Privacy Policy
Published November 1, 2026 · Effective November 1, 2026
On this page
Who we are
SystemSculpt is a product of Trellisbyte LLC, a California limited liability company ("Trellisbyte", "we", "us"). This policy covers systemsculpt.com, the SystemSculpt plugin for Obsidian, SystemSculpt for iPhone and Apple Watch, and our hosted AI service. Trellisbyte is responsible for deciding how the personal information described here is used.
Contact privacy@systemsculpt.com, or write to Trellisbyte LLC, c/o Northwest Registered Agent, Inc., 2108 N St Ste N, Sacramento, CA 95816, USA. This is our mailing/registered-agent address. Company information.
The short version
- Your Obsidian vault is on your device. Hosted features receive the content you submit or authorize the assistant to read. The iPhone app also keeps local captures and sends them to our service; not every copy exists only in Obsidian.
- We use content to provide and support the requested features, not to create advertising audiences. We do not operate a model-training program. Provider processing and the company-assistant settings are explained below; this is not a promise of zero provider retention or a claim about all historical processing.
- Google measures website visits and conversions as described below. Hashing an email for ad matching does not make it anonymous.
- The current iPhone app does not track you across other companies' apps or websites. A future tracking feature would require updated disclosures and the applicable permission before use.
- You can request access, correction or deletion at privacy@systemsculpt.com, or delete your account yourself on the website or in the iPhone app. Deleting your account stops a website subscription from renewing; it does not cancel an App Store subscription.
What we collect
Account and security information. Email, name if supplied or received through sign-in, account and license identifiers, signup time, where you signed up (the website, the Obsidian plugin or the iPhone app, with the app's version), time zone, and network/security information. We use signup network information to detect abuse of starter credits. A sign-in service handles authentication; we do not receive your sign-in password.
Purchases. Products, amounts, currency, dates, subscription status, payment/customer identifiers and information reported by Stripe, Apple or RevenueCat, such as billing country, email or the payment method used (for example a card, Apple Pay, Google Pay or Link) where available. We do not receive your full payment-card number.
Feature content. Messages, prompts, selected or attached notes and files, images, recordings, transcripts, URLs, iPhone captures, questions, generated answers and other results. Content accessible to an agent depends on the selected files, tools and permissions, not just what you type in a chat box.
Service activity. Feature/model use, credit charges, delivery receipts, app/plugin versions, operational errors and diagnostic records. A failed AI-request record can include the request's content and relevant vault context, not just an error code.
Website activity. Requested pages, browser/device and network information, referrers, campaign tags, ad-click identifiers and measurement identifiers where enabled. See Cookies and ad choices. When a script error occurs in your browser on our checkout, sign-in, sign-up or account pages, the page sends us only which of those pages it was, the browser type, the website's release version, whether the error came from our code, a browser extension or elsewhere, and a fingerprint (hash) of the error instead of the error message itself, and we count them; those counts hold no IP address, cookie, account or content.
Correspondence. Support/contact messages and their attachments. Our contact form also receives name, email, IP address and browser details. Email services record delivery and may record opens or link clicks where tracking is enabled, including newsletter measurement. You can unsubscribe using the message's link.
How we use information
| Purpose | Examples | EEA/UK legal basis, where applicable |
|---|---|---|
| Provide the service you request | Authentication, AI processing, storage, vault delivery, subscriptions and credits | Contract |
| Payments and required records | Billing, refunds, accounting and legally required records | Contract; legal obligation |
| Security and reliability | Fraud/abuse prevention, operational diagnostics, investigation and recovery | Legitimate interests; legal obligation where applicable |
| Support | Answering questions and resolving account problems | Contract; legitimate interests |
| Product analysis | Understanding first-party feature use and subscription outcomes | Legitimate interests, subject to applicable device-storage/consent requirements |
| Website measurement and advertising attribution | Visits, campaign and purchase measurement | Consent where required; otherwise legitimate interests subject to applicable opt-outs |
| Communications | Service/purchase notices, requested newsletters and permitted product messages | Contract, consent or legitimate interests as applicable; legal obligation for required notices |
Our legitimate interests are running a reliable service, preventing misuse, understanding product performance and helping customers. You may object as explained under Your rights. Swiss law may use different legal terminology; applicable Swiss protections also apply.
