Privacy Policy

Fastrepl, Inc. ("Char," "we," "our," or "us") makes Char, an AI notepad with an assistant, Charlie, that answers questions and takes action for you. This Privacy Policy explains what information we collect when you use the Char apps for Mac and mobile, the websites at char.com and its subdomains, and our related services (together, the "Service"), how we use it, who we share it with, and the choices you have.

If you have questions, email privacy@char.com.

The short version

• We don't sell your data, and we don't use it for advertising.
• We don't train AI models on your content. Charlie's model calls go through a provider router that we set to zero data retention, so the model providers don't keep your prompts or replies.
• Char is not end-to-end encrypted. Charlie works on your content in the cloud, so our systems can read it to provide the Service. Each person's cloud database is encrypted with its own key.
• Your content is yours alone. No one else, including an organization that pays for your plan, can read it through Char.
• You choose what Charlie can reach. Connected apps, Awareness, meeting recording, and location are each off until you turn them on, and you can turn them off at any time.
• By default, Charlie asks before critical actions: sending, publishing, paying, deleting, and writing to your connected apps.
• You can get a copy of your data or delete your account by emailing us (see Section 12).

1. Who we are and what this covers

Fastrepl, Inc., 2261 Market Street STE 85492, San Francisco, CA 94114, United States, is the controller of the personal information described in this Policy. Our representative in the European Union is Artem Savelev, Lisbon, Portugal (artem@fastrepl.com).

This Policy covers the information we handle as the provider of Char. It does not cover the services you connect to Char or the other agents you hand work to. Those providers handle your data under their own policies.

When an organization buys or manages Char plans for its people, the organization can manage billing and seats. It does not get access to your Pages, chats, or memory through Char.

2. Information we collect

We collect information in three ways: what you give us, what we collect automatically when you use the Service, and what we receive from other services you connect.

2.1 Information you give us

• Account information. Your name, email address, and sign-in details when you create an account with email and password, Google, or (on mobile) Apple. You need an account to use Char. We use your first name and email address for account, trial, and onboarding emails (Section 8).
• Profile and onboarding. What you tell Char about yourself, such as your role and goals, and the name and response style you choose for your assistant.
• Billing information. For paid plans, your billing name, address, and plan. Card numbers go directly to our payment processor and never touch our servers.
• Communications. Messages you send to support, survey replies, feedback, and reports you file about an AI response.
• Newsletter and waitlist sign-ups. Your email address and how you found us, if you sign up on our website.

2.2 Your content

"Your content" is everything you create in Char or that Charlie produces for you. It belongs to you, as our Terms of Service say.

• Your Library. Pages, daily notes, todos, people, organizations, meetings, reminders, and files you add. It is stored on your devices and synced to the cloud. Every plan includes sync; on the Free plan, sync covers one device.
• Chats with Charlie. Your messages, Charlie's replies, the steps Charlie takes, your approvals, and files Charlie produces.
• Schedules. Schedules you create or accept, and the results of their runs.
• Memory. On paid plans, Charlie builds memory from your chats, Pages, meetings, connected apps, Schedule runs, and Awareness. Memory is made of History entries that describe what you did, and what Charlie has learned about people, organizations, projects, and your preferences. The Free plan has no memory.
• Meetings and dictation. Audio you record or dictate, and the transcripts and summaries made from it (see Section 5).

2.3 Information we collect automatically

• Product usage. Events about which features you use and whether they worked, such as "page created" with its outcome and duration. We design these events to leave out your content. In Char desktop, usage and error sharing are on by default and you can turn them off in Settings. On mobile, they are off until you turn them on.
• Errors and crash reports. Error traces, crash dumps, app version, and device details, so we can find and fix bugs. We strip user details, request bodies, and headers from them.
• Device and log data. Operating system, app version, device identifiers, push notification tokens, IP address, latency, and service logs.
• Credit usage. How many credits and how much computer time your account uses, to enforce plan limits and bill you. For AI usage we record token counts, not the content of the request.
• Location. If you turn on precise location, Char desktop reads your Mac's location and turns it into a place name, so Charlie can answer location-aware questions. Otherwise Charlie only knows your time zone.
• Website analytics. When you visit char.com, we collect pages viewed, clicks, referrers, and approximate location derived from your IP address, without cookies. See Section 13.

2.4 Information from other services

• Sign-in providers. If you sign in with Google or Apple, we receive your name, email address, and an account identifier from them.
• Connected apps. When you connect a service such as Gmail, Google Calendar, Outlook, Slack, GitHub, Linear, Discord, or one of the many others Char supports, we receive the data you authorize. Section 4 explains what Char does with it, and covers Google data in detail.
• Other agents. When Charlie hands work to another agent at your request, we receive that agent's results.

3. How Charlie uses AI

Charlie is built on AI models from other companies. Here is how your content moves through them.

• Model providers. Charlie's model calls, including the ones that write memory, summarize meetings, and sort email, go through OpenRouter. OpenRouter routes each call to a provider that serves the model, such as Anthropic, OpenAI, Google, xAI, Mistral, DeepSeek, Moonshot AI, MiniMax, or Z.ai. Each call carries only the context that request needs.
• Zero data retention. We set every call through OpenRouter to zero data retention and to deny data collection, so the provider that serves it may not store or train on your prompts or replies. We do not offer models that cannot meet that requirement.
• Specialized AI vendors. A few tasks use vendors that run their own models: TypeSafe.ai for small, quick decisions (such as which Card a memory belongs on), and Yutori for planning the steps of browser tasks. They receive only what each task needs. TypeSafe.ai does not train or fine-tune on what it receives and keeps it only as long as it needs to provide its service. Yutori keeps task inputs and results while our account with it is active.
• On your device. Some tasks, such as naming chats on supported Macs, run on your device with Apple's on-device models and never leave it.
• Your own AI accounts. If you connect your own Anthropic or OpenAI API key, or your ChatGPT subscription, Charlie's calls go straight to that provider under your account and its terms. We store your key or token encrypted.
• No training. We do not use your content, or data derived from it, to train AI models. The model providers that serve Charlie may not train on it either: our OpenRouter settings deny it, and TypeSafe.ai's terms rule it out.
• Web search. When Charlie searches the web, the search query (without your name or account) goes to a search provider, which handles it under its own policy. Some search providers use queries to improve their services.
• AI can be wrong. Charlie's replies and actions are generated by AI and may be inaccurate. Charlie does not make decisions about you that have legal or similarly significant effects.
• Human review. People at Char do not read your content unless you ask us to (for example, by sending a support request or reporting a response), it is needed to investigate abuse or a security issue, or the law requires it.

4. Connected apps and Google user data

4.1 Connected apps

When you connect an app, Char and Charlie access the data you authorize to show it in Char (for example, email cards and upcoming meetings), to act on your requests, and, on paid plans, to build memory.

• Tokens. Sign-in tokens for connected apps are held by Nango, our integration broker, and every request Char makes to a connected app passes through it. Char's own database stores only a reference to the connection.
• Actions. Charlie asks before writing to a connected app, such as sending an email or creating an event, unless you have chosen otherwise in Settings.
• Disconnecting. You can disconnect an app at any time in Settings → Apps. For Google accounts, Char also revokes its access with Google. Disconnecting deletes the calendar events and the email cards still waiting for you, with their chats and related data Char stored from that connection. Email cards you already handled, dismissed, or archived stay until you delete your account; they keep no email content, only a reference to the thread. Memory already built from the connection is kept.
• Discord. When you connect a Discord server, Char's bot reads the channels and messages in that server. It cannot post.

4.2 Google user data

This section describes how Char accesses, uses, stores, shares, and deletes data it receives from Google APIs ("Google user data") when you connect Gmail, Google Calendar, Google Contacts, Google Drive, or Google Docs.

Limited Use. Char's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Char's use of raw or derived data received from Google Workspace APIs also adheres to the Google Workspace API User Data and Developer Policy.

What Char accesses. You choose the permissions when you connect, and you can connect more than one account.

• Gmail: read and organize your email (gmail.readonly, gmail.modify). You can also allow Char to create drafts (gmail.compose) and send email (gmail.send). Char does not request full Gmail access (mail.google.com), so it cannot permanently delete your email.
• Google Calendar: read your calendars and events (calendar.readonly), create and change events (calendar.events), and see your Google account's email address (userinfo.email) so you can tell connected accounts apart.
• Google Contacts: read your contacts (contacts.readonly), so Charlie can recognize the people in your email and meetings.
• Google Drive and Docs: find and read the files you ask Charlie about.

How Char uses it. Only to provide the features you see in Char:

• Email cards on Home. About every five minutes, Char checks your inbox for new mail. When you first connect, it looks at up to 25 unread messages from the last three days. For each new conversation it reads the sender, subject, and a preview of up to 280 characters, and shows it as a card.
• Upcoming meetings and reminders. About every fifteen minutes, Char reads the title, time, and status of events from 30 days ago to 90 days ahead on the calendars you show, to list your upcoming meetings and remind you before they start.
• Charlie. When you ask, or when a Schedule you set up runs, Charlie can search and read your email, calendar, contacts, and files, draft and send email, organize messages, and create or change events. Charlie reads a full message or file only when it opens that specific item.
• Memory. On paid plans, Charlie can record what an email or event was about in your memory.

How Char stores it. Google user data that Char keeps is stored in your own encrypted person database and synced to your devices. Your Google tokens are held by Nango.

How Char shares it. Only with the vendors in Section 9 that need it to run these features (Nango, our hosting and database providers, and our AI providers under zero data retention), with a third party at your direction (for example, the recipient of an email you ask Charlie to send), or as required by law. Char does not sell Google user data, does not transfer it to advertising platforms, data brokers, or information resellers, and does not use it for advertising or to determine creditworthiness.

No AI model training. Char does not use Google user data, or data derived from it, to develop, improve, or train generalized AI or machine-learning models, and does not allow the AI model providers that process it to do so.

Human access. No one at Char reads your Google user data unless you give us permission for specific data, it is necessary for security purposes, it is necessary to comply with the law, or the data has been aggregated and anonymized for internal operations.

Retention and deletion. Email cards keep their sender, subject, and preview until you clear the card. Calendar events are kept while they fall between 30 days ago and 90 days ahead. Disconnecting a Google account in Settings → Apps, or removing Char at myaccount.google.com/connections, stops Char from reading it; disconnecting in Char also deletes the events and the cards still waiting for you. Deleting your account deletes all of it (Section 12).

5. Meetings and dictation

• Meeting recording. When you record a meeting, Char desktop records the meeting's audio on your Mac. Char does not send a bot into your call. The audio is uploaded to Recall.ai, which transcribes it. Char then writes a summary with its AI models and stores the transcript and summary with the meeting in your Library. Recall.ai keeps the audio so you can play it back, until you delete it in Char or delete your account.
• Dictation. When you dictate, your audio is sent to Soniox (or, as a fallback, Deepgram) to be transcribed. To improve accuracy, Char can also send your custom dictionary and, if you turn on screen awareness for dictation, up to 6,000 characters of text read from your screen on your Mac. Char deletes the audio and transcript at Soniox as soon as it has the text, and opts out of Deepgram's model improvement program.
• Recording consent. You are responsible for getting consent from everyone you record, as required by the laws where you and they are. Some places require everyone's consent; others require notice or one person's consent. Char shows an indicator on your Mac while it records.

6. Awareness

Awareness lets Charlie remember your work on your Mac. It is available on paid plans, is off until you turn it on, and needs the macOS Screen Recording and Accessibility permissions (and, optionally, Input Monitoring).

