1. Who we are
Buckwheat (“we,” “us,” “our”) is a personal AI companion that remembers who you are, learns from your documents, and works with any AI model you choose. This policy explains what data we collect, why, and what you can do about it.
We believe your data belongs to you. Buckwheat is not an AI model provider — we do not build, train, or fine-tune AI models, and your data is never used for that purpose. We do not serve advertising. We do not use cookies or behavioural tracking.
2. Information we collect
Account information
When you sign in with Google, we receive and store your name, email address, profile photo URL, and locale preference. If you subscribe to a paid plan, we also store your Stripe customer ID and subscription details. We never store credit card numbers — all payment processing is handled by Stripe.
Conversations
Every message you send and every AI response is stored in your account so you can return to past conversations. Conversations are retained until you delete them. There is no automatic expiry.
Documents and knowledge base
When you upload documents, web pages, audio, or video, we store the original content, extract text, and generate vector embeddings for search. Audio files are transcribed using OpenAI’s Whisper API and the audio bytes are stored for playback. Uploaded documents are retained until you delete them.
Adaptive memory
This is what makes Buckwheat different — and it requires special transparency.
After each conversation, Buckwheat analyses the exchange to extract facts about you: your preferences, the people in your life, significant events, and communication style. These facts are stored in a structured profile and a knowledge graph that connects entities (people, places, organisations) with typed relationships.
This may include sensitive information such as health conditions, relationship status, family structure, dietary preferences, and employment details. We extract this information to provide a personalised experience — so Buckwheat can remember that your partner is vegetarian, your daughter starts school in September, or that you’re training for a marathon.
You can view, edit, and delete any extracted memory at any time through the Brain Panel in the app. Memory extraction happens automatically; you do not need to opt in, but you are always in control of what is retained.
Usage data
We track credit consumption (token counts per model, per day) and text-to-speech character usage for billing and rate-limiting purposes. Our marketing website uses Vercel Analytics, a cookieless, privacy-friendly analytics service that collects aggregate page view counts and referrer data. No cookies are set, no personal data is collected, and no individual user behaviour is tracked. We do not use Google Analytics, Mixpanel, Segment, or any behavioural tracking service.
Seedlings (chat snapshots)
When you save a conversation as a Seedling, a copy of the messages is stored independently. Deleting the original conversation does not delete the Seedling.
3. How we use your data
- To provide the service — generating AI responses, retrieving your documents, building your memory profile
- To improve the service — aggregate, anonymised usage statistics (e.g., which models are most popular) help us make product decisions. We never use individual conversations for this purpose.
- To bill you — credit tracking ensures accurate usage-based billing
- To keep the service safe — we may review flagged content to enforce our acceptable use policy
- To communicate with you — transactional emails related to your account (billing confirmations, security alerts)
Improving your experience
We may use your feedback (such as thumbs-up/thumbs-down ratings on responses) to improve your Buckwheat experience — for example, by refining how prompts are constructed for you, adjusting response style to your preferences, or tuning which information is prioritised in your context. This is per-user optimisation, not model training. Your feedback is never aggregated across users to train or fine-tune any AI model.
What we never do
- Train or fine-tune AI models on your conversations, documents, or memory data
- Use your data to train any shared model that serves other users
- Sell or share your data with advertisers
- Serve advertising of any kind
- Use cookies, behavioural tracking, or advertising analytics
- Allow any other user to access your data
4. AI model providers
Buckwheat routes your conversations to the AI model you choose. Your choice of model determines which company processes your data. When you send a message, the following is transmitted to the selected provider:
- Your conversation history (recent messages in the thread)
- Relevant excerpts from your knowledge base
- Your memory context (profile facts, entities, significant events) embedded in the system prompt
The AI model providers we integrate with are:
| Provider | Models | Data sent |
|---|---|---|
| OpenAI | GPT-4o, GPT-5.1 | Conversation + memory context; audio (Whisper transcription) |
| Anthropic | Claude Sonnet, Opus, Haiku | Conversation + memory context |
| Gemini 2.5 Flash, Pro | Conversation + memory context | |
| xAI | Grok 4 | Conversation + memory context |
| DeepSeek | DeepSeek Chat | Conversation + memory context |
| Groq | Llama, Qwen, Kimi | Conversation + memory context |
| Perplexity | Sonar, Sonar Pro | Your query (for web search) |
We use API access with each provider. None of these providers train their models on API inputs under their standard API terms of service. However, each provider’s own privacy policy governs how they handle data received through their API. We encourage you to review their policies.
Important: Your extracted memory (including sensitive personal information like health conditions or relationship details) is included in the system prompt sent to the model provider. If you are uncomfortable with a particular provider receiving this information, choose a different model.
