Bare

Privacy Policy

Intel CFO LLC, d/b/a Bare AI Labs · Effective September 8, 2026 · Published August 10, 2026 · Contact: support@gobare.ai

This policy governs your use of the Service from the date it is published above.

This policy describes how Intel CFO LLC, d/b/a Bare AI Labs (“Bare,” “we,” “us”) handles data when you use the Bare AI assistant at https://www.gobare.ai (the “Service”).

Your conversations live in your browser, not on our servers. When you send a message, we process it to answer you and do not store it. What we do keep is metadata — thread titles, timestamps, counters — and it’s all listed in one table below, with retention times. One temporary beta exception exists (feedback you choose to send us), and it’s disclosed plainly in Section 5. That’s the policy; the rest is detail.

1. What we collect

Thread titles are the one conversation-derived string we store, and they are capped and short. That’s it.

2. What we don’t collect (the longer list)

We never store on our servers:

• your message content — prompts or responses;
• your conversation history or transcripts;
• attachments you upload (documents, images) — processed transiently, not retained;
• voice audio;
• generated media beyond a transient relay (temporary files are deleted within a day, usually within minutes);
• your Google OAuth tokens or any connector credentials — those live in your browser;
• content from your connected Google account (email bodies, calendar events, files) — processed transiently to answer your request, not retained;
• your contacts, address book, or social graph;
• your precise location;
• browsing history outside the Service;
• biometric data;
• raw IP addresses in our application database (see the abuse-signals row above for the narrow exception in short-lived security logs).

This isn’t just a promise — it’s how the system is built. Our database schema has no place to put message content, and automated checks on every deployment verify that no content-bearing fields are added and that logs stay content-free.

3. How your messages are processed

When you send a message, it travels over an encrypted connection to our servers and then to the AI infrastructure that hosts the models we use. Your message is processed in memory to generate the response, which streams back to your browser. We process your messages to answer you; we do not store or log them. Our AI infrastructure provider commits that customer inputs are not retained or used to train models — a commitment we rely on.

Your conversation history — the thing that gives an AI assistant context — is assembled on your device from your local storage and sent with each request, transiently, within size caps. That is how Bare remembers your conversation without our servers keeping it.

4. Deleting your data — Burn Receipt

• Transcripts: they’re on your device, so you delete them directly in the product. When you delete a thread, Bare gives you a Burn Receipt — a cryptographically signed attestation of the deletion that you can verify against our published verification key. Honest framing: the signature proves the authenticity of our attestation; the underlying guarantee is the design described in this policy.
• Server metadata: deleting a thread or your account removes the corresponding metadata (titles, counters, account record) from our systems.
• Anonymous users: if you never signed in, we hold nothing that identifies you. Clear your local data and the relationship ends.

5. Beta feedback — the one exception (temporary)

During the private beta, you can flag a response or send feedback. This is the only way conversation content ever reaches our storage, and it happens only when you explicitly send it.

• You choose to flag; you see a preview of exactly what will be sent (the flagged conversation excerpt, your comment, and an optional screenshot) before pressing Send. Nothing is captured passively.
• It is stored in our cloud (a database table and, for screenshots, a storage bucket) with automatic 30-day deletion.
• It is used solely to diagnose and fix beta issues. It is not used for training, marketing, or anything else.
• Access is restricted: the application can only write feedback, not read it back; reads require operator credentials.
• Because feedback expires on its own 30-day clock, deleting your account does not delete feedback you already chose to send; it is removed when that clock runs out.
• The entire feedback system will be removed at public launch, and this section will be deleted with it.

6. Waitlist and sign-in email

Before public launch, access is gated. Two flows involve your email address:

• Waitlist: we store the email address you submit, a consent timestamp, your waitlist position, and the referral codes you generate or use — so we can reserve your place and email you a one-time access code when a referral succeeds.
• Email sign-in link: we use the address you type to send a single-use sign-in link.

These emails are transactional only, sent through Amazon SES from addresses on gobare.ai. Bounces and spam complaints are processed automatically so suppressed addresses stop receiving mail. We do not buy or rent email lists, and we do not use waitlist or sign-in addresses for marketing newsletters unless you separately opt in. To have your waitlist entry removed, email support@gobare.ai.

