Privacy Policy

Quick version

• Your fitness data lives ONLY on your device by default.
• If you set up Sarge backup, we hold an encrypted copy. We can't decrypt it.
• Squads are end-to-end encrypted group chats, and we can't read them. What your logs share into one is a set of switches, on until you turn them off. Calling @sarge sends the recent thread to the AI the same private way your chat goes.
• Chat and log extraction run inside attested confidential-compute enclaves — the operator can't see in.
• Our server doesn't keep your logs or your chats between requests.
• Your access is a random account number. No email, no password, no identity attached to it.
• Free or enlisted, the server keeps the same short list: a message count for the day (free) or the plan's spend so far (enlisted), and your push address if you let him text you.
• Meal photos are read in the enclave and not kept anywhere but your phone.
• No cookies. No ad networks. No selling. No profiling. Plausible for analytics.
• Delete anytime: you can wipe device, server backup, or both.

How this is different from what you're used to

Most fitness apps work like this:

• Your data sits on their servers in plaintext — staff and partners can read it
• You sign up with an email, name, often a phone number; everything is bound to that account
• Aggregated or "anonymized" health data is sold to advertisers, insurers, or employer wellness programs
• Your conversations and logs are used to train AI models
• Cookies and trackers follow you between sessions and across the web

Sarge:

• Your data lives on your device. The only things on our server are encrypted bytes we can't read — your backup blob if you opt in, and sealed squad messages if you join a squad.
• No identity. No email, no name, no phone number, no password. Your access is a random 16-digit account number; your backup is keyed by an ID your device derives from your recovery phrase or passkey. Neither one says who you are. (A card payment does put your email next to your account number at the payment processor; bitcoin doesn't.)
• Nothing about you is sold, shared, or licensed. Not in aggregate. Not "anonymized." Not at all.
• Your conversations don't train any model. They run through attested enclaves and are dropped after the response.
• No advertising. No retargeting. No cross-site tracking. Nothing follows you off this site.
• No automated decisions about you. No profiling in the GDPR Art. 22 sense.

What stays on your device

Everything. Every meal, workout, sleep entry, measurement, water log, step count. Your profile. Your missions. Sarge's notebook of facts about you. Your full chat history. Your saved favorites. Your squad keys and squad conversations. All of it.

Stored locally in your browser's IndexedDB. Protected the same way every other app on your device is.

What touches our server

Almost nothing. The server handles your request, forwards it to the enclaves, streams the reply back, and retains none of the message content. A short list of other things persists on disk — none of it your fitness data.

Push subscriptions (only if you let him text you)

If you let Sarge text you (on free, one set text in the evening; enlisted, up to three a day), your browser issues a push endpoint URL and we store it alongside the hours you picked, your timezone (so 07:00 means your 07:00), and your account number (so only devices with live access get woken). The part that matters: the push itself carries no content — it's a wordless wake-up. Your device then asks for Sarge's words the same private way chat works, and the server keeps none of it. Turn pings off and the whole record drops off our server.

Encrypted backup blobs (only if you set up Sarge backup)

Your device encrypts a snapshot of your data with a 256-bit AES-GCM key derived from a 12-word BIP-39 recovery phrase, or from a passkey on your phone. We store the encrypted bytes keyed by a UUID derived the same way. We cannot read it. We cannot link it to you. We cannot decrypt it. Rotate your key at any time.

One click in Settings → Delete data → "Delete server backup" wipes it.

Sealed squad messages (only if you join a squad)

Squads are private group chats between people who share an invite link. Every squad message is encrypted on the sender's device with a key that exists only inside that link — the link's key rides in a URL fragment, which browsers never send to servers, so we never see it. Our server works as a relay mailbox: it holds a short, self-trimming window of sealed messages (so members who were offline can catch up) and it cannot read them. There is no member list, no roster, no squad name on the server — just ciphertext under a random ID. Posting and reading carry no account number, so the server can't map which accounts are in a squad together. Creating a squad or a private DM does carry one, because starting them is paid, and so does calling @sarge (below).

Shared by switches: what reaches a squad from your logs — workout check-ins, streak milestones, your respect moving up or down, your sessions against your weekly commitment, missions you start or stop — is a set of switches, on until you turn them off. Never your meals, weights or measurements. If you summon Sarge into a squad thread (@sarge), your phone sends that squad's recent messages, its name and the members' names through our server to the AI, the same way your own chat goes: read in the enclave, kept nowhere. He sees only that squad's conversation — never your private file. Leave a squad and your copy leaves with you; the mailbox window trims itself automatically.

