Quick version
- Your fitness data lives ONLY on your device by default.
- If you set up Sarge backup, we hold an encrypted copy. We can't decrypt it.
- Squads are default-private: end-to-end encrypted group chats — you choose what you share with your squad, and we can't read any of it.
- Chat and log extraction run inside attested confidential-compute enclaves — the operator can't see in.
- Our server doesn't store, log, or retain anything about you between requests.
- Your access is a random account number. No email, no password, no identity attached to it.
- No cookies. No ad networks. No selling. No profiling. Plausible for analytics.
- Delete anytime: you can wipe device, server backup, or both.
How this is different from what you're used to
Most fitness apps work like this:
- Your data sits on their servers in plaintext — staff and partners can read it
- You sign up with an email, name, often a phone number; everything is bound to that account
- Aggregated or "anonymized" health data is sold to advertisers, insurers, or employer wellness programs
- Your conversations and logs are used to train AI models
- Cookies and trackers follow you between sessions and across the web
Sarge:
- Your data lives on your device. The only things on our server are encrypted bytes we can't read — your backup blob if you opt in, and sealed squad messages if you join a squad.
- No identity. No email, no name, no phone number, no password. Your access is a random 16-digit account number; your backup is keyed by an ID your device derives from your recovery phrase. Neither one says who you are.
- Nothing about you is sold, shared, or licensed. Not in aggregate. Not "anonymized." Not at all.
- Your conversations don't train any model. They run through attested enclaves and are dropped after the response.
- No advertising. No retargeting. No cross-site tracking. Nothing follows you off this site.
- No automated decisions about you. No profiling in the GDPR Art. 22 sense.
What stays on your device
Everything. Every meal, workout, sleep entry, measurement, water log, step count. Your profile. Your missions. Sarge's notebook of facts about you. Your full chat history. Your saved favorites. Your squad keys and squad conversations. All of it.
Stored locally in your browser's IndexedDB. Protected the same way every other app on your device is.
What touches our server
Almost nothing. The server handles your request, forwards it to the enclaves, streams the reply back, and retains none of the message content. A short list of other things persists on disk — none of it your fitness data.
Push subscriptions (only if you turn on pings)
If you opt into ping notifications, your browser issues a push endpoint URL and we store it alongside the hours you picked, your timezone (so 07:00 means your 07:00), and your account number (so only devices with live access get woken). The part that matters: the push itself carries no content — it's a wordless wake-up. Your device then asks for Sarge's words the same private way chat works, and the server keeps none of it. Turn pings off and the whole record drops off our server.
Encrypted backup blobs (only if you set up Sarge backup)
Your device encrypts a snapshot of your data with a 256-bit AES-GCM key derived from a 12-word BIP-39 recovery phrase. We store the encrypted bytes keyed by a UUID also derived from that same phrase. We cannot read it. We cannot link it to you. We cannot decrypt it. Rotate your key at any time.
One click in Settings → Delete data → "Delete server backup" wipes it.
Sealed squad messages (only if you join a squad)
Squads are private group chats between people who share an invite link. Every squad message is encrypted on the sender's device with a key that exists only inside that link — the link's key rides in a URL fragment, which browsers never send to servers, so we never see it. Our server works as a relay mailbox: it holds a short, self-trimming window of sealed messages (so members who were offline can catch up) and it cannot read them. There is no member list, no roster, no squad name on the server — just ciphertext under a random ID. We deliberately left your account number off squad requests, so the server can't even map which accounts are in a squad together.
Default-private, shared by choice: nothing from your logs enters a squad unless you put it there. If you summon Sarge into a squad thread (@sarge), he sees only that squad's conversation — never your private file. Leave a squad and your copy leaves with you; the mailbox window trims itself automatically.
