Privacy
How Cleo handles what you tell her. Last updated 10 November 2026.
Draft. Written from how Cleo actually works, not yet reviewed by a lawyer. Items marked [to confirm] are open.
The short version
- Cleo is an AI companion, not a person.
- Your voice is turned into text on Cleo's own server and then discarded. The audio itself is never stored and never sent to anyone else.
- What you say, as text, is kept so she can remember you. To answer you, it goes to the AI model provider (Anthropic).
- Camera frames, if you turn the camera on, go to the model for the moment she looks, and are never saved.
- You can download everything, or delete your account and everything with it, from Settings → Your data, at any time.
- No advertising, no analytics, no tracking, and your data is never sold.
Who is responsible
Cleo is run by [name, address and contact email of the controller]. Questions about your data go to that address.
What is kept, and why
| What | Why |
|---|---|
| Your account | Username, the name you gave, how she refers to you, and either a password (stored only as an Argon2 hash) or the id of the Google or GitHub account you sign in with. To know it is you. |
| Conversations | The text of what you said and what she said, each session. So she can pick up where you left off. |
| Memories | Facts, summaries and a sense of how close you are (with a one-line note of what changed it), which she works out from your conversations. So she remembers you over time. |
| Voiceprints | Only if you record one in Settings → Voices she knows: a numeric signature of a voice, computed from a short sample. The sample's audio is not kept. So she can tell who in the room is talking. This is biometric data; see below. |
| Settings | Your choices in Settings, such as her look. |
| Usage counts | How much of the service each account used (characters, tokens, minutes). To apply limits and pay the providers. |
| Safety count | When a message suggests someone may be in danger, Cleo shows crisis contacts and records the time it did so, with no words. To know whether that safeguard is being reached. |
| Diagnostic logs | Technical logs of the server, which can include short snippets of what was heard. To find and fix faults. [retention period to be set, e.g. 30 days] |
Not kept: recordings of your voice, camera frames, and the video of her face.
Who else handles it
Cleo uses these providers to work. Each receives only what its part needs.
| Provider | What they receive |
|---|---|
| Anthropic | Her brain. The recent conversation as text, the memories that matter for it, and camera frames when the camera is on. Under its commercial terms this is not used to train its models [to confirm in its data processing agreement]. Past a monthly limit, a model on Cleo's own server answers instead and nothing goes to Anthropic. |
| ElevenLabs | Her voice. The text of her replies, to turn into speech. Nothing you said. |
| Anam or Simli | Her live face. Her spoken replies as audio; they send back video of her face. Nothing you said. |
| Google or GitHub | Only if you sign in with them. Cleo receives your account id, email and name; it keeps the id, your name, and a username made from your email. |
| Hosting | [the hosting and backup providers, once Cleo moves off its current server] |
Some of these providers are outside the EU/EEA. Transfers rely on [the EU-US Data Privacy Framework or Standard Contractual Clauses, per provider: to confirm].
Legal basis
- Your account, conversations, memories, settings and usage: to provide the service you signed up for (GDPR Art. 6(1)(b)).
- Voiceprints: your explicit consent (Art. 9(2)(a)), given by recording a sample. Withdraw it by deleting the voice in Settings → Voices she knows.
- Camera: your consent, given by turning it on. Turn it off at any time.
- Diagnostic logs and the safety count: Cleo's legitimate interest in running safely and fixing faults (Art. 6(1)(f)).
How long
Until you delete it. Delete my account erases your account, conversations, memories, voiceprints and settings at once. [Backups: removed within N days, once backups exist.]
Your rights
- A copy of your data: Settings → Your data → Download my data, a machine-readable file of everything kept about your account.
- Erasure: Settings → Your data → Delete my account.
- Correction, restriction or objection: write to the contact above.
- A complaint to your data protection authority, for example the CNPD in Portugal or IMY in Sweden.
Adults only
Cleo is for people aged 18 or older. Accounts are created by invitation and must confirm their age.
Cookies and storage
cleo_session: keeps you signed in. Strictly necessary, HttpOnly, sent only over HTTPS.cleo_oauth: only while signing in with Google or GitHub, for ten minutes, to check the sign-in came from your browser.- Your browser's local storage holds a few display preferences on your own device.
Nothing else: no analytics, advertising or third-party cookies.
Security
Connections are encrypted (HTTPS). Passwords are stored only as Argon2 hashes, invite links only as hashes, and each account's data is kept apart from every other's.
She is an AI
Cleo is a computer program. She is not a therapist or a doctor. If you or someone near you may be in danger, contact local emergency services (112 in the EU).
Changes
If this policy changes in a way that matters, Cleo will say so before it takes effect.