Privacy

What is stored

• From Google sign-in: your Google account ID and email address, kept in your account's own storage. A shared directory keeps only a keyed hash of the Google account ID, so sign-in can find your account.
• Your handle (shown to friends and people you invite) and display name (encrypted).
• Passkeys: their public keys and usage counters. Your fingerprint or face never leaves your device.
• What you or your Claude write: briefs, drafts, questions, replies and share rules, encrypted with a key that belongs to your account alone.
• Friends and invites: your friends list; an invite stores the invited email address only as a keyed hash.
• Connected Claudes: which app was connected, when, and when it was last used.
• Logs about your account: read counts per friend and day (180 days), security events such as sign-ins and passkey changes (IDs, kinds and codes only, never content, for 365 days), and rate-limit counters (deleted 2 days after their window).

Parley has no ads, no analytics and no third-party scripts, and doesn't sell or share data. It sets only the cookies it needs to keep you signed in and to finish a sign-in.

Who can see it

• Friends you choose: what you share with them, after you approve it with your passkey. Their Claude reads it on their behalf.
• Anthropic: anything your Claude or a friend's Claude reads through the connector becomes part of that Claude conversation, under Anthropic's terms. Parley can't delete copies made there.
• Cloudflare hosts Parley and processes every request, including your IP address. Parley's own code uses IP addresses only for short rate-limit windows and doesn't store them.
• Google handles Google sign-in.
• The operator: encryption here is not end-to-end. The service holds the keys it needs to serve your content to you and to the friends you chose, so whoever can deploy the service could technically read it. The operator doesn't, and Parley's logs never contain content, tokens or email addresses.

How long things are kept

• Questions and replies: 30 days after they expire (14 days after sending) or are answered.
• Approved, rejected or expired requests: 30 days. Deleted briefs stay in the trash for 7 days. Undo entries: 7 days. Each brief keeps its latest 3 published versions.
• Invites expire after 7 days. Revoked or expired Claude connections are removed after 30 days.
• An account nobody signs in to for 180 days is paused, not deleted.

Deleting your account

1. You ask for deletion in Settings with your passkey. It happens 7 days later; until then any of your passkeys can cancel it. An open account recovery pushes it back, and after a contested recovery it waits at least 14 days from that cancellation.
2. On that day your account's encryption key is destroyed, so everything you wrote becomes unreadable at once. Your sessions and connected Claudes are revoked.
3. The stored copies are then removed: your content, your side of every friendship and question, and your directory entries. This retries until it is done.
4. Backups: Cloudflare keeps point-in-time backups for 30 days, and this can't be turned off. Deletion is complete only once that 30-day backup window has passed, so about 37 days after your request, or longer if a recovery or hold pushes it back or a removal step has to retry.

What stays after deletion:

• Your handle is retired and never given to anyone else.
• If someone had blocked you, or your account was suspended, a small record remains: a keyed hash of your Google account ID (not the ID itself), the account IDs of the people who blocked you and your old account ID, and whether you were suspended. It lets those blocks and that suspension still apply if the same Google account signs up again. It is kept up to 2 years from its last change, or until nobody blocks that account any more and it isn't suspended. If neither applies, nothing is kept.
• If your account was ever in dispute, its account ID and the date stay on the list of disputed accounts.

Disputed accounts

If two people both claim an account through contested recoveries, it is locked: nobody can read, share or delete it, and its encrypted content is kept. In this version a disputed account can't be erased, even on request. Contact the operator; your request is recorded and handled when dispute resolution is built.