1. Who we are
Buckwheat (“we,” “us,” “our”) is a personal AI companion that knows you, learns from your documents, and works with any AI model you choose. This policy explains what data we collect, why, and what you can do about it.
We believe your data belongs to you. Buckwheat processes your conversations, documents, and interactions to build a personalized model of your preferences, knowledge, and relationships. This model exists solely within your account and is used exclusively to improve your experience. It is never shared with other users or sold to third parties. Your data is never used to train ChatGPT, Claude, Gemini, or Grok. We reach those models only through their business APIs, whose terms do not allow the labs to train on what we send. Buckwheat may use your data to improve Buckwheat’s own models: a model trained on your personal data works only for you, and models that learn across users use only de-identified, aggregated data (see section 3). We do not serve advertising. Our marketing website (buckwheat.ai) uses analytics cookies, described in section 11; the Buckwheat app does not use advertising or analytics cookies.
2. Information we collect
Account information
When you sign in with Google, we receive and store your name, email address, profile photo URL, and locale preference. If you subscribe to a paid plan, we also store your Stripe customer ID and subscription details. We never store credit card numbers; all payment processing is handled by Stripe.
Conversations
Every message you send and every AI response is stored in your account so you can return to past conversations. Conversations are retained until you delete them. There is no automatic expiry.
Documents and knowledge base
When you upload documents, web pages, audio, or video, we store the original content, extract text, and generate vector embeddings for search. Audio files are transcribed using OpenAI or Groq Whisper speech-to-text and the audio bytes are stored for playback. Uploaded documents are retained until you delete them.
Adaptive memory
This is what makes Buckwheat different, and it requires special transparency.
After each conversation, Buckwheat analyses the exchange to extract facts about you: your preferences, the people in your life, significant events, and communication style. These facts are stored in a structured profile and a knowledge graph that connects entities (people, places, organisations) with typed relationships.
This may include sensitive information such as health conditions, relationship status, family structure, dietary preferences, and employment details. We extract this information to provide a personalised experience so Buckwheat can remember that your partner is vegetarian, your daughter starts school in September, or that you’re training for a marathon.
You can view, edit, and delete any extracted memory at any time through the Brain Panel in the app. Memory extraction happens automatically; you do not need to opt in, but you are always in control of what is retained.
Usage data
We track token usage (token counts per model, per day) and text-to-speech character usage for billing and rate-limiting purposes. Our marketing website (buckwheat.ai) uses Vercel Analytics, which counts page views and referrers without cookies, and Google Analytics, which uses cookies to measure visits, pages viewed, and traffic sources. Google Analytics does not load if your browser sends a Global Privacy Control signal. The Buckwheat app does not use Google Analytics. To find and fix problems, the app sends error reports and performance data to Sentry.
Waitlist
When you join the waitlist, we store your email address, your approximate location (country, region, and city, derived from your IP address by our hosting provider), your browser and device type, screen size, language, and the page that referred you. We do not store your IP address. We send a confirmation email through Resend, and we may email you about early access.
Seedlings (chat snapshots)
When you save a conversation as a Seedling, a copy of the messages is stored independently. Deleting the original conversation does not delete the Seedling.
3. How we use your data
- To provide the service:generating AI responses, retrieving your documents, building your memory profile
- To improve Buckwheat’s own models:we may train Buckwheat’s own models on your data so Buckwheat gets better at remembering what matters to you, surfacing the right memories, and learning your habits and patterns. A model trained on your data works only for you and never serves other users. We may also train population-level models on de-identified, aggregated data drawn from many users, so Buckwheat learns patterns that hold across people. That data cannot reasonably be linked back to you, we commit not to re-identify it, and those models never reveal any individual’s data. Data you delete is removed and is not used for future training.
- To improve the service:aggregate, anonymised usage statistics (e.g., which models are most popular) help us make product decisions. We never use individual conversations for this purpose.
