Privacy

What stays on your phone, and what travels.

Front Door 24 is built so that the sensitive part — what you teach your desk, and the AI that uses it — never leaves your device in the standard On this device mode. This page says exactly what that means, exactly what does travel, and what changes with Cloud thinking.

Who is responsible

Hybrid Intelligence Studios operates Front Door 24 and the relay that carries messages. Contact: leave a note on the site and the founder will write back.

The short version

• Your answers, your documents and your photos stay on your device. In the standard On this device mode, the AI runs there too, and nothing you ask or teach leaves it. With Cloud thinking switched on, each question and the parts of your answers needed to reply are sent out — see Cloud thinking below.
• We never use anything you or your customers write to train an AI model. (While Cloud thinking is on, the provider’s own no-training statement covers their side — see below.)
• Your customers’ questions do travel — they have to, to reach your phone. We say below exactly what is stored and for how long.
• No ads. No tracking. No analytics on your customers. No sale of data, to anyone, for any reason.

What stays on your device

Everything you teach the app — your answers, the documents and photos you add, and the AI models that draft from them — is stored on your device. In the standard On this device mode, the AI runs there too and nothing you add is uploaded. While Cloud thinking is on, the parts needed for each answer are sent out — see Cloud thinking.

The app asks iOS to keep its files locked until the first time you unlock the phone after a restart. A few writes fall back to the level iOS gives by default, which today is the same one. We stopped deliberately one short of the strictest: at that level your desk could not draft an answer while your phone sat locked in your pocket, which is the whole point of it.

If your device’s backup is switched on, your answers ride along in it — that is how they survive a lost or replaced phone. If it isn’t, this phone is the only copy. (The AI model files are deliberately excluded, so your backup stays small.)

The app collects no analytics and transmits none. There is an optional usage-counts setting in Privacy settings, off by default. As the app stands today it records nothing at all — we found that mismatch in our own audit and it is being fixed; this page will say so when it is.

Camera and photo access are used only to read the material you choose to add.

Cloud thinking — only if you turn it on

Cloud thinking is off unless you switch it on in Set up → Thinking. While it is on, every question asked of your desk — yours and your customers’ — and the answers from your library the desk needs to reply are sent to an outside AI provider to be written. Photos and documents you add are sent as images to be read. Your library itself is not uploaded; the parts behind each answer are.

“Nothing you ask or teach leaves this phone” is the promise of the On this device mode, and it does not hold while Cloud thinking is on. Your answers, documents and photos are still stored on your device, deleted only by you, and never used to train anything of ours.

We choose providers that state in writing that they do not retain prompts and do not train on them — that is their statement, not ours; we cannot see or enforce what happens on their side. Cloud thinking uses your own provider key, so every question is charged to your account with them. Switch back to On this device at any time.

What travels, and why

Everything that travels does so over standard web encryption (HTTPS) — transit encryption, stated plainly; we make no encryption claims beyond transit today.

For a customer’s question to reach your phone, it has to cross the internet. Our relay carries it. Here is everything it holds:

• Messages your customers send to your desk, so you can answer them.
• Contact details a customer chooses to leave for a callback. This is optional — staying anonymous is always fine, and it is the default.
• Your device’s push token, so your phone can be told someone is waiting.

That is the whole list of what the relay holds about your customers. It also holds your own desk settings — your welcome message, your display name, your review clock and the like. In particular, we do not store your customers’ IP addresses. Rate limiting has to recognize a repeat visitor, not identify one, so each desk keys its limits on a salted, shortened hash: the salt never leaves that desk, the address is never stored in readable form, and the hash cannot be matched against any other desk. Cloudflare, which operates the edge our relay runs on, still sees the connection — this is a statement about what we store.

Each business has its own separate desk, holding only that business’s conversations. Nothing is pooled across businesses.

How long it is kept

• A question still waiting for you is deleted after 14 days. Your customer is told when that happens, so it is never silence — but the question is closed at that point and cannot be answered afterwards. Asking again starts a new one.
• If an alert to your phone fails to send, the relay logs it with a short preview (the first 80 characters of the question), deleted after 30 days. Alerts that send leave no log entry.
• Delivered conversation transcripts are deleted after 90 days.
• Callback details stay until you delete them — up to the most recent 500, after which the oldest drops off.
• Your device’s push token stays until you use Start over, or until Apple reports that it no longer works.
• Rate-limit bookkeeping, keyed on the salted hash described above, covers at most the 200 most recent visitors and stays until you use Start over.
• On your device, your answers, documents, photos and conversations stay until you delete them or delete the app. If your device’s backup is on, that backup keeps its own copy until the backup is deleted.

Notifications carry no question text

When a customer asks, your phone gets an alert that says a customer is waiting — and nothing else. The question itself never enters the notification, so it is never on your lock screen and it never passes through Apple’s notification service. You read it by opening the app, over the same signed channel everything else uses.

The limit, since you would not otherwise know it: your device’s push token does travel, and Apple does deliver the alert. What does not travel is the question. Only if an alert fails to send does our own log keep a short preview of the question, for 30 days.

