Privacy Policy

What stays on your device

• Connection settings — the address of your backend and a device token are stored on your device (the iOS Keychain / app preferences) so the app can reconnect. The connection token is sent only to the backend it authenticates, including LISA Cloud when you choose cloud mode.
• Your conversations and Lisa’s memory (“soul”) live on the backend you connect to — your own Mac (under ~/.lisa) or a Lisa Cloud instance you use. The app is a window onto that backend.

Your backend & LLM providers

LISA Cloud sends your message, relevant conversation history, assistant memory, and tool results to Google Gemini to generate your response. This can include personal information you put in those materials. We use Gemini API through a Google Cloud project with active billing. Under Google'spaid-service terms, prompts and responses are not used to improve Google's products. Google may retain them for a limited period for abuse prevention, security, or legal requirements, and may process them in countries where Google or its agents have facilities.

Third parties we engage to process personal data must provide the same or equal protection as this policy, including limited-purpose processing, confidentiality, security, and applicable deletion obligations. Google'sData Processing Addendumapplies to paid Gemini prompts and responses. Service and billing metadata are also processed under Google's applicable privacy and data-protection terms.

With your own Mac, you choose the server and AI provider (for example Anthropic, OpenAI, Google, or Zhipu/GLM); review that provider's terms and settings before use. Those independently configured services are not operated by us. A local model can keep inference on your Mac; connecting a Mac alone does not keep remote inference on your device.

Web search and page requests

Web tools are currently disabled on LISA Cloud. When using web tools on your own Mac, search text derived from your request is sent to DuckDuckGo, and a page request sends its URL to the destination website. URLs and search text may contain personal information from your request. These services see the backend's IP address and apply their own privacy and retention policies. Account tokens are not attached to these requests. Results may be included in the context sent to your selected AI provider. If hosted web tools are enabled in a future update, Lisa Pocket will name the additional recipients and ask for permission again before sending.

Consent and withdrawal in Lisa Pocket

Before sending a chat message, the iOS app identifies the configured AI recipients, explains the data involved, and asks for your explicit permission. Cancel leaves the draft unsent. Consent is limited to the current app session and connection; a changed recipient requires permission again. In Settings → AI data sharing → Withdraw AI consent, you can stop an active chat request and require fresh permission before future messages from this app. Withdrawal cannot recall information already processed and does not erase your history. It does not disable independent automations on your Mac; stop those on your own server. Use account deletion below, or contact us privately, to request deletion.

LISA Cloud accounts (optional)

• What we store — your email address, a sign-in identifier (Apple/Google sub or a password hash — never the password itself), and your Lisa's per-account home: her soul, your conversations, and anything you add to her knowledge base. We also encrypt and store the Apple authorization token when supplied, so we can revoke that authorization when you delete your account. Stored on Google Cloud (us-central1), isolated per account.
• What we process — chat messages pass through the account's metered LLM provider to answer you; token counts are metered for billing. We keep an append-only usage ledger (model, token counts, cost) — not message content.
• Service providers — Google Cloud (hosting and storage), Google Gemini (AI inference), Resend (verification & sign-in code emails), Stripe (web top-ups), Apple (Sign in with Apple, iOS purchases), Google (Sign in with Google), Cloudflare (bot-check on signup). These services receive only the data needed for their function, such as an email address for a sign-in email, an account identifier for authentication, or transaction identifiers and purchase receipts for credits. We do not receive your full payment card details from Apple or Stripe.
• Operational data — service logs can include request IP addresses, times, routes, response status, errors, and account or transaction identifiers. We use these to operate the service, prevent abuse, and diagnose failures, not for advertising or cross-app tracking. We retain account data until you delete it; operational, payment, and provider records are kept as needed for security, accounting, dispute handling, and legal obligations.
• Deletion — "Delete account" in the app removes the account record and wipes the per-account home entirely; every session is invalidated at that instant. Payment transaction records used for deduplication and refunds are separate from conversation storage. For Apple sign-ins with a saved authorization token, deletion also revokes that authorization. For an earlier sign-in without a saved token, we delete the Lisa data and show Apple's instructions for removing the remaining Apple connection. Provider-side records and infrastructure backups follow their respective retention policies; contact us for a data request.
• The App Review demonstration account is shared with reviewers. Do not place personal information in that account. Ordinary cloud accounts have separate assistant data.

Notifications

If you enable push notifications, a push token (Apple APNs, or an ntfy topic you choose) is used only to deliver the alerts you opt into, routed through the backend you paired with. It is not used for tracking.

Age requirement

LISA is intended for adults aged 18 or older. Lisa Pocket requires confirmation before enabling AI chat. Do not use the service if you are under 18. If we learn that we hold a minor's personal data, we will take steps to delete it; please contact us privately using the email below.

Changes

We may update this policy as the apps evolve; material changes will be noted here with a new date. The source is public:github.com/oratis/LISA.

Contact

Questions about privacy? Open an issue atgithub.com/oratis/LISA/issuesor email wangharp@gmail.com.