- To bill you:token tracking ensures accurate usage-based billing
- To keep the service safe:we may review flagged content to enforce our acceptable use policy
- To communicate with you:transactional emails related to your account (billing confirmations, security alerts) and, if you joined the waitlist, emails about early access
Improving your experience
We may use your feedback (such as thumbs-up/thumbs-down ratings on responses) to improve your Buckwheat experience. For example, by refining how prompts are constructed for you, adjusting response style to your preferences, or tuning which information is prioritised in your context. This is per-user optimisation. Your feedback is never shared with external AI model providers, and it is combined across users only in de-identified, aggregated form.
What we never do
- Let OpenAI (ChatGPT), Anthropic (Claude), Google (Gemini), or xAI (Grok) train their models on your data
- Sell or license your data to AI companies or anyone else
- Use your personal data to serve, inform, or benefit any other user (de-identified, aggregated data is described in section 3)
- Sell or share your data with advertisers
- Serve advertising of any kind
- Use the content of your conversations, documents, or memories for advertising or marketing
- Allow any other user to access your data
4. AI model providers
Buckwheat routes your conversations to the AI model you choose. Your choice of model determines which company processes your data. When you send a message, the following is transmitted to the selected provider:
- Your conversation history (recent messages in the thread)
- Relevant excerpts from your knowledge base
- Your memory context (profile facts, entities, significant events) embedded in the system prompt
The AI model providers we integrate with are:
| Provider | Models | Data sent |
|---|---|---|
| OpenAI | GPT-5.2, GPT-5.4, GPT-5.4-nano, GPT-5.4-pro | Conversation + memory context |
| Anthropic | Claude Sonnet 4.6, Opus 4.6, Haiku 4.5 | Conversation + memory context |
| Gemini 3 Flash, Gemini 3 Pro, Gemini 3.1 Pro | Conversation + memory context | |
| xAI | Grok 4.1 | Conversation + memory context |
| Groq | Llama, Qwen, GPT-OSS | Conversation + memory context; audio (Whisper STT, Orpheus TTS) |
| Together.ai | Kimi K2.5, MiniMax M2.7, DeepSeek | Conversation + memory context |
| Fireworks.ai | Kimi K2.5, DeepSeek | Conversation + memory context |
| OpenRouter | Various | Conversation + memory context |
| Perplexity | Sonar, Sonar Pro | Your query (for web search) |
We use each provider through its business API. OpenAI, Anthropic, Google, and xAI do not train their models on API data under the terms we use. Each provider’s API terms and privacy policy govern how it handles the data it receives. We encourage you to review their policies.
Important: Your extracted memory (including sensitive personal information like health conditions or relationship details) is included in the system prompt sent to the model provider. If you are uncomfortable with a particular provider receiving this information, choose a different model.
5. Third-party data processors
Beyond AI model providers, we use the following services to operate Buckwheat:
| Service | Purpose | Data processed |
|---|---|---|
| MongoDB Atlas | Primary database | All application data (encrypted at rest) |
| Neo4j | Knowledge graph | Entities and relationships extracted from your conversations |
| Google OAuth | Authentication | Email, name, profile photo |
| Stripe | Payments | Email, name, payment amounts |
| Voyage AI | Vector embeddings | Document text chunks |
| Groq | Text-to-speech (Orpheus) and speech-to-text (Whisper) | AI-generated response text; user audio |
| Upstash | Redis cache & task queue | Cached content, temporary task data |
| Render | Hosting | Application runtime, logs |
| Meta (WhatsApp) | Messaging channel | Message content, phone number |
| Telegram | Messaging channel | Message content, chat ID |
| Jina AI | Web page extraction | URLs you add to your knowledge base |
| Cloudflare | App hosting, DNS, and security | Network traffic, including IP addresses |
| Amazon Web Services (S3) | File storage | Uploaded files and audio |
| Sentry | Error monitoring | Error reports and technical data from the app |
| Resend | Email delivery | Email address and email content |
| Vercel | Marketing website hosting and analytics | Page views, referrers, waitlist sign-ups |
| Google Analytics | Marketing website analytics | Cookie identifiers, pages viewed, device type, approximate location |
6. Smart home integrations
If you connect smart home devices through Buckwheat, your commands are routed through the relevant cloud service (Google Home API or TP-Link Cloud). These providers receive your device commands and timestamps.
