Effective date: October 16, 2026 · Applies to: Ren (ren.1088labs.com) and Javi (javi.1088labs.com), both operated by 1088labs ("we", "us"). Companion document: Terms of Service.
1. Who we are
1088labs builds AI personal-assistant apps: Ren, a premium assistant, and Javi, a free and multi-tier assistant. Both let you chat by text or voice with an AI assistant that can manage tasks, calendars, reminders, money tracking, health logs, study tools, email, shopping, and connected accounts on your behalf. This policy explains what data the apps handle and how.
2. Information we collect
Information you provide
- Account details: email address, display name, and a password (stored only as a salted hash, so we cannot read it).
- Google sign-in (if you use it): signing in with Google gives Ren your name, email address and Google account id, used only to create and sign in to your account.
- Conversations: your messages to the assistant, typed or spoken (how spoken words become text is under "Voice audio" below).
- Content you create through the assistant: tasks, calendar events, reminders, notes, journal entries and moods, flashcards, shopping lists, goals, reading lists, time logs, and files you attach, and details you choose to record about people in your life (names, how you know them, how often you want to be in touch, notes and reminders about them, and, if you turn on phone capture in a version of the app installed from ren.1088labs.com, which apps and contacts messaged you, never the messages themselves).
- Financial information you enter: spending and income you log, budgets, bills, debts and payments, credit score, and net-worth figures.
- Health information you enter: weight, medications, meals, sleep, water, and mood logs, plus fitness data (recovery, sleep, strain, heart-rate variability) if you connect a Whoop account. Health data has its own dedicated policy: see our Consumer Health Data Privacy Policy.
- Reports: if you report one of Ren's replies, we keep the reason you picked, any note you add, and the first 500 characters of that reply with your account, so we can review it and improve how Ren avoids wrong or harmful answers. Reports are deleted with your account.
Information from connected accounts (only if you connect them)
- Google (Gmail and Google Calendar): email metadata and content needed to summarize, search, and (only when you explicitly confirm) send messages; calendar events to read and manage your schedule. See section 5.
- Retailers (Walmart, Target, Amazon): your product preferences, cart contents, and order history from your own retailer account, used to stage carts and reorder for you. Sign-in happens in your own retailer session; one-time codes and passwords you provide during sign-in are used to establish that session and are kept out of logs and chat replies (codes are never stored; passwords are stored only if you turn on saved sign-in, described below).
- Banks and financial apps (for example Chime and Cash App): if you choose to connect a bank or financial account, we access your balances and transaction history on a read-only basis to answer your questions and track your finances. You sign in to your own session; texted one-time codes are used only to establish that session, are never stored, and are kept out of logs. The assistant cannot move money, make payments, or change your account. Read-only means read-only.
- Saved sign-in details (optional): if you turn on saved sign-in, the identifiers, passwords, or PINs you provide for a connected account are stored encrypted at rest so the assistant can re-establish your session when it expires, without asking you to retype them. One-time codes are never stored, and stored values are never shown back in chat or logs. You can see which accounts have saved details, turn saving off, or delete any or all of them at any time by asking the assistant.
- Whoop: fitness and recovery data via Whoop's official authorization flow, limited to the scopes you approve.
Device permissions (Android app: each optional, each asked for in context)
- Microphone: only for voice input you start, or hands-free listening you turn on (see "Voice audio" below).
- Texted sign-in codes (SMS): during a sign-in you started to a connected account, the app can pick up the one-time code texted to you so you don't have to type it. Android asks you each time: you tap Allow to let Ren read that one message. Ren takes the code out of it and sends only the code to our servers, never the message itself, never reads your SMS inbox or other messages, and stores no message content. Versions of the app installed from ren.1088labs.com could also be given the SMS permission for hands-free capture; even then the app listens only while a sign-in you started is waiting for a code and forwards only messages that look like a code.
- Notifications: for reminders and messages from the assistant.
- Optional companion features you turn on (for example alarms and timers, or screen time and website time, described below) work only at your request and can be turned off anytime.
Screen time and website time (Android app, optional)
Nothing is collected until you allow it: screen time starts only after you give Ren usage access in Android's settings, and website time only after you tap Agree on Ren's notice and turn on its Accessibility service. You can turn either off at any time in the Ren app's Phone settings.
- Screen time uses Android's usage access to count how long each app was on screen each day. Ren keeps the app's name and its minutes per day.
- Website time uses Android's Accessibility service. Only after you tap Agree on Ren's notice does it read the web address in your browser's address bar (Chrome, Samsung Internet, Firefox, Edge, Brave and other browsers). Ren keeps only the site name (like youtube.com), how long it was on screen, and how many times you opened it. It never keeps full web addresses, page titles, page content, or anything you type, and it never taps, types, or controls your phone. In other apps it notes only that you left the browser. Private (incognito) tabs are counted too.
