LEGAL

Privacy Policy

Effective Date: October 7, 2026

1. Who we are

SharpAI LLC ("SharpAI," "we," "us") makes the Aegis desktop app, the Aegis AI API, and the Storyboard mobile app (Chinese name 故事工坊), and runs the websites described below. For the personal data described in this policy, SharpAI LLC is the controller (or the "business" under California law), except where this policy says we act on behalf of a customer.

2. Which part applies to you

If you…Read
use the Aegis desktop appPart A
use the Aegis AI API (cloud gateway)Part B
use the Storyboard appPart C
visit our websites or open a Storyboard share linkPart D

Sections 3 to 9 apply to everything. If a Part and a general section differ, the Part controls for that product.

3. Who we share data with

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We disclose data to:

  • Service providers that host, store, deliver or process data on our behalf under contracts that limit their use. They are listed on our Sub-processors page.
  • Third-party services you choose to connect (for example camera, messaging or AI providers you configure yourself in the Aegis desktop app). Those connections are between you and them.
  • Other members of a family you invite in Storyboard, as described in Part C.
  • Authorities or others when the law requires it, to protect rights and safety, or in a business transaction (merger, sale), with notice where required.

4. How long we keep data

Each Part lists retention by category. Where no fixed period is given, we keep data while your account is active and for as long as needed for the purpose, then delete or de-identify it. Service logs and backups are kept only as long as needed for security and operations, then deleted or aged out.

5. Security

We use encryption in transit, access controls, and separate credentials for our services. No system is perfectly secure, and we cannot guarantee the security of your data.

6. Your rights

Depending on where you live, you may have the right to: access your data; correct it; delete it; restrict or object to processing; receive it in a portable format; withdraw consent at any time (without affecting earlier processing); and complain to your data protection authority. California residents may also know, delete, correct, and limit use of sensitive personal information, and are not discriminated against for using these rights.

How to exercise them: use the in-app controls where they exist (Storyboard: Me › Delete Account), or contact service@sharpai.org. We may ask you to verify your identity. We respond within 45 days, extendable as the law allows. In California you can use an authorized agent. If we decline a request, you can appeal by replying to our message.

We do not make decisions about you with legal or similarly significant effect based solely on automated processing.

7. Children

You must be at least 16 years old to create an account with any of our products, in every country. Our products are not directed to children under 16, and we do not knowingly collect personal information directly from anyone under 16. If we learn that we have, we delete the account. If you believe a child has an account, contact service@sharpai.org. For how Storyboard handles children who appear in family photos or recordings, see Part C, section C9.

8. Changes to this policy

We will post the new version with its effective date and keep earlier versions available. For material changes we will notify you in the app or by email before they take effect, and we will ask for your consent again if a change expands how we use your photos, recordings or text.

Previous versions: this unified policy replaces the earlier Aegis desktop privacy policy (effective April 18, 2026). The earlier version is available on request from service@sharpai.org.

Part A — Aegis desktop app

A1. Stored on your device

The Aegis desktop app stores most data locally on your computer. We do not receive this data unless you turn on a feature described below.

  • Video content and recordings — Live camera feeds, saved video clips, and captured snapshots from your connected cameras.
  • AI analysis results — Object detection data, motion events, scene descriptions, and other analysis outputs generated by on-device or cloud-based AI models.
  • Application data — Your preferences, camera configurations, notification rules, chat history, and event timeline, all stored in a local SQLite database.

A2. Information you enter

  • Camera provider credentials — Login credentials for cloud-connected camera services such as Blink or Ring, used to authenticate with those services on your behalf.
  • Third-party AI service API keys — API keys for AI providers such as Google Gemini, OpenAI, or Anthropic, used to send analysis requests from your device to those services.
  • Messaging service tokens — Bot tokens, chat IDs, or webhook URLs for notification services such as Discord or Telegram.

These are stored on your device.

A3. Services you configure yourself

When you configure a cloud-based AI provider or messaging service yourself, the app sends requests directly from your device to that provider. These requests may include camera images, video frames, or text prompts. Their handling is governed by that provider's own privacy policy, and we are not a party to those communications. If you instead use the Aegis AI API, see Part B.

A4. Crash and diagnostic reports

To help us identify and fix software defects, the app may automatically send crash reports to our diagnostic service provider (Sentry) when unexpected errors occur. These reports may include your IP address, device and operating system information (such as operating system version, app version and general hardware type), and the error message and stack trace. Crash reports do not include any video footage, camera images, chat messages, AI analysis results, or API keys. You can disable crash reporting at any time in the application's Privacy settings; when disabled, no diagnostic data is sent from your device.

