1. Who we are
SharpAI LLC ("SharpAI," "we," "us") makes the Aegis desktop app, the
Aegis AI API, and the Storyboard mobile app (Chinese name 故事工坊),
and runs the websites described below. For the personal data
described in this policy, SharpAI LLC is the controller (or the
"business" under California law), except where this policy says we
act on behalf of a customer.
2. Which part applies to you
| If you… | Read |
| use the Aegis desktop app | Part A |
| use the Aegis AI API (cloud gateway) | Part B |
| use the Storyboard app | Part C |
| visit our websites or open a Storyboard share link | Part D |
Sections 3 to 9 apply to everything. If a Part and a general
section differ, the Part controls for that product.
3. Who we share data with
We do not sell your personal information, and we do not share it
for cross-context behavioral advertising. We disclose data to:
- Service providers that host, store, deliver or
process data on our behalf under contracts that limit their use.
They are listed on our
Sub-processors page.
- Third-party services you choose to connect (for
example camera, messaging or AI providers you configure yourself
in the Aegis desktop app). Those connections are between you and
them.
- Other members of a family you invite in
Storyboard, as described in Part C.
- Authorities or others when the law requires it,
to protect rights and safety, or in a business transaction
(merger, sale), with notice where required.
4. How long we keep data
Each Part lists retention by category. Where no fixed period is
given, we keep data while your account is active and for as long as
needed for the purpose, then delete or de-identify it. Service logs
and backups are kept only as long as needed for security and
operations, then deleted or aged out.
5. Security
We use encryption in transit, access controls, and separate
credentials for our services. No system is perfectly secure, and we
cannot guarantee the security of your data.
6. Your rights
Depending on where you live, you may have the right to: access your
data; correct it; delete it; restrict or object to processing;
receive it in a portable format; withdraw consent at any time
(without affecting earlier processing); and complain to your data
protection authority. California residents may also know, delete,
correct, and limit use of sensitive personal information, and are
not discriminated against for using these rights.
How to exercise them: use the in-app controls
where they exist (Storyboard: Me › Delete Account), or contact
service@sharpai.org.
We may ask you to verify your identity. We respond within 45 days, extendable as the law allows. In California you can use an authorized agent. If we
decline a request, you can appeal by replying to our message.
We do not make decisions about you with legal or similarly
significant effect based solely on automated processing.
7. Children
You must be at least 16 years old to create an account with any of
our products, in every country. Our products are not directed to
children under 16, and we do not knowingly collect personal
information directly from anyone under 16. If we learn that we have,
we delete the account. If you believe a child has an account,
contact service@sharpai.org.
For how Storyboard handles children who appear in family photos or
recordings, see Part C, section C9.
8. Changes to this policy
We will post the new version with its effective date and keep
earlier versions available. For material changes we will notify you
in the app or by email before they take effect, and we will ask for
your consent again if a change expands how we use your photos,
recordings or text.
Previous versions: this unified policy replaces the
earlier Aegis desktop privacy policy (effective April 18, 2026). The
earlier version is available on request from
service@sharpai.org.
9. How to contact us
Part A — Aegis desktop app
A1. Stored on your device
The Aegis desktop app stores most data locally on your computer.
We do not receive this data unless you turn on a feature described
below.
- Video content and recordings — Live camera feeds,
saved video clips, and captured snapshots from your connected cameras.
- AI analysis results — Object detection data, motion
events, scene descriptions, and other analysis outputs generated by
on-device or cloud-based AI models.
- Application data — Your preferences, camera configurations,
notification rules, chat history, and event timeline, all stored in
a local SQLite database.
A2. Information you enter
- Camera provider credentials — Login credentials for
cloud-connected camera services such as Blink or Ring, used to authenticate
with those services on your behalf.
- Third-party AI service API keys — API keys for AI
providers such as Google Gemini, OpenAI, or Anthropic, used to send
analysis requests from your device to those services.
- Messaging service tokens — Bot tokens, chat IDs, or
webhook URLs for notification services such as Discord or Telegram.
These are stored on your device.
A3. Services you configure yourself
When you configure a cloud-based AI provider or messaging service
yourself, the app sends requests directly from your device to that
provider. These requests may include camera images, video frames,
or text prompts. Their handling is governed by that provider's own
privacy policy, and we are not a party to those communications. If
you instead use the Aegis AI API, see Part B.
A4. Crash and diagnostic reports
To help us identify and fix software defects, the app may
automatically send crash reports to our diagnostic service provider
(Sentry) when unexpected errors occur. These reports may include
your IP address, device and operating system information (such as
operating system version, app version and general hardware type),
and the error message and stack trace. Crash reports do not include
any video footage, camera images, chat messages, AI analysis
results, or API keys. You can disable crash
reporting at any time in the application's Privacy settings; when
disabled, no diagnostic data is sent from your device.
