Privacy: what Buoy keeps, why, and for how long
Plain language first, the full table second. Last updated 2026-10-23. This page describes the product as built; it is not yet legal advice and will be reviewed by counsel before general availability.
The short version
- You sign in with LinkedIn. We keep what LinkedIn sends back (name, photo, locale, email, and the raw response), encrypted, so we can show who is helping whom, keep one account per person, and investigate abuse.
- We never start a screen share. You pick a window; it is masked on your Mac before it leaves.
- Every session is recorded: both voices and the window the seeker shares. Both people see a "Recording" line the whole time. The recording, transcript and summary belong to the person who asked for help; Buoy staff can review a session for quality or abuse, and every such review is logged.
- Shared something you shouldn't have? Delete the session from History. It disappears for you, your helper and any team log, and is removed from your Mac; Buoy keeps it only for abuse review until it expires.
- Everything personal is encrypted with a key that is yours alone. Delete your account and that key is destroyed; what was encrypted with it is gone everywhere, backups included.
- You can download everything we hold about you (
GET /v1/me/export) and see every access to your records (GET /v1/me/audit). - We do not train AI models on your sessions and we do not sell data.
The table
| Data | Why we keep it | How long |
|---|---|---|
| LinkedIn identity (id, name, photo, locale, email) and the raw sign-in response | One real person per account, a name and face for the people you help, abuse investigations, and so we can prove what LinkedIn told us if an account is disputed | While your account exists; refreshed at each sign-in |
| Sign-in history (time, client, IP address, browser or app version) | Spotting account takeover, showing you where you are signed in, and the evidence an audit asks for | 1 year |
| Your requests for help (description, summary, tags, app and window title) | Matching you with a helper and keeping the ask in front of both of you during the session | While your account exists |
| Session facts (who, when, minutes, credits, ratings) | Credits, levels and dispute resolution | While your account exists; anonymized accounting rows after deletion |
| Recordings (voices plus the shared window) | Your own history; quality and abuse review by staff (logged) | 90 days |
| Transcripts and summaries | Your own history and the next steps from a session | 1 year |
| Audit trail (sign-ins, tokens, bots, record access, exports, deletions) | Security, and so you can see who looked at what | 400 days |
| Bot credentials and personal API tokens | Letting your bots and tools act for you; stored hashed, expiring | Until revoked or expired, then 30 days |
The engineering version of this table, with field names and the code that enforces each limit, is in the project's data inventory. Questions: privacy@buoy.be-n.com.