A5. Your choices

You can access, delete and export local data directly (standard SQLite, MP4 and JPEG formats), delete it by removing files from the data directory or uninstalling the app, disconnect any third-party integration by removing its credentials, and turn off crash reports at any time.

Part B — Aegis AI API (cloud gateway)

Upstream providers. Upstream model providers process your requests under their own terms and may retain them or use them for their own purposes. We cannot obtain no-training terms from them and we do not control this. Choose your plan and models accordingly.

B1. What it is, and our role

When you use the Aegis AI API, your requests (including message content) and the model's responses pass through our cloud infrastructure, and we forward them to upstream model providers on your behalf. For this service we are an intermediary: we receive, route and, depending on your plan, store your requests.

B2. Upstream providers

We forward requests to upstream providers (such as OpenAI, Anthropic, Google, and others via OpenRouter or Fireworks AI). They process your request under their own privacy policies and terms, and may independently store it or use it for their own purposes. We choose these providers, but we do not control their retention or use after a request is forwarded.

B3. Free and Premium plans

For users on the Free or Premium plans, SharpAI LLC stores request messages and model responses in our secure cloud infrastructure, and we use this content to improve and train SharpAI's services and models, including routing quality, cost optimization, reliability, abuse detection and benchmarking. We do not sell this data to third parties or use it to serve advertising.

  • What is stored — Request message content, model responses, token counts, latency, model identifier, and your account identifier.
  • Retention — Request logs are retained for up to 90 days, after which message content is deleted. Usage metrics (token counts, cost) are retained for billing and analytics purposes.
  • Training use — We use stored request content to train and improve SharpAI's services and models. You can ask us to stop using your content for training by writing to service@sharpai.org.

B4. Storyboard is separate

The Aegis AI API is not used by the Storyboard app. Storyboard content is not sent to the Aegis AI API, and the retention terms in this Part do not apply to it. Storyboard shares only a sign-in account and a deletion process with Aegis (see Part C, section C8).

Part C — Storyboard mobile app (故事工坊)

C1. What Storyboard is

Storyboard helps families turn photos and voice recordings into stories and share them with family members you invite. Your account is a sign-in account that is shared with the Aegis desktop app.

C2. Data we collect, why, where, how long

CategoryWhatPurposeWhere processedRetention
Account Name and email from Apple or Google sign-in (Apple may provide a relay address); user ID Sign-in, show who wrote what, account management Our cloud via our sign-in provider Until the account is deleted (see C8)
Device and notifications App-generated install ID; push-notification token; language and app version sent with requests Deliver notifications; make the app work Our cloud; our push provider Until you sign out of the device or delete the account
Photos Reduced-size copies you choose to add to a story (long edge up to 1024 px, location and camera metadata removed on your phone). Originals stay on your phone by default Show your story to your family; build the story video; AI features you start (C4) Our cloud storage and media delivery Kept with the story; deleted when the story or account is deleted
Recordings Voice recordings and short videos you add, including comments recorded on others' stories Playback, story video, transcription on your phone Our cloud storage Kept with the story, not time-limited; deleted when the account is deleted (see C8)
Story content Story text, descriptions, comments, family chat, "listened" records Run the app; let family see who has listened Our cloud database As above
Chat with your home device Messages between your phone and a compatible home device you connected Deliver the chat Our cloud database Kept only as long as needed to deliver the chat
Face detection Face boxes found on your phone; only the position of a comment you pinned is sent Let you attach a comment to a spot on a photo Your phone; the comment location goes to our cloud With the comment. We do not create face templates and do not identify people
Purchase and credit records Gift credits, purchases and refunds as ledger entries. Payments are handled by Apple or Google; we do not see card numbers Provide purchases, refunds, accounting Our cloud On account deletion, balances and entitlements are deleted; gift, purchase and refund entries are pseudonymized (identifier replaced by a random one, no mapping kept) and kept 7 years
Reports If you report content: your user ID and the reported content Safety and abuse handling Our cloud Kept for as long as needed to handle reports and prevent abuse; not removed by account deletion
Service logs and technical data IP address and request metadata at our network edge and hosting; usage metadata for AI calls (user ID, size and cost counters, no content) Security, rate limiting, cost control Our cloud and edge network See section 4

We do not use advertising SDKs, do not track you across other apps or websites, and the app contains no analytics or crash-reporting SDK. We do not collect your location, contacts, or health data.

