Privacy Policy

Last updated: July 26, 2026

This Privacy Policy describes how Runaq.ai ("we", "us", "our"), a company based in Washington State, USA, collects, uses, and protects your personal data when you use Smidgio ("the Service") through WhatsApp, the web portal, your personal RSS feed, and our landing page.

If you are in Washington State, our separate Consumer Health Data Privacy Policy also applies to the categories of data described there.

1. Data Controller

Runaq.ai is the data controller responsible for your personal data. Contact: contact@runaq.ai

2. What Data We Collect

2a. Mood and Emotional-State Information

We want to be specific about this rather than bury it. If you tell Smidgio how you are feeling, for example "feeling overwhelmed today", the assistant may save a short note about it as part of its memory of you. We do not ask you for this, and you do not have to share it. It comes only from what you volunteer in conversation.

We use those notes in three ways:

• To steer what your episodes are about (for example, surfacing material on emotional regulation, life transitions, or work stress)
• To adjust the tone and warmth of episodes and of the assistant's replies
• To derive a rough recent-sentiment signal (positive, mixed, or negative) from your latest memory notes, which feeds the same personalization

These are inferences a computer draws about your emotional state. They are used only to personalize your content. They are never used to make decisions about you with legal or similarly significant effects, they are not sold, and they are not shared for advertising. Memory notes are deleted automatically after 90 days, and you can ask the assistant to forget a specific fact, or delete your account entirely, at any time.

Some accounts created early in the product's life also carry a legacy personality-score profile (including a measure of emotional sensitivity). We no longer create these for new users.

Some of this inferred data - in particular the mood or emotional-state notes described above - may be "consumer health data" under Washington's My Health My Data Act (ch. 19.373 RCW). Our separate Consumer Health Data Privacy Policy describes that data and your rights over it.

We do not collect medical records, clinical diagnoses, or data from health providers or health apps. We do not collect precise location or biometric data. We do not collect or store your payment card details; those go directly to Stripe, our payment processor. We do store the mood and emotional-state information described above.

3. How We Use Your Data

• Generate personalized podcast episodes based on your interests, preferences, and what you have told the assistant
• Deliver episodes and messages via WhatsApp
• Operate, secure, and debug the Service, including delivery and engagement records, usage limits, and cost accounting
• Provide your personal web portal and RSS podcast feed
• Process subscription payments and send service emails such as verification and deletion codes

We do not sell or rent your personal data, and we do not share it with third parties for marketing or advertising purposes. We do not use third-party analytics or advertising trackers.

Profiling. Personalization is the core of how Smidgio works, so we want to state plainly that we do profile you. We build and continuously update an automated profile of your interests, your communication style, and things you have told us, including the mood information described in Section 2a, and we use it to choose and shape what you hear. Part of this profile is refreshed automatically overnight. This profiling is used only to personalize your content and tone. It is not used to make decisions about you with legal or similarly significant effects, such as credit, employment, housing, or insurance. You can steer or limit it at any time: ask the assistant to forget something, set a content rule, pause deliveries, or delete your account.

4. Third-Party Services

We share personal data only with the service providers that run Smidgio. We do not sell it and we do not share it for advertising.

• WhatsApp (Meta Platforms) - message delivery. Subject to WhatsApp's own privacy policy.
• Amazon Web Services (AWS) - data storage (DynamoDB), audio and content storage and delivery (S3/CloudFront), encryption key management (KMS), and service email (SES). Data is stored in the US East (N. Virginia) region.
• AI models via AWS Bedrock - including Anthropic Claude models, used to power the assistant's conversation, write your episode scripts, and transcribe your voice notes.
• Google Cloud - text-to-speech voice synthesis. The narration in your episodes is a synthetic, computer-generated voice, not a human recording.
• Stripe - subscription billing and payment processing. Your card details are handled by Stripe, not by us.
• Exa - news and article search used to source material for your episodes. We send topic and search queries; we do not send your identity.

5. Data Retention

• Profile, preferences, and content rules: Retained while your account is active.
• Episodes (script, audio, and cited sources): Retained while your account is active. They are deleted when you delete your account. They are not currently on an automatic expiry schedule.
• Memory notes from your chats, including mood notes: Automatically deleted 90 days after they are recorded.
• Dates and events you mention: Automatically deleted 30 days after the date passes.
• Onboarding conversation state: Automatically deleted after 24 hours.
• Active chat session context: Automatically deleted after 7 days without activity.
• Portal login sessions: Expire after 30 days.
• Verification and data-deletion codes: Expire after 15 minutes.
• Security, audit, and cost records: Retained up to 365 days. These reference your account through a one-way hash of your phone number rather than the number itself.
• Marketing emails left on our landing page: Retained up to 1 year.
• Rate limiting counters: Held briefly in server memory on a rolling one-minute window and never written to our database.

