Privacy

What Doorman stores

Everything Doorman knows is plain text you can read in Memory — matters, people, spheres, rules, and an event log. Mail bodies are transient; meaning is durable.

Retention

• Mail bodies — raw body, quoted text, and attachment blobs are purged after 30 days. Envelope metadata and events remain so routing history stays legible.
• Facts — time-limited facts expire on their expires_at date.
• Noise — marketing and notification-only mail is purged after 7 days.

Context requests

When you share a context-request link, an outside contributor can dump voice and optional files into a sphere you chose. Audio is transcribed server-side and deleted immediately — you never receive a recording. Transcripts and non-audio files are Tier A (30-day purge); only the meaning filed into your memory is durable. Contributor words are untrusted third-party content: they never become instructions, never edit your rules, and never send as you.

No model training

Doorman calls the Anthropic API to classify, route, and extract. Anthropic does not use API traffic for model training by default. We do not sell or share your memory with third parties.

Export and erasure

From Memory, request a zip or git bundle export (emailed download link). To leave entirely, use Delete everything — optionally export first. Admins can also run manage.py erase_user or manage.py erase_person for third-party erasure requests.

Human review

Staff can view envelope bodies and memory files only when you opt in via allow review in settings (off by default for guinea pigs). Each staff view writes an admin.viewed event visible on your Memory page.