• What it captures. The apps, windows, and websites you use, the text shown in them as macOS exposes it to accessibility tools, and whether text was typed or pasted. It does not take screenshots.
• What it skips. Password managers, secure input fields, and private browsing windows. Char also redacts text that looks like passwords, card or ID numbers, or health information. Apps and sites in sensitive categories (such as health, finance, accounts, email, social, and entertainment) are excluded by default, and you can exclude others or pause Awareness at any time.
• Where it goes. Raw activity is stored only on your Mac and is deleted after 24 hours. To write memory, Char sends excerpts of that activity to its AI models under zero data retention. Only the resulting History entries are stored in the cloud.

7. Charlie's computer

• Charlie's computer. On the Max plan, Charlie has its own cloud computer. Files Charlie keeps there, and the sites you or Charlie sign in to on it, persist between sessions. Its home folder is backed up with an extra layer of encryption. When Charlie hasn't used it for a while, the computer is paused and its memory is saved so it can resume where it left off.
• Computer use on your Mac. If you let Charlie use your Mac, it sees and controls only the apps you allow, and asks before critical actions.

8. How we use your information

We use your information to:

• provide the Service, including running Charlie, your Schedules, memory, and the features in Sections 3 to 7;
• sync your content between your devices;
• authenticate you and keep your account secure;
• process payments, manage plans and credits, and prevent fraud;
• send you transactional messages and notifications, such as account, billing, reminder, and approval notices, including a notice before your trial ends;
• send onboarding and tips emails while you start out, and product news and newsletters, unless you opt out;
• answer your questions and provide support;
• understand how the Service is used, fix bugs, and improve it, using usage events and error reports rather than your content;
• prevent abuse and enforce our Terms; and
• comply with the law.

Legal bases (EEA, UK, and Switzerland)

Our legitimate interests are running a secure, reliable product and improving it. They do not override your rights; you can object to them (Section 12).

9. How we share your information

We share information only as described here. We do not sell or rent your personal information, and we do not share it for cross-context behavioral advertising.

• Service providers. Vendors that run parts of the Service for us, listed below. Each may use the data only to provide its service to us.
• At your direction. When you connect an app, ask Charlie to act in another service (for example, to send an email), hand work to another agent, share a Page, or let an external AI agent read your shared Pages through Char's MCP connection.
• Legal reasons. To comply with a valid legal request, or to protect the rights, safety, or property of Char, our users, or the public. Where the law allows, we tell you first and push back on overbroad requests.
• Business transfers. In a merger, acquisition, or sale of assets, your information stays subject to this Policy, and we will tell you before it becomes subject to a different one.

Service providers

We may change these vendors as the Service evolves. We keep this list current and will tell you by email or in the app before a new vendor starts receiving your content.

Connected apps and agents you choose to use are not our service providers. Char exchanges data with them at your direction.

10. How long we keep information

We may keep information longer when the law requires it or to resolve disputes, prevent fraud, or enforce our Terms.

11. Security

• Your data is encrypted in transit with TLS and at rest in the cloud.
• Each person's cloud database is encrypted with its own key. That key is wrapped with a key in Google Cloud KMS, and deleting your account destroys it.
• Backups of Charlie's computer get an extra layer of encryption (AES-256-GCM) with a Google Cloud KMS key.
• Every record and file is tied to its owner, the owner always comes from your verified sign-in, and automated tests check that one person cannot read, list, change, or delete another's data.
• AI provider keys and subscription tokens you connect are stored encrypted.
• Our team's access is limited to what each role needs.

Copies of your content on your devices are not separately encrypted by Char. We recommend turning on disk encryption, such as FileVault on macOS. Char is not end-to-end encrypted, and no system is perfectly secure. If a security incident affects your information, we will notify you as the law requires.