What sends on its own

A short, fixed list of messages is answered without waiting for your tap: a greeting, a thank-you, a goodbye, “are you a bot?”, a clear I’d-like-to-buy, and any message that leaves contact details. One more sends on its own for safety: if a message reads as an emergency or distress, the desk replies at once pointing to emergency services. That reply is marked sent automatically, it stays in your Inbox, and it is never counted as approved by you. Those are answered from answers you already wrote — never from a guess — and your customer sees them marked “sent automatically”, so nobody is ever told you approved something you did not see.

This happens whatever the Auto-answer setting says: holding “hi” for review made the desk feel like a broken bot. Everything else waits for you, or becomes an honest hand-off when your review clock runs out.

Two different clocks apply to a held question, and they do different things. Your review clock is yours to set; when it runs out, your customer is told a real person will follow up — the question stays in your queue, and a late answer still reaches them. After 14 days, a question still waiting is closed and cannot be answered afterwards; your customer is told that too. Asking again starts a new question.

Deletion, and changing your mind

• One callback: delete it in the app.
• Conversation history: in Set up, Erase conversation history deletes every delivered conversation the relay holds. Answers your customer hasn’t received yet, and questions still waiting for you, stay until they are delivered or expire.
• Everything on the relay: in Set up, Start over erases your whole desk there — conversations, waiting questions, callbacks, the alert log, your push token and the rate-limit bookkeeping — and takes your link down.
• Stop what goes out: Pause my desk closes your link, so customers see “This front desk is closed” and no alerts are sent. Switch Thinking back to On this device to stop Cloud thinking. Turn off notifications for Front Door 24 in your device’s Settings.
• Anything else we hold, including waitlist and demo messages: email us and we delete it.

If you are a customer of a business using Front Door 24 and want your information removed, ask that business to delete it. Your conversation belongs to the business you were talking to, not to us.

Your answers are yours

Your answers export to a single sealed file you keep. The file opens with its code — anyone holding the file and the code can open it, so share the code carefully. If you stop using Front Door 24, that file is still yours.

What the file holds: every department’s answers and your desk table, and, in newer bundles, the source documents you chose to retain. Your conversations, your callback requests and your settings are not in it.

Billing

Nothing is charged today. Front Door 24 is invite-only and free for the early adopters we work with, so there is no subscription running and no billing record of any kind.

When pricing launches, billing will run through Apple and your App Store account — manage or cancel in your device’s Settings, refunds requested through Apple. Your card details never touch us either way.

What we do not do

• No ads, no tracking, no analytics on your customers.
• No sale of data — ever. Sharing goes only as far as each part needs: Cloudflare, whose network our relay runs on; Apple, which delivers your alerts (they carry no question text); the AI provider you choose, only while you have Cloud thinking switched on; on this website, the outside LLM provider that writes the demo’s replies, and the speech provider that reads them aloud if you turn sound on; and valid legal process, which can compel anyone — then only what we actually hold, and the clocks above keep that small.
• No training by us on anything you or your customers write.
• No answer your desk composes is delivered unreviewed: you approve it, or your customer gets an honest hand-off instead. (Greetings and the short list above send on their own, from words you already wrote — see What sends on its own.)
• We do not store your customers’ IP addresses — see What travels.

If something ever goes wrong

If we confirm a breach that touches your data, we tell the affected businesses what happened and what it reached. What a breach could ever reach is bounded by the retention above — the clocks are the ceiling.

Changes

If this page changes in a way that affects what we collect or how long we keep it, we will say so here with the date.

The website itself (draft — pending owner review)

This page mostly describes the product. The website you are reading also handles a little data of its own, and honesty means listing it too:

• The demo chat. What you type into the ask box is sent to an outside AI provider to generate the reply; which provider may change. A record of each exchange — the question, the reply, a random session id, and a one-way hash of your network address that cannot be turned back into it — is kept for 30 days, then deleted automatically, along with your country, browser, and the page you arrived from. During invite-only early access, the founder reads these to check the quality of the demo’s answers. Don’t type anything confidential into the demo — the note under the chat says so too.
• Reading replies aloud. If you turn the demo’s sound on, each reply is sent through our relay to a hosted speech provider to be voiced; the text is not logged. If that is unavailable, your browser’s own on-device voice reads it instead.
• The waitlist. Your email and optional note are kept for 30 days and then deleted automatically — along with your country, the kind of browser you used, the page you arrived from, and a one-way hash of your network address that cannot be turned back into it. The founder reads them there to write back, and that email conversation is kept like any other correspondence until you ask us to delete it. No list is built, nothing is sold or shared.
• Two small things saved in your browser. The demo chat stores a random session id so a conversation holds together across visits, and the voice buttons remember the speed you picked. Neither identifies a person, and you can clear them like any site data.
• Nothing else. No analytics scripts, no advertising trackers, no cookies beyond the above, and every font, image, style and script on this site is served from this site — nothing is fetched from anyone else’s servers.

draft — pending owner review

Last updated: 17 September 2026
Hybrid Intelligence Studios · Front Door 24 · Support