Your account number + invite codes
When you first open Sarge, the server hands your device a random 16-digit account number. That number is your whole identity here — there's no email, name, or password to attach it to. Next to it we keep billing housekeeping, nothing more: when it was created, how far its paid access runs, which invite code admitted it, and whether its one-time offers — the intro week, the free first hello — have been used. Invite codes themselves are tickets — each one records a label, how many uses it allows, and how many are used. Codes count redemptions; they don't identify the people who redeemed them. None of this ever touches your fitness data — your logs, chats, and profile never reach the server in readable form in the first place.
Account rows aren't deletable from inside the app today, because deleting yours would erase any access time attached to it. Email us and we'll purge it.
Card payments are handled by a payment processor, which needs your card details and an email to process the charge and send receipts. We keep no copy of either. When Bitcoin top-ups land, paying that way will keep even that off the books.
The front desk (only if you use the website chat)
The "Talk to Sarge" chat on these marketing pages is the one conversation that works like ordinary website chat — and it says so right under the input. It runs before you have an account, on a separate desk: it can't see your logs, your chats, or your account number, and nothing from the app ever touches it. We keep front-desk conversations (plus your email if you leave one, and the ordinary request data every website sees) so we can answer follow-ups and hear what recruits ask on the way in. Once you're enlisted, you talk to Sarge in the app — where everything above applies.
That's the whole list
No processing. No analysis. No retention of anything you log.
What runs in attested enclaves
Both chat and extraction run inside hardware-attested enclaves. The hosting provider can't read what goes in or comes out — not in transit, not at rest, not while it's being processed.
How the connection works
Your data is encrypted in transit and processed on confidential-compute GPUs — the strongest commercially-available privacy architecture for AI inference. Once your data reaches the enclave, memory is encrypted, performance counters are disabled, and hardware firewalls cut off the host operating system, the hypervisor, and the hosting provider from inputs, outputs, and intermediate state.
What runs there
- Chat. Your message routes to the enclave, where a large language model generates Sarge's reply and streams it back.
- Extraction. A second enclave pass turns natural language ("I had eggs and toast") into structured log entries. Same hardware, same protections.
Who can see your messages
- Sarge's server: only briefly, to forward them. Nothing stored, nothing logged, nothing analyzed.
- The infrastructure operator: no. The host OS, hypervisor, and staff are cut off from the enclave's encrypted memory by hardware.
- The network: no. TLS encrypts every hop.
Why this is the strongest setup we can build
Hardware-attested enclaves are how you process data without giving the operator visibility into it. Sarge ships them today — not as a future roadmap item. Pair that with a stateless server (no storage, no logging) and the only places your message exists in plaintext are your own device and the enclave processing it. The hardware providers' attestation architecture is publicly documented and independently audited.
Your rights
- Delete it all. Settings → Delete data wipes device, server backup, or both.
- Export it all. Settings → Export Data dumps everything as plain JSON. You own it.
- Turn off pings. Settings → Notifications → OFF removes your push subscription from our server.
- Skip analytics entirely. Plausible never identifies you, but if you'd rather not be counted even in anonymous totals: most ad/content blockers already exclude you automatically. No blocker? Set
localStorage.plausible_ignore = "true"in your browser console on drillsarge.ai and you're invisible to it.
EU (GDPR), California (CCPA / CPRA), and Washington (My Health My Data Act) residents — the rights above cover access, deletion, and portability obligations. Email [email protected] if you need a written record or want a more specific request handled.
Cookies and tracking
None. Sarge sets zero cookies — no banner because there's nothing to accept.
For analytics we use Plausible, a privacy-first system with no cookies, no fingerprinting, and no ability to follow you anywhere. All it ever shows us is anonymous, aggregate counts — how many people visited, which pages get read, roughly what country traffic comes from. That's how we know whether the landing page is doing its job without knowing anything about you. Rather not be counted at all, even anonymously? Easy — see Your rights above.
Changes to this policy
We'll update this page as the app evolves. The "Last updated" date at the top of the policy reflects the most recent revision.
Contact
Email: [email protected]