AI features and company support tools
Hosted AI features send the information needed for the request to a model-routing service, which forwards it to underlying inference providers to run the selected models. The company hosting inference is not necessarily the model's developer. Recipients can differ by feature and route; the routing service is not the only company that receives the submitted content.
Capture formatting, Ask and capture actions include a provider data-collection restriction in their routing requests and restrict routing to the provider list configured for the selected model. That list can change. Other hosted paths have their own routing and storage controls. These controls are not a universal no-training or zero-retention guarantee: provider policies, security, abuse monitoring, processing and retention still matter. The routing service and downstream providers have their own applicable terms.
- Audio: AssemblyAI may receive an accessible audio URL and process the recording for transcription, including language detection and speaker labels. After saving the result, we request deletion of its transcript resource and retry failed requests. This is not a claim that every provider backup or security record is immediately erased.
- YouTube: Audio Processor uses YouTube API Services. When you submit a YouTube link, our server sends that video's ID to YouTube and receives the video's public details. Of those, we use its title, channel name, length, whether it is public and finished processing, whether it has captions, and its audio language: to check that the video can be processed and is within the length limit, to estimate and charge credits, to choose a caption track, and to show the title and channel with the job and in its note. We keep these details only as long as the Audio Processor job. SystemSculpt does not sign in to YouTube or ask for access to your Google or YouTube account, so there is no access to revoke. A video-transcript provider receives the requested video URL, transcription options and that audio language. Captions or generated transcripts can then be processed through the routing service for summaries. Google's own handling of information is described in the Google Privacy Policy.
- Documents: Uploaded PDFs, including their filenames, are sent through our model-routing service with an OCR document parser selected, then converted into Markdown by the configured model. Uploaded images are sent to the configured vision model. Source uploads and extracted content have different retention schedules below.
- Search: A hosted search query may be sent to a search provider through the routing service; our service fetches selected result pages. We use safeguards intended to avoid sending secrets and private identifiers in queries, but no filter guarantees that sensitive information can never pass through.
- Reuse: Results for an identical public video may be reused. Audio-result reuse is scoped to the submitting account.
On desktop you can instead connect an installed Codex or Claude Code agent using your own provider account. Its provider, tools, history and permissions follow that account's configuration and terms. The plugin starts/interacts with the local agent and receives its output. This is not the same as offline processing, and it does not mean the plugin cannot see the interaction.
If you send an iPhone capture to a desktop agent, our service stores the handoff instruction and selected agent and vault identifiers. The desktop plugin sends its available agents, vault name, vault identifier and plugin-instance identifier to our service, then sends progress status, errors, the agent's full returned result text and the saved note's vault-relative path so the phone can show the outcome. This also applies when the handoff runs through your own Codex or Claude Code account. Ordinary desktop chat with those agents is separate from this handoff service. These content-bearing handoff records are separate from the content-free first-party app events described below.
We also use AI assistant services to help operate SystemSculpt, including support and review of account, billing and usage records. The account-level model-improvement preferences we verified in the assistant accounts used for this work are off. This describes those preferences, not a claim that they were always off, that prior data was erased, or that every separate product control or provider-retention rule is covered.
SystemSculpt for iPhone and Apple Watch
Account. You sign in through our website. The app stores the license credential in the iPhone Keychain.
Captures and answers. Typed/shared text, links and voice captures are processed by SystemSculpt to create notes, answer questions or perform requested capture actions. Speech is normally transcribed on the phone. When on-device transcription is unavailable or unsuitable, or a failed voice capture is resent, the recording may be uploaded for server transcription. Audio can be uploaded directly to our cloud storage through signed URLs issued by our API. The app keeps useful local copies, and the plugin can save notes to your Obsidian vault.
Watch. The Watch app transfers recordings and metadata to the iPhone and keeps its outbox until the phone acknowledges saving it. The phone sends recent capture titles/status information back to the Watch. The SystemSculpt Watch app has no separate sign-in or direct requests to our servers; the iPhone handles our service uploads.
Microphone. Microphone access is used for recordings you start, including an ongoing background recording.
Purchases and subscription analysis. Apple processes App Store payments. RevenueCat receives receipt/transaction and subscription information and is associated with your SystemSculpt account ID after sign-in. The app also supplies first-use dates, first-week steps, rolling note/speech/delivery counts, recording-recovery and duration metrics, billing-issue status, and whether features such as widgets, shortcuts, Watch, background recording, reminders or notifications were used or enabled. These attributes do not contain capture text, titles, tags or audio. A seven-day metric window is not a seven-day deletion promise for the subscriber record.
First-party app events. Our API receives subscription-screen, purchase/restore-result, note-open and Obsidian-handoff events. They include a random installation ID, event IDs/timestamps, build information and limited product, amount, outcome and capture identifiers. Events are linked to your account after sign-in. Content-free facts also record processing and vault delivery. These records do not include capture text, transcripts, recordings, email or passwords, and this event stream is not sent to advertising platforms. We use network information for request protection; raw IP is not stored with these event rows. Other infrastructure logs are separate.
Current tracking behavior. The current app shows no ads and does not track you across other companies' apps or websites. This does not mean it collects no information: the service and subscription processing above still occur.
Deleting captures. Removing a capture from the phone removes that local entry. For an undelivered server capture the app attempts a server deletion; a failed/offline request can leave it until scheduled expiry. Delivered captures use the server expiry schedule. Separate transcription artifacts, event records, local Ask history and notes already saved to Obsidian are not all erased by this action.
Website advertising and measurement
We use Google Analytics to measure visits and Google Ads to measure conversions. Campaign attribution may include a browser-generated visitor ID, referrer/path, campaign tags and click IDs associated with a checkout. Where measurement is allowed, that record (first and latest pages and visit times, the referring site, campaign tags, ad-click identifiers and the visitor ID) is also attached to your account when you create it, with that browser's consent ID and choice. If you later decline or withdraw in Cookie settings on that browser, or it sends GPC, we remove it from your account.
Google Ads conversion data can include an order ID, value and currency. With the required permission, enhanced conversions also send a SHA-256 hash of the purchase email for matching. Google can match that hash to information it already holds; it is not anonymous. Server-side Google Analytics checkout/purchase events can include account/measurement identifiers and campaign details.
We do not use Google remarketing audiences or a Meta pixel on systemsculpt.com. Google's processing is described at How Google uses information from sites and apps. Advertising-related disclosures can constitute a sale, sharing or targeted advertising under some privacy laws depending on their purposes and the applicable law; we do not claim that hashing or receiving no cash removes those protections. We do not provide your notes, recordings, transcripts or prompts for ad targeting.
We do not respond separately to the older Do Not Track header. It is different from Global Privacy Control, which is handled as described above. Google may receive information across participating services subject to its settings, terms and your choices.
Additional choices: Google My Ad Center, Google Analytics opt-out, US industry choices and European industry choices. These do not replace this site's own settings.
Who receives information
| Recipient | Purpose |
|---|---|
| Hosting and network provider | Hosting/network security, storage, service state and email routing; web analytics, which counts page loads on systemsculpt.com by page, referring site, country and browser/device type and measures load speed, without cookies or identifying individual visitors. In the EEA, UK and Switzerland it runs only after you accept optional measurement; elsewhere it runs whether or not you accept |
| Database hosting provider | Database hosting |
| Sign-in service | Authentication |
| Stripe | Website payments and related billing/tax services |
| Apple Pay, Google Pay, Link and other methods you choose at checkout | Completing a website payment you make with that method |
| Apple and RevenueCat | App Store transactions, entitlements and subscription analysis |
| Email delivery services | Transactional, onboarding and newsletter email |
| Model-routing service and selected model, search and document-processing providers; AssemblyAI; a video-transcript provider | Requested AI, document conversion, search and transcription features |
| Website Analytics/Ads; YouTube API Services, which receive the IDs of YouTube videos you submit to Audio Processor | |
| Email and workspace provider | Our support inbox |
| AI assistant services | Company/support assistants described above |
Apple Pay, Google Pay and Link. Website checkout is hosted by Stripe. If you pay with Apple Pay or Google Pay, Apple or Google handles that part of the payment under its own terms and privacy policy and passes the payment details to Stripe. Google may also use information from Google Pay payments for its own analytics. Link is Stripe's service for saving and reusing payment details; details you save with it are kept by Stripe under Link's terms and privacy policy. See Apple Pay & Privacy, Google's Payments Privacy Notice and Google Pay terms, and Link's Privacy Policy and Terms. Checkout can also offer methods such as Klarna, Affirm, Cash App Pay or Amazon Pay; the provider you choose handles that payment under its own terms. Whichever method you use, we receive the purchase information described above, not your full card number.
Some recipients process information for us; payment, advertising and other providers can also have their own legal obligations or purposes under their terms. We also disclose information where required by law or necessary to protect rights and safety. A business transfer may involve transfer of information; applicable privacy obligations and required notices continue.
International processing
Trellisbyte is in the United States. Information is processed in the United States and other countries where the relevant providers operate; those countries may have different data-protection laws. The safeguards applicable to a particular transfer depend on the provider, receiving entity, account and processing arrangement. You may contact privacy@systemsculpt.com for information about the destinations and safeguards applicable to your information. We do not claim that a provider's certification certifies Trellisbyte or that all services use the same transfer mechanism.
Retention and different copies
These are normal schedules or criteria, not promises that every device, processor, backup and failed cleanup is erased at precisely the same instant. Legal holds and required financial/security records may be retained separately. Contact us for a deletion request; a failure to clean up is not permission to retain information indefinitely.
| Information | Schedule or criteria |
|---|---|
| Account/license and usage/credit records | Used while the account is active; handled through account deletion, except justified legal/financial/security records |
| Purchase and accounting records | Retained according to applicable recordkeeping, tax, dispute and legal-hold requirements; no single universal seven-year law applies to every field |
| Renewal-consent evidence | Where California's rule applies, at least three years or one year after termination, whichever is longer |
| Server iPhone captures | Eligible for scheduled cleanup 30 days after server creation if not verified as delivered; seven days after the plugin acknowledges delivery otherwise |
| Desktop-agent handoffs | Handoff instructions, status, returned results and vault paths are removed with the source server capture under its deletion and cleanup schedule. Advertised vault/agent capabilities remain until forgotten or the account is deleted. Device and provider copies are separate |
| Server Ask replay records | 24-hour replay window, followed by scheduled cleanup |
| Local phone captures/notes | Remain on the device until removed; server expiry does not erase them. Recent Ask history is stored separately and cleared on sign-out/account deletion |
| Local recordings | When the app runs, recordings over seven days old become eligible for cleanup if no longer recording/queued/uploading; unsent recordings can remain longer |
| Watch recordings | Until the phone acknowledges saving them |
| Uploaded raw audio | Successful processing attempts deletion; jobs have a 24-hour expiry setting. Failed cleanup and distinct processing paths mean this is not a universal 24-hour destruction maximum |
| Audio Processor results | Delivery/status-dependent scheduled cleanup, ordinarily 30 days while awaiting delivery and seven days after confirmed delivery; shared artifacts can remain while required by another job |
| Other successful transcription artifacts | Separate from capture rows and Audio Processor results; no uniform automatic expiry is currently represented here. You may request their deletion |
| Hosted conversations | Some stored sessions expire after 30 days of inactivity; current agent histories do not all share that expiry. You may request deletion of retained history |
| Generated images/videos | Eligible for cleanup after delivery acknowledgment (normally 15 minutes) or seven days after completion if uncollected, with retry/processing safeguards |
| Uploaded documents | Source uploads are removed after processing; unfinished jobs become eligible for scheduled cleanup 24 hours after creation while still uploading, 15 minutes after their last update while finalizing an upload, or 72 hours after their last update while queued, processing, finalizing processing or in an error state. Extracted content is separate and may remain; you may request deletion |
| Failed-request diagnostic records | Scheduled 14-day retention; may contain request content |
| First-party server app events/capture facts | Scheduled 180-day retention from receipt/recording. Device queues and provider subscriber attributes are separate |
| Browser campaign attribution | Rolling 30-day expiry from the latest capture/update, subject to your consent and clearing choices |
| Sign-up attribution attached to an account | While the account exists; removed when you decline or withdraw measurement on the browser it came from or that browser sends GPC, and on account deletion |
| Support and email records | As needed for the correspondence, service records, disputes and applicable obligations; unsubscribe suppression records may remain to respect the choice |
| Encrypted database backups | Each night we copy our main database (account, billing and usage records and the content it holds, such as server captures and extracted document text), encrypt the copy before uploading it to a private cloud storage bucket, and schedule the copy to expire seven days after it is made. Information deleted from the live database, including by account deletion, can remain in earlier copies until they expire. If we restore data from a copy into the service, we first re-apply the deletions made since that copy |
Processor-held copies and backups have separate retention/deletion rules. We do not promise that deleting one app item immediately deletes every associated provider record or an Obsidian copy you control.
Your rights
You can request access, correction or deletion of your personal information at privacy@systemsculpt.com. We may verify identity using proportionate information. We respond within the applicable legal timeframe and explain any permitted extension or refusal. You can unsubscribe from marketing without stopping necessary account/purchase notices.
Deleting your account. Choose Delete account in the account menu of your website dashboard, or Account > Delete account in the iPhone app. This submits a request for account deletion; it is not instant erasure of every system and provider copy. You can also request deletion at privacy@systemsculpt.com, including if neither screen is available to you. Our account-deletion process sets a completion date 30 days after the request. Any legally required retained records or legally permitted extension are handled separately and explained to you; this policy does not reduce a deletion commitment already made to you. Deleting your account also stops a website subscription or recurring credit pack from renewing. Deleting the app or account does not cancel an App Store subscription: use iPhone Settings > Apple Account > Subscriptions. Signing out is not account deletion and does not necessarily erase local captures or provider customer records.
Depending on your location and the applicable law, rights include portability, restriction, objection (including to legitimate-interest processing), withdrawing consent, and opting out of sale, sharing, targeted advertising or certain profiling. Withdrawal does not affect the lawfulness of earlier consent-based processing. Authorized agents may make requests where the law provides for them. We do not unlawfully discriminate for exercising rights. If you disagree with a decision, reply to request review/appeal; you may also complain to your local regulator or data-protection authority.
Use Cookie settings for website measurement choices and GPC for the supported browser signal. Contact us if you need help applying an opt-out to your account. This explanation does not assert that every US state statute has the same coverage threshold.
Children
SystemSculpt is not directed to children under 13 and we do not knowingly collect their personal information. Contact us if you believe a child has supplied information so we can investigate and remove it as required. Where additional age/parental-consent protections apply, those protections remain applicable; this policy does not create a parental-consent signup process.
Security
We use encrypted transport and access controls intended to protect service information. Access by people and tools is for operating, supporting and securing the service. No system is perfectly secure. We give legally required incident notices when the applicable conditions are met.
Changes
We post changes with publication/effective dates and retain prior versions. For material changes affecting information already held, we provide appropriate advance notice and obtain consent where required. Posting a new policy does not authorize a materially different use of earlier information by itself.
Contact
privacy@systemsculpt.com · Trellisbyte LLC, c/o Northwest Registered Agent, Inc., 2108 N St Ste N, Sacramento, CA 95816, USA