Privacy policy
Effective Date: October 8, 2026
Joshu ("us", "we", or "our") is operated by Project Aeon Inc. This Privacy Policy explains what information we collect when you use our website joshu.me (the "Site"), your account at hello.joshu.me, and the hosted Joshu assistant (together, the "Services"), how we use it, how long we keep it, and what choices you have.
The Services are not offered to individuals located in the European Union or to European Union citizens. We do not knowingly provide accounts or paid Services to such persons. If you believe we have collected personal information from someone who is ineligible, contact us using the information below and we will delete it.
Self-hosting: the most private option
The software that runs each Joshu box is open source under the AGPL license (github.com/db-aeon/joshu-oss). If you run it yourself, on your own computer or server, your data stays on infrastructure that you control, and you choose your own model and tool providers with your own keys. A self-hosted installation does not send data to us, and this Privacy Policy does not apply to it.
The rest of this Privacy Policy describes the hosted Services that we run for you.
1. Information We Collect
Account information
When you sign up, buy a plan, join the SMS program, or contact us, we collect your name, email address, phone number, billing address, and other information you give us. Payments are processed by Stripe. We do not store your full card number.
Content
Each owner gets their own Joshu box: a private cloud computer that runs your assistant. "Content" means everything in your box or passing through it, including:
- what you send to the assistant, by chat, email, text message, or phone call ("Input");
- what the assistant produces, such as replies, documents, and actions ("Output");
- files, notes, and the assistant's memory stored in your box;
- data from accounts that you connect, such as your email, calendar, or business tools ("Connected Account Data").
Phone calls and voice messages are converted to text so that the assistant can act on them.
Usage data and cookies
The Site and the account portal at hello.joshu.me use cookies and analytics tools (Google Analytics and Hotjar) to understand how visitors use them. These tools do not run inside your box and do not receive Content. You can set your browser to refuse cookies. Some parts of the Site may then not work correctly.
2. How We Use Your Information
We use your information to:
- provide, maintain, and support the Services;
- determine eligibility and enforce geographic restrictions (for example, from IP address or billing address);
- process payments;
- communicate with you, including account notices and responses to your questions;
- send product updates and newsletters where the law permits (you can opt out at any time);
- understand how the Site and Services are used, with aggregated or de-identified data where practicable;
- detect, prevent, and fix technical issues, abuse, and security problems;
- evaluate and improve the quality and reliability of the Services, as described in section 3;
- comply with legal obligations and protect our rights.
3. Content and AI
No training on your Content
We do not use Content to train AI models, our own or anyone else's.
AI model providers
To answer you, the assistant sends parts of your Content to AI model providers. These providers process Content only to generate a response for you. We route model requests only to providers that do not use the requests they receive to train their models. Providers may keep requests for a short time for abuse and security monitoring under their own terms. The list of our providers is on our subprocessors page.
Quality review
The Services keep traces: records of the steps the assistant takes, which can include Content. We use traces to find and fix failures and to improve quality. Traces are deleted automatically after 30 days. Within that period, a small number of authorized staff or contractors may review selected traces when they need to for safety, support, or quality. Access is limited by role and bound by confidentiality obligations, and we review the minimum Content needed.
If our practices change
If we ever want to use Content in a new way, such as for training, we will update this Privacy Policy and give you notice before the change applies to your Content.
4. How Long We Keep Information
While your account is active, Content stays in your box until you or your assistant deletes it. You can delete files and memory at any time, and you can export your Content at any time, including as a Portable Soul bundle.
Traces are deleted automatically after 30 days.
When you cancel, we immediately:
- destroy your box, including its server and disks, and everything stored on it;
- delete your account and sign-in;
- delete your Content at our service providers, including your box's mailbox, phone number and its message and call logs, connected accounts, and traces.
We keep only the billing and tax records that the law requires us to keep. Deleted Content cannot be recovered, so export anything you want to keep before you cancel.
If we close your account under our Terms, we delete your information in the same way, except where the law requires us to keep it.
5. Information Sharing and Disclosure
We share information only in these cases:
- Service providers. Companies that host the Services, process payments, deliver email and phone service, connect your accounts, run AI models, and help us monitor quality. They may use your information only to provide their service to us. Our subprocessors page names each provider and what it receives.
- At your direction. For example, when your assistant sends an email or message for you, or when you connect an account.
- Legal requirements. When required by law or valid legal process, such as a court order or subpoena.
- Business transfers. In connection with a merger, acquisition, or sale of assets. This Privacy Policy will continue to apply to your information.
We do not sell your information or Content, and we do not share Content with anyone for advertising or marketing.
SMS and mobile information
If you opt in to SMS or MMS with Joshu (for example, two-way texting with your box phone number, or transactional notifications), we use your mobile number only to provide that messaging. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Message frequency varies. Message and data rates may apply. Reply STOP to opt out and HELP for help. Carriers are not liable for delayed or undelivered messages.
Program details and opt-in: joshu.me/sms · signup form: joshu.me/sms-signup.
6. Where Information Is Stored
Your box and our account systems are hosted in the United States. Some service providers, such as AI model providers, may process Content in other countries to answer your requests.
7. Data Security
Each box is a separate computer, so your Content is not stored together with other owners' Content. We use physical, technical, and administrative safeguards to protect your information. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. To report a security issue, email [email protected] with "Security" in the subject line.
8. Your Choices and Rights
- Access and correction. You can ask for a copy of the personal information we hold about you, and ask us to correct it.
- Export. You can export your Content from your box at any time.
- Deletion. You can delete Content in your box at any time. You can cancel your account to delete everything, as described in section 4, or ask us to delete specific personal information.
- Connected accounts. You can disconnect an account at any time, from your box or from the provider.
- Marketing email. You can opt out using the link in any marketing email.
- Do Not Track. The Site does not respond to "Do Not Track" signals.
To use these rights, contact us using the information below.
9. Children's Privacy
The Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has given us personal information, contact us and we will delete it.
10. Changes to this Privacy Policy
We may update this Privacy Policy to reflect changes in our practices or in the law. We will post the updated policy on the Site and update the effective date. If a change materially expands how we use Content, we will give you advance notice before it applies to your Content.
11. Contact Us
If you have questions or complaints about this Privacy Policy or our data practices, contact us:
- By email: [email protected]
- By mail: Project Aeon Inc., Corporate Pointe, Ste. 400, Culver City, CA 90230, United States