If you use camera snapshot analysis, a single frame from your camera is sent to Google Gemini or OpenAI for visual analysis. Snapshots are not stored. They are processed in memory and discarded after the response is generated.
7. Voice messages
When you send a voice message through WhatsApp or the web app, the audio is transmitted to Groq’s Whisper API for transcription. The transcribed text is then processed like any other message. For voice messages via WhatsApp, the audio passes through three parties: Meta (delivery), Buckwheat (routing), and Groq (transcription).
8. Data retention
| Data type | Retention |
|---|---|
| Conversations | Until you delete them |
| Documents & knowledge base | Until you delete them |
| Memories & knowledge graph | Until you delete them |
| Account information | Until you delete your account |
| Billing records | As required by law (typically 7 years for financial records) |
| Cached data (Redis) | Temporary; automatically purged by TTL |
| Task queue payloads | Seconds to minutes; purged on task completion |
When you delete a conversation, it is removed from your chat history immediately and purged from our database within 30 days. Memories that were extracted from that conversation are not automatically deleted. You can review and remove them individually through the Brain Panel.
9. Your rights
Regardless of where you live, we provide the following rights to all users:
- Access:View all data Buckwheat holds about you, including your memory profile, knowledge graph, and conversation history, directly in the app
- Correction:Edit or correct any memory, profile fact, or entity through the Brain Panel
- Deletion:Delete individual conversations, documents, memories, and knowledge graph entities at any time
- Export:Export individual conversations and bulk account data
- Objection:Contact us to object to any specific data processing
Where Buckwheat is available
Buckwheat is not currently offered to people located in the European Economic Area, the United Kingdom, or Switzerland. If we learn that a user or waitlist member is located in one of those places, we close the account or remove the waitlist entry and delete the associated data within 30 days.
CCPA (California)
If you are a California resident, you have rights under the California Consumer Privacy Act, including the right to know what personal information we collect, the right to delete it, the right to correct inaccurate information, and the right to opt out of the sale or sharing of personal information.
We do not sell your personal information. We do not share your personal information for cross-context behavioural advertising. We do not use sensitive personal information to infer characteristics about you for advertising purposes.
Account deletion
You can delete your entire account and all associated data from within the app. Account deletion includes a 30-day grace period during which you can restore your account. After 30 days, all data is permanently and irreversibly purged. You can also contact us at privacy@buckwheat.ai to request account deletion.
10. Data security
- All data is encrypted at rest (AES-256 via MongoDB Atlas) and in transit (TLS 1.2+)
- Per-user data isolation: every database query is scoped to your user ID
- Authentication via Google OAuth with JWT tokens
- Security-audited codebase (January 2026) with all critical vulnerabilities resolved
- No cross-user data access: verified and tested
- Separate database environments for development, staging, and production
12. Children’s privacy
Buckwheat is not intended for users under 18. We do not knowingly collect personal information from anyone under 18. If you believe a minor is using Buckwheat, please contact us at privacy@buckwheat.ai and we will delete their data.
13. International data transfers
Your data is processed in the United States (our hosting infrastructure is on Render.com in the US). If you use Buckwheat from outside the United States, your data is transferred to and processed in the United States.
14. Changes to this policy
We will update this policy as our practices evolve. Material changes will be communicated via email to your registered address. The “Last updated” date at the top of this page reflects the most recent revision.
15. Contact us
For privacy questions, data requests, or to exercise any of your rights: