Privacy Policy

1. In short

2. Data controller & Privacy Officer (PIPEDA & Quebec Law 25)

The organisation accountable for personal information under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec's Act respecting the protection of personal information in the private sector as amended by Law 25 (Bill 64), and (where applicable) the European Union and United Kingdom General Data Protection Regulation (GDPR / UK-GDPR) is:

• Legal Entity (Data Controller): Gestu Software Inc., incorporated in the Province of Ontario (Ontario Corporation No. 1001744733), with registered office at 175 Tancred St., Sault Ste. Marie, Ontario, P6A 2W5, Canada.
• Privacy Officer / Person in Charge of the Protection of Personal Information (Quebec Law 25, s. 3.1): Robert Bailey, Director, Gestu Software Inc. You can contact the Privacy Officer directly at privacy@gestu.ca.

3. On-device storage & what stays on your phone

Gestu requires no user account to install or use. By default, your personal assistant data resides locally on your Android device:

• Hardware-Backed Encrypted Credentials (EncryptedSharedPreferences): Your sensitive secrets—including BYOK provider API keys, your Gestu Pro virtual key and opaque licence token, IMAP/SMTP email passwords, your random per-install deviceId, and legacy migration keys—are encrypted at rest in gestu_secure_prefs using AES-256-SIV (for keys) and AES-256-GCM (for values), sealed by a master key held inside your phone's hardware-backed Android Keystore. This preferences file is excluded from Android cloud backup and device-to-device transfer.
• Local Conversation Database (conversations.db) & Sandbox Files: Your chat transcripts, attachments, memories, scheduled tasks, and Linux sandbox files (gestu-build-home/) are stored in your device's private application sandbox (/data/data/app.gestu.assistant*/). On Android, this directory is isolated from other apps by OS user-ID sandboxing and protected at rest by Android's system-level File-Based Encryption (FBE), rather than a separate application-layer SQLite cipher. Note on Android Auto Backup: Unless disabled in your Android system settings or excluded by build configuration, standard Android Auto Backup may back up non-credential app storage to your personal Google Drive backup account under Google's terms.
• User-Initiated Settings Exports: If you use the Export Settings feature, Gestu writes your selected settings (which may include API keys, email passwords, and conversations if you select them) as an unencrypted JSON file to the folder you choose. Protect exported JSON files carefully.
• On-Device AI & On-Device Voices: When you chat with a local LiteRT model or use Sherpa-ONNX neural text-to-speech, all computation happens on your phone's CPU, GPU, or NPU. Zero prompt or audio bytes leave your device.
• Zero In-App Telemetry or Ad SDKs: The Gestu Android app embeds no advertising SDK, no third-party crash-reporting SDK, and no behavioural analytics tracker.

4. Cloud AI: Managed Gestu Pro vs. Bring Your Own Key (BYOK)

When you choose to send a chat turn or tool result to a cloud AI model, how your data is handled depends entirely on whether you use Managed Gestu Pro or your own BYOK provider key:

Path B — Bring Your Own Key (BYOK — Direct to Your Chosen Provider):

• When you configure your own API key for any of the ~30 supported providers (such as OpenAI, Anthropic, Google Gemini, DeepSeek, Mistral, xAI, Groq, OpenRouter, Together, Fireworks, Perplexity, or a custom endpoint), your phone sends the request directly from your handset to that provider's API endpoint. Gestu's servers are not in the path.
• Your request is governed exclusively by that third-party provider's privacy policy, data-retention window, and jurisdiction.
• Important Warning Regarding Direct DeepSeek BYOK Keys: If you enter your own personal sk-... API key from DeepSeek's developer platform, your device connects directly to https://api.deepseek.com operated by Hangzhou DeepSeek Artificial Intelligence Co., Ltd. Under DeepSeek's own Privacy Policy, data sent to api.deepseek.com is transmitted to and stored on servers that DeepSeek operates itself, under DeepSeek's terms and the law of DeepSeek's home jurisdiction. Managed Gestu Pro is a separate route that does not use that key.