5. Third-party data processors
Beyond AI model providers, we use the following services to operate Buckwheat:
| Service | Purpose | Data processed |
|---|---|---|
| MongoDB Atlas | Primary database | All application data (encrypted at rest) |
| Neo4j | Knowledge graph | Entities and relationships extracted from your conversations |
| Google OAuth | Authentication | Email, name, profile photo |
| Stripe | Payments | Email, name, payment amounts |
| Voyage AI | Vector embeddings | Document text chunks |
| ElevenLabs | Text-to-speech | AI-generated response text |
| Upstash | Redis cache & task queue | Cached content, temporary task data |
| Render | Hosting | Application runtime, logs |
| Meta (WhatsApp) | Messaging channel | Message content, phone number |
| Telegram | Messaging channel | Message content, chat ID |
| Jina AI | Web page extraction | URLs you add to your knowledge base |
6. Smart home integrations
If you connect smart home devices through Buckwheat, your commands are routed through the relevant cloud service (Google Home API or TP-Link Cloud). These providers receive your device commands and timestamps.
If you use camera snapshot analysis, a single frame from your camera is sent to Google Gemini or OpenAI for visual analysis. Snapshots are not stored — they are processed in memory and discarded after the response is generated.
7. Voice messages
When you send a voice message through WhatsApp or the web app, the audio is transmitted to OpenAI’s Whisper API for transcription. The transcribed text is then processed like any other message. For voice messages via WhatsApp, the audio passes through three parties: Meta (delivery), Buckwheat (routing), and OpenAI (transcription).
8. Data retention
| Data type | Retention |
|---|---|
| Conversations | Until you delete them |
| Documents & knowledge base | Until you delete them |
| Memories & knowledge graph | Until you delete them |
| Account information | Until you delete your account |
| Billing records | As required by law (typically 7 years for financial records) |
| Cached data (Redis) | Temporary; automatically purged by TTL |
| Task queue payloads | Seconds to minutes; purged on task completion |
When you delete a conversation, it is removed from your chat history immediately and purged from our database within 30 days. Memories that were extracted from that conversation are not automatically deleted — you can review and remove them individually through the Brain Panel.
9. Your rights
Regardless of where you live, we provide the following rights to all users:
- Access — View all data Buckwheat holds about you, including your memory profile, knowledge graph, and conversation history, directly in the app
- Correction — Edit or correct any memory, profile fact, or entity through the Brain Panel
- Deletion — Delete individual conversations, documents, memories, and knowledge graph entities at any time
- Export — Export individual conversations and bulk account data
- Objection — Contact us to object to any specific data processing
GDPR (European Economic Area, UK, Switzerland)
If you are in the EEA, UK, or Switzerland, you have additional rights under the General Data Protection Regulation, including the right to erasure, data portability, restriction of processing, and the right to lodge a complaint with your local supervisory authority.
Our lawful bases for processing are:
- Contract performance — providing the service you signed up for
- Legitimate interest — service improvement through aggregate analytics, security monitoring
- Legal obligation — financial record-keeping, responding to lawful requests
For adaptive memory (which may process special category data such as health information), our lawful basis is legitimate interest balanced against your ability to review, edit, and delete any extracted memory at any time.
CCPA (California)
If you are a California resident, you have rights under the California Consumer Privacy Act, including the right to know what personal information we collect, the right to delete it, the right to correct inaccurate information, and the right to opt out of the sale or sharing of personal information.
We do not sell your personal information. We do not share your personal information for cross-context behavioural advertising. We do not use sensitive personal information to infer characteristics about you for advertising purposes.
Account deletion
You can delete your entire account and all associated data from within the app. Account deletion includes a 30-day grace period during which you can restore your account. After 30 days, all data is permanently and irreversibly purged. You can also contact us at privacy@buckwheat.ai to request account deletion.
10. Data security
- All data is encrypted at rest (AES-256 via MongoDB Atlas) and in transit (TLS 1.2+)
- Per-user data isolation — every database query is scoped to your user ID
- Authentication via Google OAuth with JWT tokens
- Security-audited codebase (January 2026) with all critical vulnerabilities resolved
- No cross-user data access — verified and tested
- Separate database environments for development, staging, and production
12. Children’s privacy
Buckwheat is not intended for users under 18. We do not knowingly collect personal information from anyone under 18. If you believe a minor is using Buckwheat, please contact us at privacy@buckwheat.ai and we will delete their data.
13. International data transfers
Your data is processed in the United States (our hosting infrastructure is on Render.com in the US). If you are outside the US, your data will be transferred to the US for processing. We rely on standard contractual clauses and our data processing agreements with sub-processors to ensure adequate protection for international transfers.
14. Changes to this policy
We will update this policy as our practices evolve. Material changes will be communicated via email to your registered address. The “Last updated” date at the top of this page reflects the most recent revision.
15. Contact us
For privacy questions, data requests, or to exercise any of your rights: