Privacy Policy

1. Introduction

Teach P2P Pty Limited ("iSpirits", "we", "our", or "us") operates the iSpirits Cloud platform at ispirits.cloud (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our Service.

We are committed to protecting your privacy and complying with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), the EU General Data Protection Regulation (GDPR), and applicable privacy legislation in all jurisdictions where we operate.

By creating an account or using our Service, you acknowledge that you have read, understood, and agree to the practices described in this Privacy Policy.

2. Information We Collect

2.1 Information You Provide Directly

• Account Information: Username, email address, and password (stored as a one-way bcrypt hash — we never store your password in plain text)
• Profile Information: Display name, profile picture, date of birth, gender, country, and preferences
• Chat Content: Messages and conversations with your iSpirit
• Goals, Plans and Tasks: The goals you set, the tasks and dates in your plans, the answers you give in guided wizards, decisions you put on record, and figures you enter if you keep a balance sheet
• Journal Entries: Written and voice-recorded reflections, including mood scores, gratitude notes, and insights
• Timeline Events: Life events, milestones, and achievements you record
• Habits and Routines: Habit check-ins, streaks, numbers you log, and priority settings
• Files and Photos: Anything you upload — attachments in chat, media in your journal, documents you import, and a photo for your iSpirit's avatar if you choose to give one
• Email You Forward: If you set up your private forwarding address, the messages you send to it — sender, subject, text, attachment names and the text of PDF attachments
• Shared Spaces: What you post in the community forum, mission rooms, shared journals and the family view
• Legacy Contact: If you use Legacy Mode, the name and email address of the person you nominate. It is kept as a record of your wishes; we do not contact them
• Health Information: Medical history, allergies, medications, and mental health notes you choose to provide (see Section 2.4)
• Voice Data: Audio recordings submitted through voice journaling and chat features, which are transcribed and then deleted from our servers within 24 hours
• Feedback: Bug reports, feature requests, and support messages

Your iSpirit also produces information about you from what you share: plans, results, reviews, and the memory and profile it keeps (Section 4).

2.2 Information Collected Automatically

• Usage Data: Pages visited, features used, and session duration
• Device Information: Device type, operating system, browser type, and the time zone your browser reports
• Log Data: Server request logs (IP address, request timestamps, error codes), retained for up to 90 days for security and debugging
• Notification Address: If you allow notifications, the address your browser gives us to deliver them to that device
• Cookies: Session cookies for authentication and preference settings (see Section 9)

2.3 Information from Third Parties

• Google Sign-In: If you sign in with Google, we receive your name, email address, and profile picture from Google. We do not receive your Google password.
• Services You Connect: If you connect GitHub, Notion or Google Calendar, we read the items you authorised — repository activity, pages, calendar events — when you or your iSpirit use them. We store the access grant (encrypted), not a copy of your whole account there.
• Stripe: Your plan, your payment status and a customer reference — never your card details.
• Other Members: What other people share with you in a mission room, shared journal or the forum.

2.4 Sensitive Information

Our Health Profile feature allows you to voluntarily provide health information including medical conditions, allergies, medications, and mental health notes. This information is classified as sensitive information under the Privacy Act 1988 and as special category data under the GDPR.

Additionally, the nature of conversations with a personal AI companion may lead you to incidentally share sensitive information — including emotional states, family matters, health concerns, religious beliefs, or end-of-life wishes. We do not actively solicit sensitive information, but we acknowledge that it may arise naturally in your reflections. Any sensitive information shared in conversations is:

• Processed solely to generate personalised AI responses and deliver the Service
• Never used for marketing, advertising, or profiling
• Subject to the same security and access-control protections as all other data
• Covered by the same contractual protections with our AI providers

By continuing to share such information after reading this notice, you provide your explicit consent under the Privacy Act 1988 and GDPR Article 9(2)(a).

The following applies to Health Profile data:

• We only collect this information with your explicit consent (you actively choose to fill in the Health Profile form, which says how it is used before you save)
• Health data is used solely to help your iSpirit provide more relevant, health-aware support. To do that, a summary of it becomes part of the profile your iSpirit works from (your Life Spec), which is processed by the AI providers in Section 5 under the same terms as your conversations
• Health data is never used for advertising, never sold, and never given to insurers, employers or data brokers
• You can clear your Health Profile at any time, and it is removed when you delete your content or your account. Your Life Spec is rebuilt without it the next time it refreshes

3. How We Use Your Information

3.1 Providing the Service

• Generating your iSpirit's replies based on your conversations and what it knows about you
• Planning your goals and doing digital work for you in the background — plan runs, the nightly review of your goals, and a check of each result before it reaches you
• Storing and displaying your goals, tasks, journal entries, timeline events, and habits
• Calculating insights, mood trends, and habit analytics
• Growing your iSpirit, and the memory it keeps, based on your interactions
• Enabling voice input by transcribing audio recordings, and reading replies aloud
• Using the services you connect, for the tasks you set

3.2 Improving the Service

• Analysing aggregate, anonymised usage patterns to improve features
• Fixing bugs and monitoring system performance
• Checking quality: an automated check, run on the AI providers in Section 5, re-reads a sample of finished results each night to catch faults in our own instructions. It looks for defects in the Service, not at you, and it does not train any model
• Developing new features based on aggregate user needs

We do not use your personal journal entries, chat messages, or health data for marketing purposes or advertising, and we do not use them to train AI models — ours or anyone else's — unless you choose to donate them (Section 3.5).

3.3 Communications

• Sending account-related notifications (password resets, security alerts)
• Sending the messages you switch on — for example a morning report, reminders, or a weekly summary — which you can switch off in your settings
• Responding to support requests
• Sending product updates (you can opt out at any time)

3.4 Security and Legal Compliance

• Protecting against fraud, abuse, and unauthorised access
• Complying with legal obligations (e.g., responding to lawful court orders)
• Enforcing our Terms of Service

3.5 Donate My Data (Optional)

Under Profile → Data & privacy you can switch on Donate my data. If you do, you allow us to use what you have shared to improve the Service for other people. It is off unless you turn it on, you can turn it off at any time, and turning it off stops any further use. We will describe a specific use on this page before it starts; as of the date at the top of this policy, nothing in the Service draws on donated data.

4. AI Companion Disclosure

Your iSpirit is an artificial intelligence. It is not sentient, conscious, or human. Its personality is configured by software, not autonomous. While it remembers your conversations and learns your preferences, it does not have feelings, opinions, or experiences of its own.

Your iSpirit keeps a memory of what you share: short notes, and a profile of your values, interests and communication style (your Life Spec), stored in our database together with the search indexes built from them. It is used solely to personalise the Service for you. The relevant parts are included in what is sent to our AI providers when your iSpirit works for you (Section 5); it is never sold, and never shared with anyone else for their own purposes. You can ask us to correct or delete it, and deleting a chat or journal entry deletes the memory built from it.

iSpirits Cloud is not a healthcare service, mental health treatment, or substitute for professional advice of any kind.

4.1 Automated Decision-Making

We use computer programs, including AI, to do the work of the Service: to draft replies, plans and results; to choose which task to work on next and when; to pick which memories are relevant; and to apply usage limits such as plan-run allowances and daily caps. They use the information described in Section 2.

None of these is a decision we would expect to significantly affect your rights or interests, and no decision producing legal or similarly significant effects about you is made solely by automated means. Your iSpirit's plans and suggestions are yours to accept, edit or ignore; limits reset on their own; and a decision to suspend or close an account is made by a person and can be appealed (Terms, Section 12). If that ever changes, we will say so here first.

5. AI Processing and Third-Party Providers

Your iSpirit's replies, plans and results are generated by AI models that other companies run. To do that work, the content each step needs is sent to them. This section says what is sent, what never is, and who receives it.

5.1 What Data Is Sent

• In conversation: your message and the recent conversation; the parts of what your iSpirit knows about you that are relevant to it (memories, your Life Spec, goals, tasks, habits, journal entries); and any file or photo you attach
• Background work: when your iSpirit plans, carries out a plan run, reviews your goals overnight or checks a result, it sends the goals, tasks and context it is working on. This happens whether or not you are signed in at the time — it is how the Service works for you in the background
• Things you connect: when you or your iSpirit use a connected service — a calendar, a repository, a notes workspace, the email you forwarded — the items read for that task
• Health Profile: if you have filled it in, a summary of it is part of the profile your iSpirit works from (Section 2.4)
• Voice: what you dictate, and the text to be read aloud, when you use those features
• Pictures: the description used to draw a picture for a goal, a habit or your iSpirit

5.2 What Data Is NOT Sent

• Your password or sign-in credentials
• Your payment card details — we never hold them (Section 6.1)
• The access keys of the services you connect — they are stored encrypted and used only to call that service
• Your whole account at once — each step is sent what that step needs

5.3 Our AI Providers

As of 11 November 2026:

• Conversation, the photos you send in it, and the guided-wizard judge run on Google Cloud Vertex AI (Gemini models, Google's global infrastructure). If Google is slow or unavailable, the reply comes from Amazon Bedrock instead.
• Planning and background work — plan runs, the nightly review of your goals, and result checks — run on Anthropic Claude (United States, under Anthropic's commercial terms).
• Helper and judging steps run on OpenAI (United States).
• Amazon Web Services (Amazon Bedrock) drafts guided-wizard prefills, is the conversation backup, and runs Cohere models for search embeddings and ranking. The models it runs for us come from Anthropic, Amazon, Mistral and Cohere. The Sydney (Australia) region is the primary endpoint; the search steps run in other AWS regions, including the United States.
• Pictures for your goals, habits and iSpirit are drawn by Google Cloud Vertex AI (Gemini image and Veo models, Google's global infrastructure), which also, for accounts invited to the avatar mood-clip preview, processes the avatar image and its portrait reframe. Profile images are edited on our own hardware.
• Read-aloud voice: when you switch on the natural voice, replies are read aloud by Google Cloud Text-to-Speech (processed on Google's global infrastructure), with Amazon Polly (Sydney region) as the fallback.
• Dictation: on a paid plan, what you dictate with the microphone is transcribed by AssemblyAI (EU region); we delete the recording and transcript from AssemblyAI as soon as the text comes back. On the Free plan, dictation uses the speech recognition built into your browser, which your browser's maker provides under its own terms.

Under our agreements with Anthropic, OpenAI, Amazon Web Services and Google:

• Your data is processed solely to generate AI responses for you
• These providers do not use your data to train or improve their AI models
• Data is transmitted over encrypted connections (TLS 1.2+)
• Data is not retained by these providers beyond short abuse-monitoring windows (up to 30 days for some providers), and is never used to train their models

When a provider or the step it handles changes, we update this section and the table in Your data, plainly the same day and record the change in Section 15. If we add a provider that is not on this list, we will also notify you.

5.4 We Never Sell Your Data

We do not sell, rent, or trade your personal information to any third party, for any purpose, ever. This applies to all data categories, including data processed by AI providers.

6. Other Information Sharing

6.1 Service Providers

We use the following service providers. Each handles your information under a contract or terms that limit what it may do with it:

• Cloud infrastructure: servers hosted in Australia (our own hardware)
• AI processing: Google Cloud Vertex AI (conversation, the guided-wizard judge, and pictures; global infrastructure); Anthropic (planning and background work); OpenAI (helper and judging steps); Amazon Web Services / Amazon Bedrock (guided-wizard drafts, the conversation backup, and Cohere models for search; Sydney region primary, with some processing in other regions including the United States); Google Cloud Text-to-Speech (natural voice; global infrastructure) and Amazon Polly (voice fallback; Sydney region); AssemblyAI (voice input; EU region) — see Section 5.3 for what each one handles and Section 11 on international transfers
• Payments: Stripe — your card details are collected and stored by Stripe, never by us; we receive only the payment status and a customer reference
• Transactional email: Resend (password resets, invitations, receipts, alerts you opt into)
• Email you forward (only if you set it up): Cloudflare receives the messages you send to your private forwarding address and hands them to us
• Web search: Brave Search — when you ask your iSpirit to look something up, only the short search query leaves our systems, never your goals, journal or chat
• Notifications (only if you allow them): the push service run by your browser's maker delivers the notification to your device
• Messaging (only if you connect it): Telegram — your morning message (task titles, questions, decision options) and your replies pass through and are stored by Telegram; not end-to-end encrypted
• CDN and security: Cloudflare (DDoS protection and content delivery)
• Our own mailboxes: email you send to our support, privacy, legal or security addresses is held by our business email host

Error tracking stays in-house: when something breaks, the crash report is sent to error-tracking software we run on our own hardware — not to a third-party service — and it is scrubbed of request content before storage.

6.2 Legal Requirements

We may disclose information when required to:

• Comply with a lawful court order, subpoena, or government request
• Protect the rights, property, or safety of iSpirits, our users, or the public
• Prevent fraud or enforce our Terms of Service

We will notify you of any government request for your data unless legally prohibited from doing so.

6.3 Business Transfers

If Teach P2P Pty Limited is involved in a merger, acquisition, or asset sale, your personal information may be transferred. We will provide notice before your data is transferred and becomes subject to a different privacy policy.

6.4 Connected Apps

You can let an AI tool you already use — such as Claude Desktop or Codex — read and act on your own goals, tasks and journal, through access you approve and can revoke at any time under Profile → Connected apps. You choose which of those it can see and change. A connected app can never read your Life Spec, your iSpirit's memory of you, your chat history, or your wizard intake answers — there is no code path that returns them. What it can read is bounded to the goals, tasks and journal entries you've granted it: if something your iSpirit already wrote to your journal was shaped by your Life Spec or memory, a connected app with journal access sees that entry the same way you do on your own journal page — not the source it was built from, but not nothing either. Once something leaves iSpirits Cloud through a connected app, it is handled by that app's own provider under their own terms, not ours. The same is true of a tool server you add for your iSpirit to use: what your iSpirit sends it when using its tools is handled by that server's operator.

6.5 People You Share With

What you post in the community forum, a mission room, a shared journal or the family view is visible to the people that space is shared with. Your iSpirit loads only your own memory in a shared space — never another member's.

7. Data Security

• At rest: Your data is stored on our own access-controlled infrastructure (not third-party cloud storage); credentials and secret keys are encrypted
• Encryption in transit: All connections use TLS 1.2 or higher
• Password security: Passwords are hashed using bcrypt with salt rounds
• Access controls: Access to personal data by our staff, and by the automated tools we run to operate the Service, is restricted to what is needed to run and support it
• Regular audits: We conduct regular security reviews of our infrastructure
• Incident response: We have procedures in place to detect, report, and respond to data breaches within 72 hours as required by the GDPR and Australian privacy law

We comply with the Notifiable Data Breaches (NDB) scheme under the Privacy Act 1988. In the event of a data breach that is likely to result in serious harm, we will notify affected individuals and the OAIC within 72 hours of becoming aware of the breach.

8. Data Retention

9. Cookies

We use a minimal set of cookies and browser storage:

We do not use analytics cookies, advertising cookies, or tracking pixels. We do not use Google Analytics or any similar tracking service. If you sign in with Google, Google's sign-in button may set Google's own cookies.

Our landing page sends us anonymous counts — page loaded, scrolled halfway or to the end, a button pressed — so we can tell whether visitors read it. No cookie, identifier or IP address is stored with these counts, and they cannot be linked to you.

More detail is in our Cookie Policy.

10. Your Rights

10.1 All Users

Regardless of where you live, you have the right to:

• Access your personal data (export via account settings or by request)
• Correct inaccurate personal information, including what your iSpirit remembers about you
• Delete your data (individual items or your entire account)
• Object to processing of your personal information
• Withdraw consent at any time for optional data collection (e.g., Health Profile)

10.2 Australian Privacy Act Rights

Teach P2P Pty Limited complies with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). As an Australian resident, you additionally have the right to:

• Lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au if you believe we have breached the APPs
• Request access to your personal information held by us free of charge
• Not be disadvantaged for exercising your privacy rights

10.3 European Union / EEA (GDPR)

If you are in the EU or EEA, you have additional rights under the General Data Protection Regulation:

• Right to data portability — receive your data in a structured, machine-readable format
• Right to restrict processing — limit how we use your data
• Right to erasure ("right to be forgotten")
• Right to object to automated decision-making — our AI features do not make legally binding decisions about you
• Right to lodge a complaint with your local data protection authority

Legal basis for processing: We process your data under Article 6(1)(b) (contract performance) for core service features, and Article 6(1)(a) (consent) for optional features like the Health Profile. For sensitive health data, we rely on Article 9(2)(a) (explicit consent).

10.4 California (CCPA/CPRA)

If you are a California resident:

• You have the right to know what personal information we collect and how it is used
• You have the right to delete your personal information
• You have the right to opt out of the sale of personal information — we do not sell personal information
• We will not discriminate against you for exercising your privacy rights

10.5 Exercising Your Rights

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days (or sooner where required by law). We may ask you to verify your identity before processing your request.

10.6 If Someone Else Shared Information About You

People sometimes write about others in a journal, a shared space or an email they forward. If you believe your personal information is on iSpirits Cloud without your agreement, contact [email protected] and we will look into it and, where the law requires or it is fair to do so, remove it.

11. International Data Transfers

Your data is primarily stored on servers located in Australia. When data is sent to AI providers (Google Cloud, Anthropic, OpenAI, Amazon Web Services / Amazon Bedrock and Amazon Polly, and AssemblyAI) for processing, it may be temporarily processed on servers outside Australia — including where a nominally Australian endpoint routes through a provider's global infrastructure. Payment processing (Stripe), transactional email (Resend), web search (Brave Search), and CDN/security and email forwarding (Cloudflare) also involve processing outside Australia, primarily in the United States. If you connect Telegram, your morning message and your replies are also processed and stored by Telegram outside Australia.

The countries involved are mainly the United States and, for dictation, the European Union; Google's and Cloudflare's networks may process a request in whichever of their regions is nearest or available.

For transfers outside Australia:

• We take reasonable steps to make sure each recipient handles your information consistently with the Australian Privacy Principles: we use providers whose terms commit them to confidentiality, to security, and to using your information only to provide their service to us
• We remain responsible to you for what those providers do with your information on our behalf
• For personal data covered by the GDPR, those terms include the standard contractual clauses approved by the European Commission where they are required

12. Children's Privacy

iSpirits Cloud is for adults. You must be at least 18 years of age to use the Service — registration includes an age confirmation. We do not knowingly collect personal information from anyone under 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at [email protected] and we will delete the information.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Post the updated policy on this page with a new "Last Updated" date
• Notify you via email (if you have provided an email address)
• Display a notice within the Service
• Record the change in Section 15

Your continued use of the Service after a change becomes effective constitutes acceptance of the updated Privacy Policy. If you disagree with a change, you may delete your account.