C3. Where your family's content goes

What you add to a story is visible to the family members you have invited, and to people you choose to share a link with (see C7). It is not public and is not indexed by search engines.

C4. AI features (photos, voice-derived text, and story generation)

Storyboard uses AI services run by third-party providers that process data for us (listed on the Sub-processors page). Data is sent only when you start a feature that needs it:

  • Talk it through (聊一聊). When you tap it, the reduced-size photos you selected (2 to 5) are sent once, over an encrypted connection, to our servers and on to an AI service, which reads them so that we can ask you good questions. After this, later messages in the conversation send text only. The photos you choose are stored with your story as described in C2.
  • Generate the story. To write the story, we send text to an AI service: short descriptions of your photos produced on your phone, transcripts of your recordings together with the names or labels you gave the speakers, your notes, and event summaries from a home device if you connected one.
  • Your recordings themselves are not sent to the AI service; they are transcribed on your phone.

Consent. The first time you use either feature, the app shows a notice and asks you to agree before anything is sent. You can decline and still use the rest of the app, and you can withdraw consent at any time (see C5).

What the AI provider may do. The AI service receives the content to produce the result we asked for. We do not control, and do not promise, how long that provider keeps requests or whether it uses them to improve its own service; it handles them under its own terms with us, which we select and review. If you do not want this, do not use these features.

We do not ask AI processors to identify people in your photos. AI output can be wrong; please review stories before sharing.

C5. Your choices about AI

Do not tap "talk it through" or "generate" if you do not want content processed by AI. You can withdraw your consent at any time in the app's settings; this stops future sending and does not undo earlier processing.

C6. Other people in your content

If your photos or recordings show or include other people (including children), you are responsible for having the right to add them and for telling them where needed. We process this content to provide the service you requested; we do not identify people in photos and do not build profiles. A person who appears in a story and wants it removed can contact service@sharpai.org or ask the person who uploaded it.

C7. Sharing and invitations

  • Family invitations use a code or link; anyone who has the code can join until it is used up or expires after 7 days.
  • Share links (story.sharpai.org/p/…) can be opened by anyone who has the link, without an account. Do not share a link you do not want others to see. Share pages ask search engines not to index them.
  • When someone opens a share link we may set a random reader ID cookie for one year and record the visit (page, link, browser type and country) to show you how many people read your story. Embedded views do not set cookies.

C8. Deleting your account and your content

  • In the app: Me › Delete Account (you sign in again to confirm). Your family stories and share pages are hidden immediately; you can undo within 30 days. After 30 days we delete the account and your data. Your Storyboard and Aegis accounts share one sign-in, so deleting the account deletes both; the app tells you this before you confirm.
  • What is deleted: your photos, recordings and transcript text; stories, posts, devices and chat; invitations; listening records; your profile and entitlements; the sign-in account.
  • What may remain: records needed to prevent abuse and handle reports; copies others made of a story you shared (their own versions); comments and recordings you left on someone else's story, which stay with that story; pseudonymized purchase records (7 years); backups until they age out.
  • Deleting one story currently hides it; stored photos and recordings are removed when the account is deleted.
  • Without the app: see sharpai.org/delete, or email service@sharpai.org.

C9. Children

Storyboard is a family app, and families include children. You must be at least 16 to create an account. Children can appear in photos or recordings that an adult in the family adds, but cannot have their own account. We do not knowingly collect personal information directly from anyone under 16; if we learn we have, we delete the account.

C10. California notice

California (notice at collection). In the past 12 months we collected these categories: identifiers (name, email, user ID, install ID, push token, IP address); photos and audio; internet or app activity ("listened" records); and commercial information (credit and purchase records). We do not make inferences about you. Sources: you and your device. Purposes and retention: as in C2. We disclose data for a business purpose to service providers (see the Sub-processors page). We do not sell or share personal information (as those terms are defined in California law) and have no actual knowledge of selling or sharing the personal information of anyone under 16. We do not use sensitive personal information to infer characteristics; sign-in credentials are used only to provide the service.

Part D — Websites (sharpai.org, story.sharpai.org)

  • Server logs at our hosting and network provider record IP address, requested page and browser data for security and reliability.
  • Share-link pages (Storyboard) use a first-party cookie named sb_a (a random reader ID, kept for one year) and record the visit as described in C7.
  • Embedded pages do not set cookies.
  • We honor Global Privacy Control signals as an opt-out of sale or sharing, although we do not sell or share personal information.

© 2026 SharpAI LLC. All rights reserved.

← Back to Home