Privacy Policy — As You Wish

Summary

We collect only what we need to run AsUWish. We don't sell your data. We don't show you ads. Your social media tokens are encrypted at rest. You can delete everything at any time.

1. Who We Are

As You Wish AI LLC (“AsUWish,” “we,” “us”) is a Washington State limited liability company that operates the AsUWish AI assistant platform at asuwish.ai.

As You Wish AI LLC is the data controller for the personal data described in this policy: we decide what is collected and why. Our postal address is 2226 Eastlake Ave E #1308, Seattle, WA 98102.

2. What We Collect

Data	Why
Email address	Account creation and login (via AWS Cognito)
Display name	Shown in the UI so you know who's logged in
Social media OAuth tokens	To act on your behalf on connected platforms (Twitter/X, Discord, Bluesky, etc.)
Conversation history	So your Jeannie can maintain context across chats
Memories	Facts your Jeannie learns about you to provide better assistance
Content you create	Posts, drafts, and messages composed through the platform
IP address (optional)	Stored with your chat messages only if you turn on “Share my IP address” in Settings, and you can turn it off at any time. We also use a one-way hash of your IP address, kept for about an hour, to limit abusive request rates. That happens whether or not IP sharing is on; the hash cannot be turned back into your address.
Location (optional)	If you set a home location for weather and local recommendations
AI call prompts and responses	The text sent to and returned from the AI models behind your Jeannie, kept for up to 30 days so we can debug problems, measure what a request costs, and improve our own models

2b. Why We Are Allowed to Use It

Purpose	Legal basis
Running your account: login, your Jeannies, conversations, memories and the content you ask for	Contract — we cannot provide the service without it
Acting on the social, mail and calendar accounts you connect	Contract — it is the work you asked us to do
Billing, through Paddle as Merchant of Record, and the emails about your account	Contract
Keeping AI call prompts and responses for 30 days to debug problems, measure cost and improve our models	Legitimate interest — running a reliable service that we can afford to run
A one-way hash of your IP address to limit abusive request rates	Legitimate interest — keeping the service safe for everyone
Storing your IP address with chat messages, and a home location	Consent — both are off unless you turn them on in Settings

Where we rely on consent, you can withdraw it at any time by turning the setting off. Where we rely on legitimate interest, you can object by emailing privacy@asuwish.ai, and we will stop unless we have a stronger reason we can explain to you.

3. What We Don't Collect

We don't track you across websites
We don't use analytics trackers or advertising pixels
We don't collect browser fingerprints
We don't read your social media DMs unless you explicitly ask your Jeannie to process them

4. How We Store Your Data

Social media tokens are encrypted at rest using AES-256 before storage. The encryption key is managed via AWS KMS. We never store tokens in plaintext.
Passwords are managed by AWS Cognito and never stored by us directly. Cognito uses bcrypt hashing.
Databases are hosted on Railway with SSL-encrypted connections and automated daily backups.
Data is shardedacross multiple databases using a hash ring. Each user's data lives on a specific shard, isolated via PostgreSQL Row Level Security (RLS) policies.

5. Third-Party Processors

These are the companies your data can reach, what each one is for, and what it receives. Most rows name a single company. Two rows are categories — the open weather, reference and picture-search services — because we call dozens of them and a row each would be unreadable and out of date within a week. For those two we name the category and what we send; the full host list is in asuwish_ui/src/legal/sub_processors.json in our public repository.