Path C — Optional Web, Scene Art & Tool Integrations: If you or the assistant invoke external tools during a conversation, only the data needed for that tool leaves your device: web_search sends the search query to DuckDuckGo Lite (lite.duckduckgo.com); fetch_url requests the target web page; get_location_from_ip queries ipwho.is; interactive story scene art requests a generated image from Pollinations (image.pollinations.ai) using a one-line scene description with no personal identifiers attached; email tools connect to your own configured IMAP/SMTP server; cloud read-aloud (if you configure an OpenAI TTS key) sends reply text to api.openai.com/v1/audio/speech; and MCP tools connect to the MCP server URLs you enable.

Total Privacy Mode: Switching on Total Privacy Mode in Gestu blocks all cloud AI routing and disables the daily FOSS update check, forcing all interaction onto local on-device models so no prompt can leave your phone.

5. Background Heartbeat & device permissions (opt-in disclosure)

Gestu includes a periodic background check-in feature called the Heartbeat, which can review your pending tasks and notify you when something needs your attention.

Permissions Split Between Sideloaded FOSS and Google Play Builds:

• Both Builds (app.gestu.assistant.foss & app.gestu.assistant): Request INTERNET (for cloud AI, model downloads, and tools), POST_NOTIFICATIONS (for reminders and task alerts), and—only when you invoke the relevant feature at runtime—RECORD_AUDIO (passed to Android's platform speech recogniser for voice dictation; Gestu never stores raw audio recordings), READ_CALENDAR / WRITE_CALENDAR, READ_CONTACTS / WRITE_CONTACTS, ACCESS_COARSE_LOCATION / ACCESS_FINE_LOCATION, and CALL_PHONE.
• Sideloaded FOSS Build Only (app.gestu.assistant.foss): Also supports optional, user-enabled permissions that Google Play restricts: READ_SMS / SEND_SMS (for assistant SMS tools and opt-in Heartbeat summaries), BIND_NOTIFICATION_LISTENER_SERVICE (for local and opt-in notification triage), BIND_ACCESSIBILITY_SERVICE (for user-consented Device Control screen automation, which hard-blocks banking, payment, and 2FA packages), and REQUEST_INSTALL_PACKAGES (to install APKs you build inside Gestu Build or signed Gestu updates). None of these four capabilities exist in the Google Play build.

6. Exact server-side data we hold

We collect and retain only the minimum server-side records necessary to sell and operate Gestu Pro, prevent credential abuse, send transactional emails, and comply with Canadian tax law:

• Purchase, Licence, & Activation Records (Cloudflare D1): When you subscribe to Gestu Pro, our entitlement database (`entitlements.gestu.ca`) stores your customer email address, Stripe customer ID, subscription ID, invoice/charge ID, plan tier (Founders US$99/yr vs. Standard US$149/yr), subscription status and period start/end timestamps, an HMAC-SHA256 hash of your activation code (never the plaintext code once fulfilled; a temporary checkout fulfillment row holds the code for up to 24 hours so `/welcome/` can display it once), and transactional email delivery state.
• Device Seat Bindings & Virtual Key Hashes (Cloudflare D1 & KV): When you claim or refresh a licence in the app, we record a random installation-specific deviceId, the SHA-256 hash of your minted virtual key (keyId), app package name and version, and seat first-seen/last-seen/released timestamps (enforcing the one-device limit). If you subscribe via Google Play, we store the SHA-256 hash of the Play purchase token and an obfuscated Play account ID.
• Monthly Cost-Metering Counters (Cloudflare Durable Objects): Our inference gateway (`pro.gestu.ca`) maintains one SQLite-backed LicenceMeter Durable Object per licence, storing your current calendar month's cumulative inference cost in micro-USD (µUSD), up to 2 concurrent stream leases, and your entitlement state. It contains only numbers and status flags — never conversation content.
• Pre-Launch Waitlist & Consent Records (Cloudflare D1): If you join our waitlist or opt in to product updates on gestu.ca, we record your email address, UTC timestamp, explicit consent boolean (consent: true), the exact version identifier of the consent wording shown to you (consentTextVersion), and the page/UTM source, as required to demonstrate express consent under Canada's Anti-Spam Legislation (CASL).
• Support & Legal Emails: If you write to support@gestu.ca, privacy@gestu.ca, or legal@gestu.ca, we hold your email address and the correspondence so we can assist you and maintain an audit trail of privacy/refund requests.
• Website Analytics (Cookieless Cloudflare Web Analytics) & Fonts: On gestu.ca, we use Cloudflare Web Analytics, which is privacy-first and uses no cookies, no localStorage, and no cross-site fingerprinting, collecting only aggregate page-view and performance metrics. Our web pages also load fonts from Google Fonts and animation scripts from jsDelivr CDN, which receive your browser's IP address in the ordinary course of serving those static files.

