Privacy Policy
Last updated: September 20, 2026
Our Privacy Promise
SOL is built on trust. Your dreams, journals, and conversations are deeply personal. We believe this data belongs to you, not to advertisers, not to researchers, and never to the highest bidder. We do not scan or mine your private conversations for research. Content reaches SOL Research only when you deliberately submit it yourself.
- ✓Your data stays yours—private by default
- ✓No selling data to third parties, ever
- ✓No advertising incentives—SOL does not run advertising or sponsored answers, so it has no ad-driven reason to profile you
- ✓Delete your account and personal product content from account settings
What We Collect
Account Information
Email address and display name for authentication and personalization. We use Supabase Auth for secure, industry-standard authentication.
Your Content
Dreams, journal entries, memories, and chat message bodies you choose to create are encrypted on your device before storage. Original chat attachments are not covered by this stored-record promise yet.
Usage Analytics
SOL sends anonymous page-view, device, location, and performance measurements to Vercel Web Analytics and Speed Insights. These tools do not use third-party cookies or tie the measurements to an identifiable visitor. SOL's custom events contain only coarse action and result labels, never email addresses or private content. They are not loaded in the signed-in member app, and SOL does not use advertising cookies or sell analytics data.
How Your Data is Protected
Encryption
Protected record fields use client-side AES-256-GCM encryption before storage, plus TLS while data travels over the network.
Row-Level Security
Supabase PostgreSQL row-level security helps prevent one member's account from reading another member's records.
Client-Side Processing
Your device holds the encryption key. A Recovery Code helps you restore access on a new device.
Data Retention
You can export your content or delete your account from account settings. Limited legal, security, consent, transaction, or already-published non-personal research records may be retained when required and will not be presented as active personal content.
A Future Research Goal
SOL's long-term goal is to direct 80% of net profits to external research without using your private content. We will review that goal only after one full profitable year and before any support begins. Institutions such as UVA and IONS are examples of possible future recipients, not current recipients.
- •We do not scan or mine private conversations, dreams, journals, or memories for internal research
- •Protected personal content is encrypted at rest; selected material becomes readable to a named processor only when you ask SOL to use a feature that needs it
- •No institution is a current recipient under this future goal
- •Any future recipient will need to demonstrate rigorous methodology; we do not mine your private content for internal research
Your Rights
Access
View all your data anytime through your dashboard
Export
Download all your data in standard formats
Delete
Remove your account and personal product content; limited required records and non-personal published research may be retained
You Decide What Is Shared
Nothing you write is used for research unless you deliberately submit it
AI Processing & Third Parties
Encryption protects what SOL stores. SOL uses outside services for AI, voice, search, and related features. Anthropic produces Experience (Nebula) Chat answers by default and Investigate (Prism) Chat answers, plus shared Chat planning. A documented rollback setting can deliberately move Experience answers to OpenAI or xAI. When you ask SOL to use an AI feature:
- •Your device decrypts only the selected material needed for the request. Readable input and relevant context then pass through SOL to the named service that performs that feature. SOL does not automatically send a failed final-answer request to another provider
- •Anthropic states that commercial API inputs and outputs are not used to train its models by default, unless the customer opts in or submits material through a feedback channel
- •Under Anthropic's standard commercial API policy, inputs and outputs are deleted from its backend within 30 days, subject to feature-specific terms, usage-policy or safety enforcement, legal holds, and any different agreement. SOL does not claim an organization-specific zero-data-retention arrangement
- •OpenAI states that API data is not used to train its models by default unless a customer opts in. Default abuse-monitoring logs may retain inputs and outputs for up to 30 days, subject to legal exceptions. If Experience Chat is deliberately rolled back to OpenAI, SOL disables Responses application-state storage for those requests, but does not claim an organization-specific OpenAI zero-data-retention control
- •In the standard chat path, user and assistant message bodies are encrypted on your device before database storage
Other third parties we use:
- •Supabase — Database and authentication
- •Vercel — Hosting, deployment, and content-free public-page analytics and performance measurements
- •Anthropic — Experience (Nebula) Chat answers by default, Investigate (Prism) Chat answers, shared Chat planning, and interpretation or summarization paths that SOL has enabled
- •OpenAI — Public or institutional research embeddings and query rewriting, plus the final transcription of an optional recorded dictation clip; SOL's voice logs keep only content-free operating details
- •xAI — Not selected by default; available only if SOL deliberately enables the documented Experience rollback setting, never as an automatic fallback
- •ElevenLabs — Optional read-aloud playback; receives the completed Chat response text and selected voice setting when you choose read aloud. The separate real-time voice conversation feature is disabled for paid launch; if enabled in a future release, ElevenLabs would receive microphone speech, conversation messages, and session context to transcribe, conduct, and speak in that conversation
- •Deepgram — Optional live dictation; microphone audio streams directly from your browser for interim words while you speak. The final recorded clip is transcribed by OpenAI instead
- •Tavily — Inactive for launch; the application blocks external search even if a key remains configured
- •Public websites — Reading the text of an exact public page URL you explicitly select; the site receives a normal web request, not your Chat text or private context
- •jsDelivr and Hugging Face — Browser downloads for the software and model files used by the on-device embedding tool; the embedding text is processed locally
- •HTML artifacts are static and offline — Before preview, HTML download, or PDF preparation, SOL removes scripts, forms, external links, and remote resources and applies a browser policy that blocks scripts and outside connections
- •Sentry — Crash and error reporting (with personal information scrubbed before transmission)
See exactly which services are involved and what each may receive on How AI processing works.
Contact Us
Questions about your privacy? We're here to help.
Email us at: stephen@shimmersoflight.com
This policy may be updated periodically. We'll notify you of significant changes via email.