7. Optional Google connection

If you connect your Google account (Gmail, Calendar, Drive, Contacts), you grant OAuth-scoped access that Bare uses only to fulfill the requests you make. Your Google tokens are stored in your browser — not on our servers — and travel with each request transiently. Content retrieved from Google is processed in memory to answer you and is not retained. Disconnect anytime in the product or via your Google account’s security settings. Bare’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

8. Analytics (Google Analytics 4)

The Service uses Google Analytics 4 (measurement ID G-S8EQP52FET). The Google tag sends page views, approximate location, and device/browser information to Google and sets Google cookies (_ga, _ga_*). We use this to understand how the product is used.

What GA4 never sees: your conversations. Message content stays in your browser, and our analytics events carry metadata only — never message content, prompts, thread titles, or anything conversation-derived. This is enforced by automated checks on every release.

The Service is operated for users in the United States. Before we accept EU/UK launch traffic, GA4 cookies on our public surfaces will be gated behind a consent flow with matching GA4 admin settings.

9. Cookies

We set no advertising or cross-site tracking cookies.

10. Who processes data besides us (sub-processors)

• Our cloud infrastructure and AI inference provider — hosting (encrypted infrastructure in the US) and AI model inference. The provider commits that model inputs are not retained or used for training.
• Our transactional email provider — delivery of sign-in links and waitlist access codes (Section 6).
• Google Analytics (GA4) — usage analytics as described in Section 8.
• Google APIs (Gmail, Calendar, Drive, Contacts) — only if you connect your Google account, only within scopes you approve, on your instruction.
• A third-party search-index provider — when a chat uses web search, a derived search query (not your identity) is sent transiently to retrieve results.
• A third-party image-model provider — when you ask for image generation or editing, the image prompt is sent transiently.
• A PCI-compliant payment processor — reserved for the planned paid tier; not yet live. When it launches, the processor will handle card data; we will store only customer/subscription identifiers.

A full named sub-processor list is maintained internally and is available to regulators on request. No data brokers. No ad-tech beyond the analytics above. We do not sell your personal information, and we do not use your conversations to train models — we don’t have them.

11. Your privacy rights (including California)

We aim to honor the rights below for everyone, not just where a statute requires it. If you are a California resident, the CCPA/CPRA specifically gives you:

• Right to know/access: what we hold about you is the table in Section 1. On request, we will return your account record and thread metadata — that is all there is.
• Right to delete: one click in the product (Section 4), or email us.
• Right to correct: email us; for most users the only correctable record is the account identifier.
• Right to opt out of sale/sharing: we do not sell personal information. We honor opt-outs of GA4 cookies, including browser-level signals where supported.
• Right to non-discrimination: exercising your rights never degrades your service.

To exercise any right: support@gobare.ai. We will verify requests using the minimal information we hold (which is the point — for anonymous users there is usually nothing to return, and nothing linking data to you). We will respond within the timelines the law requires (generally 45 days under CCPA/CPRA).

We do not use or disclose sensitive personal information for purposes requiring a “Limit the Use” option, and we have no actual knowledge of selling or sharing the personal information of consumers under 16.

12. Children

The Service is not directed at children under 13, and we do not knowingly collect personal information from children under 13 (COPPA). You must be 13 or older to use the Service. Honesty note: we do not verify age — we barely verify anything about you, which is the point — so this is an eligibility rule, not a technical control. If you believe a child under 13 has provided personal information to us, contact support@gobare.ai and we will delete it.

13. Security

• Encryption in transit (TLS) on every external connection and at rest on every data store.
• Least-privilege access: systems get only the permissions they need; the beta feedback store, for example, is write-only for the application.
• No standing human access paths to production servers — administration goes through audited, managed channels only.
• All user traffic enters through a hardened edge (HTTPS only).
• Content-free logging, verified automatically on every release.

No system is perfectly secure, and we don’t claim to be the exception. What we can say honestly: the most sensitive data — your conversations — isn’t on our servers to be breached.

14. Data retention

15. Where data is processed

The Service is operated from the United States, and processing happens on US infrastructure. If you use the Service from outside the US, your requests are processed in the US.

16. Changes to this policy

Material changes will be posted at https://www.gobare.ai with a dated changelog. If a change would meaningfully reduce your privacy protections, we will notify you prominently in the product before it takes effect. We won’t quietly walk back the commitments in Section 2.

17. Contact

Privacy questions, rights requests, anything else: support@gobare.ai