Privacy

What the portal stores

• Your account. Your email address, your name if you gave one, and whether your access is approved. You can use a password, an email sign-in link, or a connected sign-in provider. Supabase Auth stores a secure hash of your password, not the password itself.
• What you do here. Which calls you open and download, what you search for, and which source links you click. This is how we can tell that a feature is used, or that a question keeps being asked and never answered. When you follow a highlighted moment we keep the call, the timestamp, whether you jumped inside the transcript or opened the recording, and whether you came from the home page or from the call itself.
• That you signed in, and when. When sign-in works we record the time and method against your account. Separately, your device list stores the browser and operating system family so you can see and end your sessions. We do not store raw browser details or IP addresses in that list. This is how we can tell that somebody cannot get in from somebody who got in and found nothing worth reading.
• Questions you ask, and the answers you get. The question, which transcript excerpts were retrieved, and the answer text. We read these to find where the library is thin. They are visible to Elijah and Kabrin, and to nobody else.
• Which pages get used, counted and not tied to you. Vercel Web Analytics counts page views and load speed for each kind of page, with no cookies and no cross-site identifier, and none of it is attached to your account. What you typed never goes with it: the address is cut back to its pattern before it leaves your browser, so a search becomes the calls page and a call you opened becomes a call page, with no question, no search words, no member id and no call id. The page a sign-in link lands on is not counted at all, because that address carries your one-time token.
• Your profile, if you fill it in. What you run and what you are building, so answers can be specific to your setup. Optional, and yours to edit or clear on your Account page.

The Autmn bot in Discord

The bot answers only when you explicitly invoke it, with the /ask command or by choosing “Ask Autmn about this” on a message. It is not listening to the channel.

• It reads one message. The text you typed into the command, or the single message you pointed it at. Nothing else is read from Discord: not the channel history, not the messages around it, not your other rooms.
• It answers where you asked. In a thread on your question, in the room the question came from, including a private room. A thread there is visible to the people who can already see that room and to nobody else. No human reads the answer before you do.
• Every answer asks whether it helped. Two buttons under it, Helpful and Not helpful. A tap records your Discord user id, which answer you were judging and which way you voted. It does not record the question or the answer text again, and changing your mind updates your vote rather than adding a second one. Elijah and Kabrin read the counts.
• What it keeps. Your question and the answer are stored the same way a question asked on this site is, with your usage record, and your votes are kept alongside them. There is no automatic expiry on those: they are held until we remove them, and you can ask us to. The separate record that a command ran, which is what stops a retry answering you twice, is deleted after 30 days by a daily job.
• It answers from the calls and the documentation, or it says it cannot. It will not answer questions about membership, billing or the call schedule, and it will not review your work. Those go to Elijah and Kabrin, or to your Account page.

Connecting your Discord account

Connecting is optional and it is how the bot knows a question in Discord came from you. The portal asks Discord for one permission, identify, which returns your Discord user id and display name and nothing else. Not your email, not your servers, not your messages. The access token is used once to read that id and is then revoked. You can disconnect at any time on your Account page, which clears the id and the name.

Who else processes this

• Supabase hosts the database and sends the sign-in links.
• Vercel runs the site.
• OpenAI turns your question into a search vector.
• Anthropic writes the answer from the transcript excerpts we send it.
• Discord delivers the bot’s messages, when you use it there.
• Fathom records the calls the library is made of.

Nothing here is sold, and none of it is used to train a model.

Asking for a copy, or deletion

Message Elijah or Kabrin in Discord, or email elijah@aidrivers.io. You can also download your account data in Account, under Security. Deleting your account there removes your profile, activity, and requests. A deletion record keeps a hash of your email. Billing and administrative records remain separate, as do Discord messages. Deleting the portal account does not cancel a Whop subscription. Admins must transfer their responsibilities before deleting their account.