What we keep, and for how long.

Nothing is captured until every person in the conversation has consented to that conversation, on their own device. Not to the app, and not once. Either of you can pause or end it at any moment, and after a pause you both agree again before anything resumes.

Audio is deleted as soon as it has been turned into text. If transcription fails, the audio is kept for up to 24 hours so it can be retried, and then deleted whether or not it ever succeeded. There is no way to play a recording back — not for you, not for a therapist, and not for us. The product has no endpoint that returns audio at all.

The word-for-word transcript is temporary. It lasts 90 days by default, and either of you can shorten that on your own — shortening takes one of you, extending waits for both. When it expires it is gone, along with anything that quoted it directly.

What stays is the note: the record of what the conversation was about, written at the same moment as the summary, holding its own copy of the few sentences it needs. That is deliberate. The durable record of a difficult evening should be what the two of you learned, not every word you said while learning it.

The summary, the notes, the agreements and the good moments belong to both of you and are visible to both of you.

Your private reflection belongs only to you. Your partner cannot read it, and this is not a setting: it is stored in a separate table under a key their account cannot construct, with no permission that could ever be granted over it. There is no administrative view of it either.

The one moment your two reflections are read together. Before either reflection is published, an automated critic reads both at once, to check that they do not tell the two of you contradictory things about the same conversation. It returns a verdict and nothing else — no text from either reflection is stored, shown, or carried out of that check, and no person sees the pair. If the critic objects, neither reflection is published rather than one of you receiving something the other never will.

Sharing is a grant to one person you name, for a limited time, covering the specific conversations you chose. There is no way to share everything, and there is no link that shows anything on its own — the person you invite must sign in and enrol two-factor authentication before they can read a word.

Anything the two of you own together needs both of you to approve. Either of you can revoke access at any moment, and it takes effect on their very next request. Every time they open something, both of you can see that they did.

Either of you can delete a conversation, alone and immediately. A note the two of you had agreed on survives, because it belongs to both of you; removing that takes both. Deleting the whole relationship takes both of you as well — one asks, the other confirms, either cancels.

Deleting your account destroys the keys to your private material in the same second, which makes your reflections, your solo entries and your coach threads unreadable immediately — including in a backup taken a minute earlier. What the two of you built together stays with your partner while they are still there.

Deletion is never secret. Your partner is told that something was deleted, and never what it said.

There is no advertising in this product and no advertising code in it. There is no analytics vendor, no error-reporting vendor, and no third-party script of any kind — not one configured carefully, none at all. Your relationship is not an audience.

Shalom does not detect tone, volume, or anger, and there is nowhere in the system to record such a thing. Emotion appears only where one of you said it about yourselves.

We do not use your conversations to train models. Today that is a contractual term with the companies that process them, listed below, rather than a switch in your settings — and we would rather say that plainly than imply a control you do not yet have.

Running Shalom means handing parts of a conversation to a small number of companies. They are: Vercel (hosting), Neon (the database), Amazon Web Services (audio storage and the encryption keys), AssemblyAI (turning speech into text), Anthropic (the analysis), and Resend (sign-in codes and notices). Each is under a data-processing agreement with retention and training disabled where the vendor supports it.

Every email Shalom sends says the same sentence — that you have an update — because a subject line shows up on a lock screen, and what happens in your relationship is not something this product announces there.

Shalom is a reflection tool. It is not therapy, it is not emergency support, and it is not a system for deciding who is right. If you are in danger, it is not the thing to reach for; the safety page lists places that are.