Privacy policy

What we collect

• Your account. Your name and email address. If you sign in with Google, we receive only your name, email address and profile picture from Google, and nothing else from your Google account. If you signed up with a password, we store a one-way hash of it, never the password itself.
• What you and your agents save. The memories, descriptions and coconuts you or the AI agents you connect write to Coconut.you, and the people, companies and projects linked from them.
• Connections and activity. The agent connections you create, when they were last used, the devices you are signed in on, and a log of account activity (sign-ins, new connections, shares, blocked attempts) so you can review who reached your data.
• Usage counts. How many requests reach each coconut and which tools ran, as daily totals. We do not keep the questions your agents ask.
• Payments. If you buy or sell on Coconut Hub or subscribe, payment details are handled by Stripe. We see the amount, the status and a reference, never your full card number.

How we use it

• To run the service: store your memories, let your connected agents read and write them, and show them to you.
• To link and search your memories: we send the text of a memory to AI models to find the people, companies and projects in it and to make it searchable by meaning.
• To keep accounts safe: rate limits, blocked-attempt records and the activity log.
• To send you service email, such as a coconut someone shared with you.

We do not sell your data, and we do not use it to train AI models. Memories are processed only to provide the service to you.

Who processes it for us

• Google Cloud hosts the service and the databases (United States).
• AI model providers, reached through our own gateway, process memory text for linking and search. They do not keep it for training.
• Amazon Web Services (SES) sends our email.
• Stripe processes payments on Coconut Hub and subscriptions.
• Google provides sign-in, if you choose it.

Sharing

Your coconuts are private to you. Someone else sees one only if you share it with them by email, publish it, or list it on Coconut Hub, and then only that coconut. You can stop sharing or unlist at any time; access ends within about 30 seconds.

How long we keep it

• Your memories and coconuts: until you delete them or your account.
• Account activity and blocked-attempt records: 30 days.
• Daily usage totals: up to 400 days.
• Payment records: as long as tax and accounting law requires.

Your choices

• Export any coconut from its Settings page, on every plan.
• Delete any memory or coconut from the app, at any time.
• Revoke any agent connection or signed-in device under Connections.
• Delete your account or ask what we hold about you by emailing manoj@wexa.ai.

Security

Every request is checked against your connection and the coconuts it may reach, connection tokens are stored hashed, and data is encrypted in transit and at rest. See how a coconut is protected.

Changes and contact

If this policy changes in a way that matters, we will say so in the app before it takes effect. Questions: manoj@wexa.ai.