Service	What For	What It Receives
Anthropic (Claude)United States	AI processing — your messages are sent to Claude to generate responses, compose content, and extract memories	Messages you send and the conversation context around them Memories your Jeannie has stored about you Content you ask a Jeannie to write
AWS (Cognito, S3, KMS, SQS, SES)United States (us-east-1)	Login, file storage, encryption keys, background job queues, and the email we send you	Email address and password (Cognito holds the password; we never see it) Files, images, video and audio you upload The text of emails we send you, such as a verification link
RailwayUnited States	Application and database hosting — everything we store lives here	Everything stored in your account
VercelUnited States	Web UI hosting, and — if you connect one — your Vercel workspace	Requests for the pages of this site Project and deployment data from a Vercel workspace you connect
Paddle	Merchant of Record for all our orders — Paddle sells the subscription and token packs, takes the payment, handles sales tax and invoicing, and pays out refunds	Name and email address Billing address and the country we charge tax in Payment metadata (Paddle handles the card; we never see the number)
Hedra	Lipsync video, spoken audio, and some image generation	Photographs and images you upload Audio you upload or that we generate for you The text you want spoken and the prompt you write
ElevenLabs	Voice search, speech-to-text, and cleaning up noisy audio	Voice recordings and other audio you upload Audio taken from video you make here The transcript that comes back
NylasUnited States	Reading and sending mail, calendar and contacts for the accounts you connect	Email messages, subjects and addresses Calendar events and free/busy times Contacts
Zernio	Posting to and reading from the social accounts you connect	Posts and drafts your Jeannie writes Mentions, replies and direct messages it is asked to handle Account identifiers and the access tokens for those accounts
OpenAI	Image generation, and an alternative language model when one is selected	Prompts you write Images you upload for editing Messages sent to a model you chose
Google (Gemini)	Image generation	Prompts you write Images you upload for editing
Stability AI	Image generation and editing	Prompts you write Images you upload for editing
Replicate	Hosted image models, including click-to-select masking	Prompts you write Images you upload for editing
Ideogram	Image generation where the image contains text	Prompts you write Images you upload for editing
Tavily	Web search, and reading a page you ask about	The search query, which is derived from what you asked The address of a page you ask us to read
Temporal Cloud	Running long jobs reliably — a wish that takes minutes is checkpointed here so a restart does not lose it	Workflow payloads, which can include the text of the wish and its result
DeepL	Translation	The text you asked to have translated
Wolfram\|Alpha	Computation and factual lookups	The question, as a query
HERE	Turning place names into coordinates, finding nearby places, and travel times	Place names and addresses you mention Your home location, if you set one Start and end points of a route you ask about
Discord	Reading and sending messages in Discord servers you connect	Messages your Jeannie sends or is asked to read Channel, server and user identifiers
Notion	Reading and writing pages in the Notion workspace you connect	Page and database content your Jeannie reads or writes Your Notion access token
GitHub	Reading and writing the repositories you connect, and downloading open reference data	Repository content your Jeannie reads or writes Your GitHub access token
Meta (Facebook and Instagram)	Posting to and reading from a Facebook or Instagram account you connect	Posts, captions and media your Jeannie publishes Comments and mentions it is asked to handle Account identifiers and access tokens
Other social platforms you connect (X, Bluesky, LinkedIn, TikTok, Threads)	Posting to and reading from any other social account you connect. Which of these receive anything is entirely up to which accounts you link.	Posts, drafts and media your Jeannie publishes Mentions, replies and direct messages it is asked to handle Account identifiers and access tokens
Public data and reference APIs (category)	Answering factual questions — weather, air quality, tides, earthquakes, space weather, satellites, currency and stock prices, dictionaries, Wikipedia and Wikidata, books, and web archives. These are open endpoints; we send the question, not your identity.	The query, which is derived from what you asked A place or coordinates, when the question is about a place
Image and media search providers (category)	Finding existing pictures — museum, library and stock-photo collections. We send the search terms, not your identity.	The search terms, which are derived from what you asked

A company only receives anything if you use the part of AsUWish that talks to it. Connect no social accounts and no social platform hears from us; never generate an image and no image provider does either.

We do not sell, rent, or share your personal data with any third party for marketing or advertising purposes.

6. Your Rights

You can, at any time:

Access your data — everything is visible in the UI (memories, conversations, social accounts)
Edit your data — update memories, change your profile, modify Jeannie settings
Delete your data — delete individual memories, conversations, or your entire account
Disconnect social accounts — unlink any platform from the Channels tab
Export your data — contact us and we will provide a full export (automated export coming soon)

For GDPR (EU) and CCPA (California) purposes: we are the data controller. You have the right to request deletion of all your data by emailing privacy@asuwish.ai or by deleting your account in Settings.

7. Data Retention

Active account data is retained as long as your account exists
Deleted data is removed from live databases immediately
Encrypted database backups may retain deleted data for up to 30 days
AI call prompts and responses are kept for 30 days, then the text is erased automatically. The cost and timing records stay so our spending history remains accurate. Deleting your account erases that text for your account straight away.
AI provider logs (Anthropic) are subject to Anthropic's data retention policy

8. Cookies

We use only essential cookies for authentication (JWT access tokens stored in browser local storage). We do not use tracking cookies, analytics cookies, or third-party cookies.

9. Children

AsUWish is not intended for users under 18. We do not knowingly collect data from minors. If you believe a minor has created an account, contact us and we will delete it.

10. Changes to This Policy

We may update this policy as we add features and platforms. Material changes will be communicated via email or in-app notification. The “last updated” date at the top reflects the most recent revision.

11. Contact

Privacy questions or data requests: privacy@asuwish.ai

General inquiries: hello@asuwish.ai

As You Wish AI LLC · 2226 Eastlake Ave E #1308, Seattle, WA 98102· asuwish.ai