When you delete your account, we delete your profile first. This destroys your personal encryption key, which makes the remaining encrypted data unrecoverable, and we then delete your other records.

6. Data Security

We protect your data with:

• Encryption at rest for all stored data (AES-256 via AWS managed encryption)
• An additional layer of per-user encryption for the most sensitive content, including your name, your memory notes and mood notes, your conversation transcripts and summaries, and your personalization profile. Each user has a separate data key held by a hardware-backed key service (AWS KMS), so deleting your profile makes that content unrecoverable.
• Encryption in transit (TLS 1.2+)
• Signed, time-limited audio URLs (not publicly accessible)
• Masking of phone numbers and access tokens in application logs
• Passwords stored only as scrypt hashes; verification codes stored only as hashes
• IAM-scoped access controls with least-privilege permissions

7. Your Rights

Everyone, regardless of where you live, can do the following, and we honor these requests globally. You have the right to:

• Access your personal data - your Smidgio portal shows your profile, preferences, and recent episodes. For a copy of everything we hold about you, including your memory notes, use Download my data on your account page.
• Correct inaccurate data - update your topics, preferences, and delivery settings by asking the assistant on WhatsApp, or in your portal
• Delete your data - send "delete my data" to Smidgio via WhatsApp, or use your portal. We confirm the request with a code sent to your email, then erase your profile, memory, episodes, and associated records.
• Revoke consent - pause deliveries or delete your account at any time by telling the assistant
• Data portability - download a machine-readable JSON copy of your data at any time from Download my data on your account page. Your podcast feed (RSS) can also be added to any podcast app, but it is a live feed of your episodes, not a complete export of your personal data.
• Information about third parties with whom data is shared - these are listed in Section 4 above

To exercise any of these rights, send a message to Smidgio via WhatsApp or email contact@runaq.ai. We will respond within the shorter of 45 calendar days or the period your local law requires, and we will not discriminate against you for exercising your rights. If we deny a request, we will tell you why and how to appeal; if you are still unsatisfied, you may complain to your state Attorney General or your local data-protection authority.

California residents (CCPA/CPRA). You have the rights to know, access, correct, delete, and to opt out of the sale or sharing of personal information. We do not sell or share personal information as those terms are defined by the CCPA, and we do not use or disclose sensitive personal information for purposes beyond those permitted by regulation. You may exercise these rights through an authorized agent, and we may verify your identity through your account email.

Washington residents. See also our Consumer Health Data Privacy Policy for rights specific to consumer health data under the My Health My Data Act (ch. 19.373 RCW).

Virginia, Colorado, Connecticut, Texas, Oregon, and other US state residents. You have equivalent rights of access, correction, deletion, and portability, plus the right to appeal a refusal, and we extend them as described above.

Mexico. Runaq.ai is responsible (responsable) for your personal data. You have ARCO rights: Access, Rectification, Cancellation, and Opposition, plus the rights to withdraw consent and to limit use or disclosure. This policy, together with the notice shown during onboarding, constitutes our privacy notice (aviso de privacidad). Send ARCO requests to contact@runaq.ai; we respond within the period required by the LFPDPPP.

Colombia (Ley 1581 de 2012). We process your data based on the prior, express, and informed authorization you give at onboarding. You may access, update, rectify, and delete your data and revoke that authorization at any time, and you may complain to the Superintendencia de Industria y Comercio.

Argentina (Ley 25.326). You have rights of access, rectification, updating, and deletion, exercisable free of charge at the intervals the law provides. The Agencia de Acceso a la Informacion Publica is the supervisory authority for complaints.

8. Children's Privacy

Smidgio is not intended for users under 16 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a minor, please contact us immediately.

9. International Data Transfers

Smidgio is operated from the United States, and your data is stored and processed on AWS servers in the United States. If you use the Service from Latin America, you consent to this transfer when you accept this policy at onboarding. We protect transferred data with the safeguards described in Section 6 and with contractual commitments from the service providers listed in Section 4.

10. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via WhatsApp. The "Last updated" date at the top indicates the most recent revision.

11. Contact

For privacy-related questions or to exercise the rights described in Section 7:
Email: contact@runaq.ai
Data Controller: Runaq.ai, Washington State, USA