7. Sub-processors & cross-border data transfers

We never sell, rent, or trade your personal information. We engage the following third-party service providers (sub-processors) to operate Gestu and Gestu Pro:

• DeepSeek — Hangzhou DeepSeek Artificial Intelligence Co., Ltd. (provider and model may change):
  Role: Managed Gestu Pro AI inference (DeepSeek V4.1 Flash, api.deepseek.com).
  Data: Ephemeral chat completion requests (zero retention, zero training by Gestu).
  Location: Provider-owned infrastructure — country of processing not warranted.
• Stripe, Inc. / Stripe Canada / Link (stripe.com/privacy & link.com/privacy):
  Role: Merchant of Record (Stripe Managed Payments / Link) for web subscriptions on gestu.ca (`LINK.COM* GESTU`).
  Data processed: Payment card details, billing address, email address, IP location for tax calculation (GST/HST/QST/VAT), invoices, renewals, and refunds.
  Location: United States, Canada, and global Stripe payment infrastructure.
• Cloudflare, Inc. (cloudflare.com/privacypolicy):
  Role: Edge network, serverless compute (Cloudflare Workers), entitlement database (D1), key-value store (KV), quota state (Durable Objects), APK download storage (R2 at dl.gestu.ca), rate limiting, and cookieless Web Analytics.
  Data processed: TLS termination, IP addresses for DDoS/rate-limit protection, licence/quota records, and sampled Worker operational telemetry (status codes, execution timing, and truncated key hashes — never prompt bodies).
  Location: Canada, United States, and Cloudflare's global edge network.
• Resend / Plus Five Five, Inc. (resend.com/legal/privacy-policy):
  Role: Transactional email delivery service.
  Data processed: Customer email address and transactional email content (activation code delivery, welcome instructions, and service alerts).
  Location: United States.
• Web Hosting Canada (WHC.ca):
  Role: Corporate mailbox hosting for @gestu.ca email addresses (support@, privacy@, legal@gestu.ca).
  Data processed: Inbound and outbound support/privacy email messages.
  Location: Canada.

Cross-Border Transfer Notice (PIPEDA & Quebec Law 25, s. 17): While our corporate mailboxes are hosted in Canada, purchasing a subscription, receiving transactional emails, or routing through our edge gateway involves transferring billing, email, and network metadata outside your province (including outside Quebec) to the United States (Stripe/Link, Cloudflare, and Resend). Where personal information is processed in the United States or another foreign jurisdiction, it may be accessible to courts, law enforcement, and national security authorities of that jurisdiction under its local laws. If you use a BYOK provider, your prompts are sent to the country where that provider operates its servers.

8. Data retention & deletion

• Managed AI Prompts & Completions: 0 seconds after stream completion. Processed in volatile memory only and never written to disk or databases by Gestu.
• One-Time Checkout Activation Code Cache (checkout_fulfillments): Automatically expires and is purged 24 hours after purchase.
• Monthly Fair-Use Cost Counters: Reset on the 1st of each calendar month; historical monthly quota counters are pruned after 60 days.
• Device Seat Bindings: Released immediately upon manual release or licence deletion request, or automatically evicted when a seat has been idle for 14+ days and a new device claims a seat at the one-device limit.
• Purchase, Tax, & Accounting Records: Under the Canadian Income Tax Act and Canada Revenue Agency (CRA) rules, financial transaction and invoice records must be retained for six (6) years from the end of the last tax year to which they relate. Upon a data deletion request, we immediately delete your device bindings, virtual keys, and active entitlement tokens, and retain only the minimum statutory accounting ledger required by tax law.
• Waitlist Consent Records: Retained while you remain subscribed to updates, and archived in minimal suppression/audit form for up to 3 years after unsubscribing solely to demonstrate CASL compliance and honour your opt-out.

For step-by-step instructions on deleting both local on-device data and server-side licence records, see our rights section below or email privacy@gestu.ca with the subject [DATA DELETION REQUEST].