A5. Your choices
You can access, delete and export local data directly (standard
SQLite, MP4 and JPEG formats), delete it by removing files from the
data directory or uninstalling the app, disconnect any third-party
integration by removing its credentials, and turn off crash reports
at any time.
Part B — Aegis AI API (cloud gateway)
Upstream providers. Upstream model providers
process your requests under their own terms and may retain them or
use them for their own purposes. We cannot obtain no-training terms
from them and we do not control this. Choose your plan and models
accordingly.
B1. What it is, and our role
When you use the Aegis AI API, your requests (including message
content) and the model's responses pass through our cloud
infrastructure, and we forward
them to upstream model providers on your behalf. For this service we
are an intermediary: we receive, route and, depending on your plan,
store your requests.
B2. Upstream providers
We forward requests to upstream providers (such as OpenAI,
Anthropic, Google, and others via OpenRouter or Fireworks AI). They
process your request under their own privacy policies and terms,
and may independently store it or use it for their own purposes.
We choose these providers, but we do not control their retention or
use after a request is forwarded.
B3. Free and Premium plans
For users on the Free or Premium
plans, SharpAI LLC stores request messages and model responses in
our secure cloud infrastructure, and we use this content to improve
and train SharpAI's services and models, including routing quality,
cost optimization, reliability, abuse detection and benchmarking. We
do not sell this data to third parties or use it to serve
advertising.
- What is stored — Request message content, model
responses, token counts, latency, model identifier, and your
account identifier.
- Retention — Request logs are retained for up to
90 days, after which message content is deleted. Usage metrics
(token counts, cost) are retained for billing and analytics
purposes.
- Training use — We use stored request content to
train and improve SharpAI's services and models. You can ask us to stop
using your content for training by writing to
service@sharpai.org.
B4. Storyboard is separate
The Aegis AI API is not used by the Storyboard app. Storyboard
content is not sent to the Aegis AI API, and the retention terms in
this Part do not apply to it. Storyboard shares only a sign-in
account and a deletion process with Aegis (see Part C, section C8).
Part C — Storyboard mobile app (故事工坊)
C1. What Storyboard is
Storyboard helps families turn photos and voice recordings into
stories and share them with family members you invite. Your account
is a sign-in account that is shared with the Aegis desktop app.
C2. Data we collect, why, where, how long
| Category | What | Purpose | Where processed | Retention |
| Account | Name and email from Apple or Google sign-in (Apple may provide a relay address); user ID | Sign-in, show who wrote what, account management | Our cloud via our sign-in provider | Until the account is deleted (see C8) |
| Device and notifications | App-generated install ID; push-notification token; language and app version sent with requests | Deliver notifications; make the app work | Our cloud; our push provider | Until you sign out of the device or delete the account |
| Photos | Reduced-size copies you choose to add to a story (long edge up to 1024 px, location and camera metadata removed on your phone). Originals stay on your phone by default | Show your story to your family; build the story video; AI features you start (C4) | Our cloud storage and media delivery | Kept with the story; deleted when the story or account is deleted |
| Recordings | Voice recordings and short videos you add, including comments recorded on others' stories | Playback, story video, transcription on your phone | Our cloud storage | Kept with the story, not time-limited; deleted when the account is deleted (see C8) |
| Story content | Story text, descriptions, comments, family chat, "listened" records | Run the app; let family see who has listened | Our cloud database | As above |
| Chat with your home device | Messages between your phone and a compatible home device you connected | Deliver the chat | Our cloud database | Kept only as long as needed to deliver the chat |
| Face detection | Face boxes found on your phone; only the position of a comment you pinned is sent | Let you attach a comment to a spot on a photo | Your phone; the comment location goes to our cloud | With the comment. We do not create face templates and do not identify people |
| Purchase and credit records | Gift credits, purchases and refunds as ledger entries. Payments are handled by Apple or Google; we do not see card numbers | Provide purchases, refunds, accounting | Our cloud | On account deletion, balances and entitlements are deleted; gift, purchase and refund entries are pseudonymized (identifier replaced by a random one, no mapping kept) and kept 7 years |
| Reports | If you report content: your user ID and the reported content | Safety and abuse handling | Our cloud | Kept for as long as needed to handle reports and prevent abuse; not removed by account deletion |
| Service logs and technical data | IP address and request metadata at our network edge and hosting; usage metadata for AI calls (user ID, size and cost counters, no content) | Security, rate limiting, cost control | Our cloud and edge network | See section 4 |
We do not use advertising SDKs, do not track you across other apps
or websites, and the app contains no analytics or crash-reporting
SDK. We do not collect your location, contacts, or health data.
