Who we are

Sarah is a voice assistant made and operated by the UNC Team as part of the UNC ecosystem (“we”, “us”). This policy explains what we collect when you use Sarah, why, and the choices you have.

What we collect

• Account details: your name, email address and a securely hashed password.
• Assistant settings: the name, face and voice you choose.
• Keys and connections: the API keys and account tokens you add on the Connections page (for example Gemini, Fish Audio, Google, Meta, X, TikTok, Stripe). These are encrypted at rest and used only to carry out your own requests.
• Conversations and voice: what you say or type to the assistant, and its replies. Voice is sent as short recordings to be transcribed; we do not keep the audio after transcription.
• Assistant memory and approvals: facts you ask it to remember, actions waiting for your approval, and a log of actions it has carried out.
• Payments: for UNC payments, the plan, amount, transaction hash and paying wallet address, which are public on the blockchain.
• Technical data: basic server logs (such as time, request type and errors) used to keep the service working and secure.

How we use it

To run the assistant for you; to connect to the services you choose; to verify payments and manage your plan; to keep the service secure and fix problems; and to contact you about your account. We do not sell your personal data, and we do not use your connected accounts for anything you did not ask for.

Third-party services you connect

When you use Sarah, your requests are processed by the providers whose keys you add — for example Google (Gemini, Gmail, Calendar, Drive, Search Console, YouTube, Analytics), Fish Audio, Meta, X, TikTok and Stripe. Their own terms and privacy policies apply to what they receive. Because these run on your own keys, your provider account settings (such as whether a provider may use data to improve its models) also apply.

Google user data

If you connect Google, Sarah uses Gmail, Calendar, Drive, Sheets, Search Console, YouTube and Analytics data only to do what you ask — such as summarizing your inbox, reading your schedule or reporting your site's traffic — and to send or create things only after you approve them. We don't sell Google user data, use it for advertising, or let people read it except with your permission, for security, or where the law requires.

Sarah's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Your computer

If you connect a computer through the desktop app, Sarah can perform the actions you ask for there. Actions that close, delete, send or change something wait for your approval. We do not collect the files or browsing history on your computer.

How long we keep data

We keep your account data while your account is active. You can remove any key at any time on the Connections page. If you delete your account, we delete your account data, keys, settings, memory and conversation logs within 30 days, except payment records we must keep for legal or accounting reasons.

Security

Passwords are hashed, keys and tokens are encrypted, sessions use secure cookies, and access is limited to what is needed to run the service. No system is perfectly secure, so please use strong, unique passwords and restricted, read-only keys where providers offer them.

Your rights

Depending on where you live, you may have the right to access, correct, export or delete your data, and to object to or restrict some processing. To make a request, contact us at the contact address on our website.

Children

Sarah is not intended for anyone under 16, and we do not knowingly collect their data.

Changes

We will post any changes to this policy here and update the date above. For significant changes we will let you know by email or in the app.

Contact

Questions about privacy? Contact the UNC Team at the contact address on our website.