- Where it is kept: website history stays on your phone for 14 days, and the daily screen time and website rows sync to your Ren account, where they are kept for up to 120 days, so you can see them in the app and ask Ren about them. When you ask, the rows needed for the answer go to our AI provider (section 4). Chat messages that mention sites are part of your chat history (section 8). This data is never sold or used for advertising.
- How to delete it: turn website time off in the Ren app's Phone settings and choose to delete its history. That clears it on your phone and removes the website rows from your Ren account on our servers. Deleting your account removes all of it.
Voice audio
- Talking to Ren on your phone or computer: your speech is turned into text by the speech recognizer built into your device or browser (on Android, the speech service set on your phone; in Chrome, Google's speech service), under that provider's own terms. Ren receives the text, not the audio. Hands-free listening ("Hey Ren"), if you turn it on, keeps that recognizer listening only while Ren is open on screen.
- Ren in the car: with Ren's car add-on, audio from the car microphone is sent over an encrypted connection to Ren's own speech-to-text service, which runs on the same 1088labs servers as Ren. The audio is turned into text in memory and is not saved: our logs record only your account name, the audio's size, length and loudness, the length of the text, and how long recognition took, never the audio or the words. The text becomes your message to Ren. If our service can't make out the words on a turn you started with a tap, the add-on can pass that audio to your phone's own speech recognizer (on most phones, Google's) or ask you to say it again to your phone, under that provider's terms.
- Ren's voice: spoken replies are generated on our servers from the text of the reply, or by your device's own voice if ours is unavailable.
Information collected automatically
- Device and client info (app or browser version), IP address, timestamps, and service logs used to run, debug, and secure the service.
3. How we use your information
- To provide the assistant: answer you, run the actions you ask for, and keep your data organized across sessions.
- To run background work you request (research, reminders, scheduled briefings, automations) and proactive features you have enabled.
- To personalize the assistant, for example by remembering your preferences, routines, and saved choices.
- To operate, secure, debug, and improve the service.
We do not sell your personal information, and we do not use it for advertising.
4. AI processing
Ren's replies are written by AI models from Anthropic (Claude), a third-party provider. To answer you, Ren sends Anthropic your message, the recent conversation, and the parts of your stored data the answer needs (for example your task list, calendar entries, health logs, or screen time rows). Anthropic receives that data under its own terms, its Privacy Policy and its Usage Policy. Under those terms Anthropic keeps it for a time and, depending on the settings of the Anthropic account Ren uses, may use it to improve its models. Deleting your Ren account does not delete Anthropic's copy. 1088labs itself does not use your data to train AI models and never sells it.
AI replies can be wrong. If a reply is wrong, harmful, offensive, or a privacy problem, tap the flag under it to report it (section 2, "Reports").
5. Google user data (Limited Use disclosure)
If you connect a Google account, 1088labs' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In practice:
- Gmail and Calendar data is used only to provide the features you see: reading, summarizing, searching, and (only after your explicit confirmation) sending email, and managing your calendar.
- Google user data is never used for advertising, never sold, and never transferred to third parties except as needed to provide those features, for security, or to comply with law.
- Humans do not read your Google data except with your explicit permission, for security purposes, or where required by law.
- Google user data is not used to train AI or machine-learning models.
6. Payments
When paid subscriptions launch, payments will be processed by Stripe through Stripe-hosted checkout. Your card number goes directly to Stripe and never touches our servers; we receive only what we need to manage your subscription (such as plan, status, and billing dates). Stripe's own privacy policy applies to its processing.
7. When we share information
- AI provider: Anthropic receives what each reply needs and handles it under its own terms (section 4).
- Service providers: Stripe (section 6), Plaid (bank linking through Plaid's hosted widget, where offered), Google Firebase Cloud Messaging (FCM, which delivers push notifications to the Android app: it receives a device token and the notification content), and infrastructure/hosting providers, each only what is needed to do their job for us.
- Third-party services you connect: when you ask the assistant to act on a connected account (send an email, add to a cart, read a balance), the necessary data goes to that service under its own terms.
- Legal: if required by law, or to protect the rights, safety, or security of users or the service.
- Business transfer: if 1088labs is acquired or merges, your data may transfer under this same policy.
We never sell your data and never share it with advertisers or data brokers.
8. Data retention and deletion
Your data is kept while your account is active so the assistant can keep working for you.
- Chat history: your conversation with Ren, and the working copies the AI uses to continue it, stay in your account while it is open so Ren keeps context from one day to the next. They are deleted when you delete your account. To remove specific messages sooner, contact us (section 14).
