risk scores or assessments, or anything that could be read as one.

Upstream is a small product built on other people's infrastructure. These are every third party your data can reach, and why.

• Google (Firebase). Authentication, database and file storage. This is where your account, profile, conversations and memory live.
• Anthropic (Claude). Receives your messages and the context of your conversation in order to generate a reply. Also used to write your wrap-up notes.
• OpenAI. Text-to-speech, only if you turn on spoken replies. When voice is off — which is the default — nothing is sent to OpenAI at all. When it is on, the text of a reply is sent so it can be read aloud.
• Web search. Upstream can look something up on the web when a conversation genuinely needs a fact it does not have. It is instructed not to reach for this in a conversation about your life, and in practice it rarely does — but when it happens, a search query written by Upstream leaves to a search provider through Anthropic. Your conversation is not sent; the query can still contain words drawn from what you wrote.
• Stripe. Payments and subscription management, if you upgrade.
• Humanik. Sends the SMS message to your trusted contacts, and only in the event you trigger the duress phrase you set yourself.

Each of these is bound by its own agreement with us to process data only on our instructions. Each also has its own privacy policy governing how it operates.

These deserve their own section, because they hold the most sensitive data here.

• Your duress phrase is encrypted and unreadable. It is stored encrypted under a separate key, in a location our own security rules block every client from reading — including you. There is no screen anywhere, for anyone, that displays it back. You can replace it or clear it at any time.
• Trusted contacts are encrypted at rest and are never shown to the assistant. Upstream cannot see who they are and cannot mention them.
• The safety log records contact details in readable form. When an alert is triggered, the record of who was contacted is deliberately stored so that it remains readable afterwards — a record of an emergency that can't be read later isn't a record. It is visible only to you, at Settings → Safety → Safety log. We are naming this plainly because if someone else gets into your account, that log is legible to them.
• Crisis handling never involves a model. When a message matches our crisis patterns, the reply you get is a fixed block of resources written in advance. The message is not sent to Anthropic.

• Conversations and memory are kept while your account exists, so that Upstream can carry context forward. Deleting a conversation removes it from your view.
• Safety alert records are append-only and are not deleted, because an audit trail that can be edited is not an audit trail.
• Billing records are kept as long as tax and accounting rules require.
• Server logs are kept on a short rolling window.

If you ask us to delete your account, we delete your profile, conversations and memory.

You can see and change most of what we hold without asking anyone: your profile and “What I know” in Settings, and everything Upstream remembers on the Memory page, where any item can be retired.

Access, correction, export and deletion are available on request. Depending on where you live you may also have rights to object to or restrict processing, or to complain to a data protection authority. We do not discriminate against anyone for exercising any of this.

Being straight about a limitation: there is no self-serve delete-my-account button in the product yet. Until there is, deletion is a request we action manually.

• Everything travels over encrypted connections, and is encrypted at rest by Firebase.
• Access is enforced per-account by database security rules, not by the interface hiding things — a request for someone else's conversation is refused at the data layer.
• Duress phrases and trusted contacts get a second, separate layer of encryption.
• No system is perfect, and we would rather say so than imply otherwise. If you find a problem, please tell us.

Upstream is intended for adults. It is not directed at children, and we do not knowingly collect personal information from anyone under 18. If you believe a child has created an account, contact us and we will remove it. See also the eligibility section of the Terms of Service.

If we change it in a way that materially affects how your information is handled, we will say so in the product rather than quietly updating the date at the top. AllDay Solutions LLC is the controller of the information described here.