12. Your choices and rights

Choices in the app

• Connected apps, Awareness, meeting recording, dictation, and location: turn each on or off in Settings.
• Usage and error sharing: turn off in Settings in Char desktop; on mobile, it stays off unless you turn it on.
• Push notifications: manage in Settings or your device's settings.
• Emails: unsubscribe from onboarding emails and newsletters with the link in any of them. We still send account and billing messages, such as the notice before your trial ends.

Your rights

Depending on where you live, you may have the right to:

• access the personal information we hold about you and get a copy in a portable format;
• correct inaccurate information;
• delete your account and personal information;
• object to or restrict some processing, including processing based on legitimate interests;
• withdraw consent at any time, without affecting processing before you withdrew it;
• appeal a decision we make about your request; and
• not be discriminated against for exercising these rights.

To make a request, email privacy@char.com with "Privacy Request" in the subject, from the email address on your account. We may ask you to verify your identity. You can use an authorized agent; we will ask for proof that the agent may act for you. We respond within the time the law requires, usually 30 days.

Delete your Char account

Email privacy@char.com from your account's email address with "Delete my Char account" in the subject, or tap Request account deletion in Char mobile under Settings → Profile, which opens that email for you. We may ask you to verify that the account is yours.

Within 30 days we delete your account and all cloud data: your Library, chats, memory, Schedules, files, meeting recordings and transcripts (including at Recall.ai), Charlie's computer, connected-app connections (including the tokens at Nango), connected AI subscriptions, your person database and its encryption key, and your sign-in identity at Stytch. Billing records stay for as long as tax law requires. Usage events and error reports are pseudonymous and are kept as Section 10 describes. Copies on your devices remain until you remove them.

13. Cookies and similar technologies

Our websites use only the cookies they need to work, such as the ones that keep you signed in and keep the site secure. We don't use advertising or cross-site tracking cookies.

To understand how the site is used, we count visits and feature use with PostHog. It runs without cookies or local storage, doesn't record your IP address, and doesn't record your session, so nothing is stored in your browser for analytics and there is nothing to opt in to. Because we don't track you across sites, we don't need to act on "Do Not Track" or Global Privacy Control signals for our own analytics, but we won't start tracking that would require them without updating this Policy first.

The Char apps don't use cookies for analytics. Section 12 covers turning off usage sharing in the apps.

14. Regional information

14.1 European Economic Area, United Kingdom, and Switzerland

Our legal bases are in Section 8. You can contact us at privacy@char.com or our EU representative, Artem Savelev, in Lisbon, Portugal, at artem@fastrepl.com. You also have the right to lodge a complaint with your local data protection authority. We'd appreciate the chance to address your concern first at privacy@char.com.

14.2 United States

If you live in California or another US state with a consumer privacy law, you have the rights in Section 12. In the last 12 months we collected the categories of personal information below, from the sources and for the purposes described in Sections 2 and 8.

We do not sell personal information or share it for cross-context behavioral advertising, and we have not done so in the last 12 months. We use sensitive personal information only to provide the Service you asked for, and not to infer characteristics about you.

15. International transfers

We are based in the United States, and our servers and most of our vendors operate there. If you use Char from elsewhere, your information is transferred to, stored, and processed in the United States and other countries where our vendors operate. When we transfer personal data out of the EEA, UK, or Switzerland, we use Standard Contractual Clauses, the UK addendum, or another valid mechanism.

16. Children

Char is not for anyone under 16, as our Terms of Service say. We do not knowingly collect personal information from children under 16. If you believe a child has given us personal information, contact us and we will delete it.

17. Changes to this Policy

We may update this Policy as Char changes. For material changes, we will tell you by email or in the app at least 30 days before they take effect. Before we use data from a connected app in a new way, we will ask for your consent. The date at the top of this page shows when this Policy last changed.

18. Contact us

Fastrepl, Inc. 2261 Market Street STE 85492 San Francisco, CA 94114 United States

Email: privacy@char.com Website: char.com