- Screen time and website time: daily rows are kept for up to 120 days, website history on the phone for 14 days, and when you turn website time off, Ren offers to delete its history (section 2).
- Security and service logs: sign-ins, account deletions and other server events are logged with the IP address, account name and time, to keep the service running and protect it from abuse. They are kept for up to 90 days, also after you delete your account.
- Usage counts: which features are used and when, under a random account number, never what you said. When you delete your account, the number is removed and only the counts stay.
- Deleting your account: in the app, open Settings (on a phone: More, then Settings), then Account, then Delete account, and type DELETE to confirm. Without the app, follow ren.1088labs.com/delete-account or email info@1088labs.com from the address on your account. Deleting in the app removes your account, your chats, everything stored with the account, and your uploaded files from Ren's servers right away.
If you delete your account, we delete your personal data within 30 days, except the security and service logs above (up to 90 days) and records the law requires us to keep. Copies the AI provider keeps under its own terms are covered in section 4. You can also ask the assistant to delete specific items (a note, a log, a connected account) at any time.
9. Your rights
You can, at any time:
- Access and correct your data. Most of it is directly visible and editable in the app.
- Export a copy of your data: download it yourself in Ren on the web (Settings, then Account, then Download my data), or ask us. The download leaves out passwords, sign-in tokens and keys.
- Disconnect any connected account (Google, retailers, Chime, Whoop). This stops all further access to it.
- Delete your account and data: in the app (Settings, then Account, then Delete account), at ren.1088labs.com/delete-account, or by contacting us (section 14).
Depending on where you live, you may have additional legal rights (such as under GDPR or U.S. state privacy laws, including rights to access, correction, deletion, and portability); we will honor valid requests through the contact in section 14, and we will not treat you differently for exercising them. We do not "sell" or "share" personal information as those terms are defined by California and similar state privacy laws, and we do not use it for targeted advertising or profiling. Your financial and health information is used only to provide the features you use; it is never sold and never shared for advertising. If you are in the European Economic Area, the United Kingdom, or Switzerland, section 10 describes your rights in more detail.
10. European users (GDPR)
The Services are not currently marketed in the EU, but if you use them from the European Economic Area, the United Kingdom, or Switzerland, this section applies to you. 1088labs is the data controller for the personal data described in this policy.
Lawful bases for processing
We process your personal data on these legal bases:
- Performance of a contract: providing the assistant itself: your conversations, the content you create, and the actions you ask it to take.
- Consent: optional features you turn on: connecting a Google, retailer, bank, or Whoop account; saved sign-in details; device permissions; and any health data you choose to enter (which we process only with your explicit consent). You can withdraw consent at any time by turning the feature off or disconnecting the account.
- Legitimate interests: operating, securing, and debugging the service, always balanced against your rights.
- Legal obligation: where the law requires us to keep or disclose specific records.
Your rights
You have the right to access your personal data, correct it (rectification), delete it (erasure), receive a copy in a portable format (portability), restrict or object to processing, and withdraw consent at any time without affecting past processing. Most of these you can exercise directly in the app (section 9); for the rest, contact us (section 14) and we will respond within one month. You also have the right to lodge a complaint with your local supervisory authority.
Data retention
We keep your personal data only as long as your account is active, plus the deletion window in section 8 (30 days after account deletion, except security and service logs, kept for up to 90 days, and records the law requires us to keep). Data from disconnected accounts stops being collected immediately, and one-time sign-in codes are never stored at all.
International data transfers
The Services are operated from the United States, and your data is stored and processed there. If you use the Services from outside the U.S., your data will be transferred to and processed in the U.S., a country that may not provide the same level of data protection as your home jurisdiction. Where GDPR applies to a transfer, we will rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK and Swiss equivalents) with our service providers, alongside the security measures in section 11.
11. Security
Data is encrypted in transit (TLS). Account passwords are stored only as salted hashes. Sign-in details you choose to save for connected accounts (section 2) are encrypted at rest. Secrets such as one-time codes are kept out of logs and never stored. Access to production systems is limited. No online service can promise perfect security, but protecting your data is a design requirement, not an afterthought. If a breach affects your personal data, we will notify you and the relevant authorities as required by applicable law.
12. Children
Ren and Javi are for adults. You must be at least 18 to use them, and we do not knowingly collect data from anyone under 18. If we learn we have collected data from someone under 18, we will delete it.
13. Changes to this policy
If we change this policy in a meaningful way, we will notify you in the app before the change takes effect. The effective date at the top always shows the current version.
14. Contact
Questions or requests: email info@1088labs.com, or message the assistant directly in the app.