Your account number + invite codes

When you first open Sarge, the server hands your device a random 16-digit account number. That number is your whole identity here — there's no email, name, or password to attach it to. Next to it we keep billing housekeeping, nothing more: when it was created, how far its paid time runs, which invite or promo code it used, and whether its one-time offers have been used. On free we also keep today's message count, so the free limit holds. Enlisted, there's no daily count; instead we keep a running dollar total of what your plan has cost us to run this period (the fair-use limit in the Terms). It's a number, never what you said. Invite codes themselves are tickets — each one records a label, how many uses it allows, and how many are used. Codes count redemptions; they don't identify the people who redeemed them. None of this ever touches your fitness data — your logs, chats, and profile never reach the server in readable form in the first place.

Account rows aren't deletable from inside the app today, because deleting yours would erase any access time attached to it. Email us and we'll purge it.

Card payments are handled by a payment processor, which needs your card details and an email to process the charge and send receipts. We keep no copy of either. Pay in bitcoin over Lightning instead and there's no card and no email at all: we see a paid invoice and the account number it credits.

Meal photos (only if you send one)

A photo you send rides along with that message into the enclave, where Sarge reads it, and it isn't kept there or on our server. Your phone keeps today's newest photo so he can refer back to it; it never goes into your backup.

The front desk (only if you use the website chat)

The "Talk to Sarge" chat on these marketing pages is the one conversation that works like ordinary website chat — and it says so in the chat. It runs before you have an account, on a separate desk: it can't see your logs, your chats, or your account number, and nothing from the app ever touches it. We keep front-desk conversations (plus your email if you leave one, and the ordinary request data every website sees) so we can answer follow-ups and hear what recruits ask on the way in. Once you're enlisted, you talk to Sarge in the app — where everything above applies.

That's the whole list

Your logs are processed in memory, to score his respect and write his reply, and then dropped. Nothing you log is kept.

To hold the daily limits, the server also counts in memory how many requests each account number made today and what they cost. Never what was said, and gone on every restart.

What runs in attested enclaves

Sarge's replies, and turning your words and photos into log entries, both run inside hardware-attested enclaves. The company hosting them can't read what goes in or comes out: not in transit, not at rest, not while it's being processed.

Who can see your messages

• Our servers: only in memory, for the moment it takes to build the request and pass it on. Nothing stored, nothing logged.
• The enclave's operator: no. Their machines and their staff are cut off from the enclave's memory by the hardware itself.
• The network: no. Everything that crosses the internet is encrypted.

Where your message exists

In readable form, in three places: your device, our servers' memory for the seconds it takes to pass it on, and the enclave writing the reply. No copy survives the request. The enclaves are run by Privatemode (Edgeless Systems); their attestation, source and builds are public and independently auditable.

What you can verify, what you can't — yet

You can verify today: that your logs live on your device (open your browser's storage inspector and look); that your backup leaves your device already encrypted (watch the network tab); that the inference enclaves are what they claim (Privatemode's attestation and builds are public).

You can't verify: that our server keeps its no-logging pledge. It assembles your prompt in memory before the enclave takes over, and no architecture we ship today lets you audit that from the outside. We designed the server to hold nothing — but that's a claim, and we know the difference.

What closes the gap: moving the server itself into attested confidential hardware, so the same verification that covers the enclave covers us. We've scoped it; it's where this architecture is headed.

Your rights

• Delete it all. Settings → Delete data wipes device, server backup, or both.
• Export it all. Settings → Export Data dumps everything as plain JSON. You own it.
• Turn off pings. Settings → Notifications → OFF removes your push subscription from our server.
• Skip analytics entirely. Plausible never identifies you, but if you'd rather not be counted even in anonymous totals: most ad/content blockers already exclude you automatically. No blocker? Set localStorage.plausible_ignore = "true" in your browser console on drillsarge.ai and you're invisible to it.

EU (GDPR), California (CCPA / CPRA), and Washington (My Health My Data Act) residents — the rights above cover access, deletion, and portability obligations. Email [email protected] if you need a written record or want a more specific request handled.

Cookies and tracking

None. Sarge sets zero cookies — no banner because there's nothing to accept.

For analytics we use Plausible, a privacy-first system with no cookies, no fingerprinting, and no ability to follow you anywhere. All it ever shows us is anonymous, aggregate counts — how many people visited, which pages get read, roughly what country traffic comes from. That's how we know whether the landing page is doing its job without knowing anything about you. Inside the app, the server also keeps a few daily totals — how many people got a first read, how many free messages went through, how many free recruits were new or returning, how many reached the day's limit, and what the day's AI calls cost — as bare counts, with no account, device or person attached. Rather not be counted at all, even anonymously? Easy — see Your rights above.

Changes to this policy

We'll update this page as the app evolves. The "Last updated" date at the top of the policy reflects the most recent revision.

Contact

Email: [email protected]