Privacy Policy

Version 2026-07-22 (also the date this policy takes effect)

This policy explains what Aime collects, why, and what you can do about it. Aime is operated by 933 Consulting Group LLC, doing business as Prism, which is the controller of your personal data, at PO Box 8243, Midland, TX 79708. For any privacy question, contact andrew@933consulting.com.

1. What we collect

• Account data — username, password (stored only as an Argon2 hash, never in readable form), optional name, email address, time zone and display preferences, and the date and version of the terms you accepted.
• Your content — the conversations, notes, topics, events, files and images you put into Aime.
• Billing data — your subscription status, plan, and renewal dates. Card details are collected and held by Stripe; we never see or store them.
• Usage data — token counts and cost totals used to apply your plan's daily allowance.
• Security data — a log of unsuccessful and abnormal authentication events: failed sign-in attempts, account lockouts, signup throttling, and password resets, each with the time, the username tried, and the IP address it came from. Successful sign-ins are not logged. If you mark a device as trusted, we store a hash of that device's token, its browser user-agent string, and its expiry.
• Diagnostics — error records, and any feedback you choose to send.

We do not use tracking pixels, advertising identifiers, or third-party analytics.

2. Why we use it

• To provide the assistant and store your content.
• To take payment and manage subscriptions.
• To keep accounts secure, prevent abuse, and enforce usage limits.
• To fix faults and improve the service.
• To meet legal, tax, and accounting obligations.

If you are in the EEA or UK, our legal bases are performance of our contract with you (providing the service and billing), our legitimate interests (security, abuse prevention, fixing faults), and legal obligation (tax and accounting records).

3. AI processing

Answering you means sending the relevant parts of your conversation and stored notes to Anthropic, which processes them to generate a response and acts as our service provider under contract. Under Anthropic's commercial API terms, your inputs and outputs are not used to train their models, and are retained by them only for a limited period for abuse monitoring. See Anthropic's commercial terms and privacy centre for their current position.

If you use web search, Aime derives a search query from your request and submits it through Anthropic's server-side web search tool, which queries an external search provider on our behalf. Send only what you are content to have searched.

4. Encryption at rest

Your conversations and notes are encrypted on our servers under a key unique to your account. This protects your content if the storage media are compromised. It is not end-to-end encryption: the service can decrypt your content in order to run, so treat it as private-to-Aime rather than private-from-Aime, and please don't store passwords, card numbers, or other secrets you would not want a hosted service to hold.

5. Who we share it with

We do not sell your personal information, we do not share it for cross-context behavioural advertising, and we do not use it for advertising at all. We share it only with the service providers needed to run Aime:

• Anthropic — generating responses, and web search when you use it.
• Stripe — payments and subscription management.
• Amazon Web Services (United States) — hosting and infrastructure.
• [EMAIL PROVIDER] — verification codes and account email.
• Twilio — sending SMS messages, and only if you have set up message delivery and only for the messages you asked Aime to send you.

We may also disclose data where legally required, or to protect our rights, our users, or the security of the service. If the business changes hands, your data may transfer with it, subject to this policy.

6. International transfers

Aime is hosted in the United States, and our service providers may process data in the United States and elsewhere. If you are in the EEA or UK, your data is transferred outside your home country; where that happens we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) with the providers listed above.

7. How long we keep it

• Account data and your content — for as long as your account is active.
• After you delete your account — the account is deactivated immediately and stays recoverable for 30 days if you sign in again. After that it is erased: the row, your stored content, and every backup archive of it. We keep no copy, so a deletion past the 30-day window cannot be undone by us or by you.
• Security logs — authentication events are automatically deleted after 30 days.
• Trusted-device records — until the token expires or you revoke the device.
• Billing and tax records — up to 7 years, as tax law requires. Stripe keeps its own records under its own policy.

8. Your rights

You can do most of this yourself in the app: correct your details, export everything you have stored as a .zip, and delete your account.

Depending on where you live, you may also have the right to know what we hold about you, to have it corrected or deleted, to receive a portable copy, to limit how we use it, and not to be discriminated against for exercising any of these rights. We do not sell or share personal information, so there is nothing to opt out of. To make a request, contact andrew@933consulting.com from the email address on your account; we respond within 45 days, and will tell you if we need longer.

If you are in the EEA or UK you also have the right to object to or restrict processing, to withdraw consent, and to complain to your local data protection authority.

9. Cookies

We use a cookie to keep you signed in, and — only if you ask us to remember a device — a second cookie holding that device's trusted-device token. Both are strictly necessary for the service to work. There are no advertising, tracking, or third-party analytics cookies.

10. Children

Aime is for adults. You must be 18 or older to have an account, and we do not knowingly collect data from anyone under 18. If you believe a child has created an account, contact us and we will remove it.

11. Security

We encrypt account content at rest, store passwords only as Argon2 hashes, protect sign-in with a second factor by email, and rate-limit authentication. No service can promise perfect security; if a breach affects your personal information we will notify you and any regulator as the law requires.

12. Changes to this policy

If we make a material change we will notify you at the email on your account before it takes effect. The version line at the top tells you which revision you are reading.

13. Contact

andrew@933consulting.com
933 Consulting Group LLC, d/b/a Prism
PO Box 8243, Midland, TX 79708