Privacy

1. Who holds your data

Phoenix is software you install, not a service someone runs for you. That single fact determines everything in this policy.

Whoever installed and operates the instance you are using — probably you — is the person who holds the data and, in data-protection terms, the person responsible for it. The contributors to the Phoenix project are not a processor, a controller, or a party to your data at all. They have no access to your installation and no copy of anything in it.

If you are using someone else's instance, the questions in this policy are properly addressed to them.

2. What an instance stores

A Phoenix installation keeps the following on its own disk, because the features the robot expects cannot work without it:

Account details

Email address, a hashed password, first and last name, and optionally birthday, gender and phone number. These exist so a person can sign in and so the robot can address them.

Household ("loop") records

The household, its members, nicknames and phonetic names, invitation and membership state, the link between a member and an account, and whether each member has completed face or voice enrolment.

Personal report settings

Your weather units, chosen news categories, calendar selections, and — if you use the commute feature — your home and work locations and usual departure time. Home and work coordinates are precise location data about where you live and work. They are stored so the robot can tell you about your journey, and for no other purpose.

Robot records and credentials

The robots paired with the household, their identifiers, and the credentials used to authenticate them.

Media

Photographs and other media the robot captures, along with their timestamps.

Messages and notifications

Messages sent within the household, and push-notification registrations for devices that asked to receive them.

Speech

Audio streamed from the robot is processed by the recognition service on your own machine to produce a transcript. Whether audio or transcripts are written to disk, and for how long, depends on how the instance is configured and logged.

3. Cookies and local storage

The console sets one cookie, phx_session. It identifies your signed-in session to the instance and nothing else. It is not used for advertising, profiling or tracking across sites, and there is nowhere for it to be shared to. Signing out clears it.

The site stores one preference in your browser's local storage — your choice of light or dark theme. It never leaves your browser.

There are no third-party cookies, no advertising pixels, and no consent banner, because there is nothing to consent to.

4. What leaves the machine

Phoenix is built to keep everything local. The exceptions are the outside data sources the robot's own features need, and each is a deliberate configuration choice by whoever runs the instance:

• Map tiles, used only by the location picker when you are setting a commute address. The map library itself is served from your own instance rather than a CDN; only the tile images are fetched from outside, and the picker falls back to manual latitude and longitude entry if it cannot reach them.
• Weather, news, traffic and calendar providers, contacted when you ask for a personal report that includes them. A request to such a provider necessarily reveals what was asked for — for example, the coordinates of a journey.
• Push-notification services, if you register a device for them.

Each of these is operated by a third party under its own privacy policy. Turning a feature off in the console stops the corresponding requests.

5. No telemetry

Phoenix contains no analytics, no telemetry, no crash or error reporting, no usage metrics, no fingerprinting, no A/B testing and no beacons. This website loads no third-party scripts, no third-party fonts and no tracking of any kind. Everything it needs is served from the instance you are looking at.

This is verifiable rather than promised: the source is available, and the network tab of your browser is the shortest audit.

6. Other people in the household

A social robot is a shared device. If you run an instance, it will hold personal data about people other than you — their names, their voices, their faces, their photographs, their messages and their report settings.

Those people have a reasonable expectation of knowing that this is happening. If you operate an instance, please tell the people around the robot what it records and what is kept, and respect it when they ask you to delete something. In some jurisdictions this is not merely courtesy but a legal obligation you personally carry.

7. Children

This robot was widely used in family homes, and children frequently interacted with it. A Phoenix instance may therefore process children's voices, faces and photographs.

The Phoenix project does not knowingly collect anything from anyone, since it collects nothing at all. But if you operate an instance in a household with children, you are the one handling children's personal data, and the responsibility for doing so lawfully and carefully is yours.

8. Retention and deletion

Data stays on the instance until it is deleted there. The console can delete media and remove members, push registrations and robots. Nothing is retained anywhere else, because there is nowhere else.

Deleting the instance's data directory removes everything. There is no backup you do not control, which also means there is no recovery if you delete something by mistake.

9. Your rights

Depending on where you live, you may have rights to access, correct, export, delete or restrict the processing of your personal data.

Those rights are exercised against the person operating the instance holding your data. If that is you, you already have complete access: the data is on your disk and the console edits it directly. If it is someone else, ask them. The Phoenix project cannot act on such a request, because it holds nothing to act on.

10. Security

Passwords are stored hashed, robot connections are authenticated, and the session cookie governs access to the console. The practical security of your data, however, depends far more on how the instance is deployed — whether it is exposed to the internet, whether it uses TLS, and how the host machine is secured.

The Security page covers this in more detail, including how to report a vulnerability.

11. Changes

This policy may be revised as the software changes. The version that applies to an installation is the one distributed with it, dated above. Material changes to what the software stores or transmits will be reflected here.

12. Contact

For anything about your data on a specific installation, contact the maintainer of the Phoenix instance you are using.

For a question about what the software itself does, the source repository is the place to ask — and to check the answer.

See also: Terms of use and Security.