Security and privacy

New spaces require team membership. Administering another space doesn't grant access. In the inbox you can keep a contribution just for you or share it with the space. Shared information will also be visible to members added later.

Familia Mateu and Amaterra keep the family portal's permissions; the member list isn't their only access mechanism. Bank transactions and personal inbox conversations belong to their holder. Check the access explanation inside each space.

The app runs on Vercel. Originals uploaded to the inbox and their findings are saved in MongoDB; they aren't published as open links or copied to Drive automatically. Existing Drive files keep a separate copy and permissions there.

Most content is still in a shared database. A new database or a separate folder doesn't establish encryption or isolation by itself. Check Information and privacy inside your space to see its real status. Production uses HTTPS. Access controls are checked on the server, including for file downloads. Bank credentials have specific encryption; this doesn't mean all documents have end-to-end encryption.

People with authorised access to the database, keys or infrastructure can access content. Still to do: publish the list of authorised operators, and verify regions, storage encryption and keys, backups, retention and each provider's contracts.

When you add a document or story to the inbox, the Guide interprets it automatically to extract facts and propose which Path it belongs to. Anthropic receives the original and the allowed context from the same space. Findings are reviewed before being added as facts. «Only me» keeps the original and its findings private. The space's settings control which memory the Guide can use. Earlier blocked sources aren't sent automatically.

Under its commercial policy, Anthropic doesn't use its API inputs and outputs for training by default. Its standard retention policy allows up to 30 days, with exceptions. We haven't established a zero-retention agreement for this app.

Voyage / MongoDB receives text to generate search vectors, not just anonymous numbers. Sending stays blocked until the operator confirms the configured endpoint's policy, the training option and retention. It isn't assumed that the provider has that option turned off.

Resend receives the addresses, the space's name and the link of invitations sent. It also keeps emails sent to enabled addresses; Caminos saves their metadata and copies text or attachments when you open or add them. The space's new emails are shared with all its members; earlier personal emails remain private. Receiving email doesn't authorise AI automatically. When you choose to process an email or attachment, you add it as a source for the Guide to read. The receiving signature vouches for Resend, not for the sender's identity. Dictation may use a browser or device service. The Guide's web searches may pass queries to external services. Don't include unnecessary personal identifiers. These inbox controls don't retroactively change what other features have sent.

Entrenamiento de AnthropicAnthropic retentionVoyage / MongoDB data options

Access requires an email validated by Google and a Caminos authenticator. The second-factor proof is bound to the Google session; codes can't be reused and attempts are limited. Sensitive changes require a recent verification. You can start without personal documents, keep the Guide off, choose «only me» in the inbox and block a source from new AI operations. Hiding figures helps when showing the screen: it doesn't change access permissions.

Removing access doesn't recover downloaded files. Blocking AI doesn't delete content already sent, conversations, backups or data entered separately. Invitations require the person to sign in with the exact email, activate their authenticator and accept access; it isn't granted by creating the link. Verifiable full deletion and export still need work; there's no established backup deletion period.