9. Your privacy rights (PIPEDA, Quebec Law 25, & GDPR / UK-GDPR)

Regardless of where you live, we extend strong privacy rights to every user:

• Right of Access & Portability: You may request a copy of the personal information we hold about you (such as your licence record, device bindings, and waitlist consent record) in a structured, commonly used electronic format.
• Right to Rectification (Correction): You may ask us to correct any inaccurate or incomplete personal information we hold.
• Right to Erasure / Deletion ("Right to be Forgotten" / De-indexing):
  • On your device: Delete any conversation, memory, or file directly inside Gestu, or wipe all local data immediately via Settings → Developer → Reset Data or Android's Settings → Apps → Gestu → Storage & cache → Clear storage.
  • On our servers: Email privacy@gestu.ca with your checkout email address, activation code, or Device ID. We will revoke and purge your virtual keys, device bindings, and active profile data within 7 business days (and always within the statutory 30-day maximum), retaining only records strictly mandated by Canadian tax law.
• Right to Withdraw Consent: You may withdraw consent to cloud AI routing at any time by switching to an on-device model or enabling Total Privacy Mode; withdraw consent to Heartbeat sources by toggling off SMS, notifications, or email in Settings; and withdraw marketing/waitlist consent at any time by clicking the unsubscribe link in any email or writing to privacy@gestu.ca.
• GDPR / UK-GDPR Legal Bases (for EEA, Swiss, & UK Users): Where the GDPR or UK-GDPR applies, we process personal data on the following lawful bases under Article 6(1): (a) Performance of a contract (Art. 6(1)(b)) to issue activation codes, verify entitlements, and route Gestu Pro requests; (b) Explicit consent (Art. 6(1)(a)) for the one-time Gestu Pro cloud disclosure, opt-in Heartbeat sources, and waitlist emails; (c) Legal obligation (Art. 6(1)(c)) for tax and accounting retention; and (d) Legitimate interests (Art. 6(1)(f)) to protect our endpoints against credential stuffing, fraud, and quota abuse. You also have the right to restrict or object to processing.
• Regulator Complaints: If you are unsatisfied with our response to a privacy concern, you have the right to contact the Office of the Privacy Commissioner of Canada (OPC) (priv.gc.ca), Quebec's Commission d'accès à l'information (CAI) (cai.gouv.qc.ca), or your local EEA/UK data protection supervisory authority.

10. Security & breach notification

We protect data through defence-in-depth engineering:

• Cryptographic Hashing of Secrets: Activation codes are stored as HMAC-SHA256 hashes with a server-side pepper; virtual keys and Play tokens are stored as SHA-256 hashes. Even if our database were inspected, raw keys cannot be reconstructed.
• Hardware-Backed Local Keystore: On-device API keys and virtual keys are sealed in EncryptedSharedPreferences backed by the Android Keystore.
• Transport Security: All connections to gestu.ca, entitlements.gestu.ca, pro.gestu.ca, and dl.gestu.ca use HTTPS / TLS 1.3. (Note: if you manually configure a custom http:// endpoint for a local LAN server in BYOK settings, traffic to that custom `http://` address is unencrypted.)
• Privacy Incident & Breach Notification: We maintain a security incident register in accordance with PIPEDA and Quebec Law 25. If a confidentiality incident or security breach involving personal information in our custody creates a risk of serious injury (or a real risk of significant harm), we will promptly notify affected individuals, the Office of the Privacy Commissioner of Canada, the Commission d'accès à l'information du Québec (where applicable), and any other required regulator.

11. Children's privacy

Gestu is not directed to children under the age of 14 (or under 16 in the European Economic Area and jurisdictions with a higher digital age of consent). In accordance with PIPEDA and Quebec Law 25 (which requires parental consent for collecting personal information from minors under 14), we do not knowingly collect personal information from children. If you believe a child has provided personal information to us, please contact privacy@gestu.ca and we will promptly delete it.

12. Changes to this policy

If we make material changes to this Privacy Policy—including any change to our managed inference provider, its model or its region or the categories of data we process—we will update the effective date at the top of this page and provide prominent notice in the app or by email before the change takes effect.

13. Contact & Privacy Officer