C3. Where your family's content goes
What you add to a story is visible to the family members you have
invited, and to people you choose to share a link with (see C7). It
is not public and is not indexed by search engines.
C4. AI features (photos, voice-derived text, and story generation)
Storyboard uses AI services run by third-party providers that
process data for us (listed on the
Sub-processors page).
Data is sent only when you start a feature that needs it:
- Talk it through (聊一聊). When you tap it, the
reduced-size photos you selected (2 to 5) are sent once, over an
encrypted connection, to our servers and on to an AI service, which
reads them so that we can ask you good questions. After this,
later messages in the conversation send text only. The photos you
choose are stored with your story as described in C2.
- Generate the story. To write the story, we send
text to an AI service: short descriptions of your photos produced
on your phone, transcripts of your recordings together with the
names or labels you gave the speakers, your notes, and event
summaries from a home device if you connected one.
-
Your recordings themselves are not sent to the AI service; they
are transcribed on your phone.
Consent. The first time you use either feature,
the app shows a notice and asks you to agree before anything is
sent. You can decline and still use the rest of the app, and you can
withdraw consent at any time (see C5).
What the AI provider may do. The AI service
receives the content to produce the result we asked for. We do not
control, and do not promise, how long that provider keeps requests
or whether it uses them to improve its own service; it handles them
under its own terms with us, which we select and review. If you do not want this, do not use these features.
We do not ask AI processors to identify people in your photos. AI
output can be wrong; please review stories before sharing.
C5. Your choices about AI
Do not tap "talk it through" or "generate" if you do not want
content processed by AI. You can withdraw your consent at any time
in the app's settings; this stops future sending and does not undo
earlier processing.
C6. Other people in your content
If your photos or recordings show or include other people
(including children), you are responsible for having the right to
add them and for telling them where needed. We process this content
to provide the service you requested; we do not identify people in
photos and do not build profiles. A person who appears in a story
and wants it removed can contact
service@sharpai.org
or ask the person who uploaded it.
C7. Sharing and invitations
- Family invitations use a code or link; anyone who
has the code can join until it is used up or expires after 7 days.
- Share links (story.sharpai.org/p/…) can be
opened by anyone who has the link, without an account. Do not
share a link you do not want others to see. Share pages ask search
engines not to index them.
-
When someone opens a share link we may set a random reader ID
cookie for one year and record the visit (page, link, browser type
and country) to show you how many people read your story. Embedded
views do not set cookies.
C8. Deleting your account and your content
- In the app: Me › Delete Account (you sign in
again to confirm). Your family stories and share pages are hidden
immediately; you can undo within 30 days. After 30 days we delete
the account and your data. Your Storyboard and Aegis accounts
share one sign-in, so deleting the account deletes both; the app
tells you this before you confirm.
- What is deleted: your photos, recordings and
transcript text; stories, posts, devices and chat; invitations;
listening records; your profile and entitlements; the sign-in
account.
- What may remain: records needed to prevent abuse
and handle reports; copies others made of a story you shared (their
own versions); comments and recordings you left on someone else's
story, which stay with that story; pseudonymized purchase records
(7 years); backups until they age out.
- Deleting one story currently hides it; stored
photos and recordings are removed when the account is deleted.
- Without the app: see sharpai.org/delete, or email service@sharpai.org.
C9. Children
Storyboard is a family app, and families include children. You must
be at least 16 to create an account. Children can appear in photos
or recordings that an adult in the family adds, but cannot have
their own account. We do not knowingly collect personal information
directly from anyone under 16; if we learn we have, we delete the
account.
C10. California notice
California (notice at collection). In the past 12
months we collected these categories: identifiers (name, email, user
ID, install ID, push token, IP address); photos and audio; internet
or app activity ("listened" records); and commercial information
(credit and purchase records). We do not make inferences about you.
Sources: you and your device. Purposes and retention: as in C2. We
disclose data for a business purpose to service providers (see the
Sub-processors page).
We do not sell or share personal information (as those terms are
defined in California law) and have no actual knowledge of selling
or sharing the personal information of anyone under 16. We do not
use sensitive personal information to infer characteristics;
sign-in credentials are used only to provide the service.
Part D — Websites (sharpai.org, story.sharpai.org)
- Server logs at our hosting and network provider
record IP address, requested page and browser data for security
and reliability.
- Share-link pages (Storyboard) use a first-party
cookie named
sb_a (a random reader ID, kept for one
year) and record the visit as described in C7.
- Embedded pages do not set cookies.
-
We honor Global Privacy Control signals as an opt-out of sale or
sharing, although we do not sell or share personal information.