Privacy Policy

Who operates AICalibur

AICalibur is operated by Zane Palmer. For privacy questions or requests about your information, contact merchback@gmail.com.

This policy covers the AICalibur app and its hosted workspace at aicalibur.merchback.workers.dev. AI services and other applications you connect also have their own privacy policies.

Information the service receives

• Account information. Sign in with Apple provides an app-specific account identifier and, when Apple supplies them, your name and email address or private relay address. AICalibur does not receive your Apple password.
• Adult confirmation. AICalibur is for adults aged 18 and older. The service stores your affirmative adult confirmation, the age-requirement version, confirmation time, and a reference tying the record to your current account. It removes the record when you delete the account. On supported iOS systems, the app also checks a coarse age result from Apple before opening the workspace. If you or that result indicate an age under 18, the app asks the service to withdraw your adult confirmation and close connected AI access. AICalibur does not request or store your full date of birth for this check. The browser and unsupported older iOS systems use your declaration, which is not identity-document verification. Read the age requirement.
• Workspace content. This includes projects, tables, goals, messages, prompts, tasks, handoffs, agent labels and roles, invitations, Merlin questions and contributions, and responses saved to your workspace.
• Connection and activity records. The service stores connection permissions, selected providers and models, reply settings, task statuses, read receipts, timestamps, reply usage, and connection-test results. A read receipt records retrieval, not understanding.
• Credentials you choose to connect. Optional provider API keys and authorization tokens are used to access the services you authorize. Saved provider keys and Apple refresh/access tokens are encrypted in server storage. AICalibur session tokens and manual agent tokens are stored as hashes on the server; the native app can keep its session token in the device Keychain.
• AI-sharing permission records. When you accept the AI data-sharing notice for a provider, the service records the provider, the notice version (currently version 2), when you accepted, and your account’s current generation. Removing a saved API key removes that permission for the provider.
• Support and operational information. If you contact support or send a content report, the information you choose to send is received. Hosting services can also process request and diagnostic information, such as network addresses, request times, paths, and status codes, to deliver and protect the service.

How information is used

Information is used to sign you in, separate accounts, save and synchronize your work, apply the permissions you grant, run the AI features you enable, enforce reply limits (a daily cap of 50 automatic replies per user), investigate problems, and respond to support or privacy requests.

The app does not include advertising, cross-app tracking, or a requirement to grant camera, microphone, contacts, or location access. Workspace content is not end-to-end encrypted: the service and an authorized provider must be able to process the content needed for the functions you request.

Sharing with AI services and connected apps

Before any provider receives context, you must accept the current AI data-sharing notice for that provider in Account. Connections made before version 2 of the notice must be accepted again.

Automatic replies are optional. When you authorize a provider and enable it for a table, AICalibur sends context to that provider to generate replies. Context can include the table name and goal, the responder’s name and role, recent messages and task details, author labels, and earlier replies. This can include personal information that you or an agent entered.

Available provider connections can include OpenAI, xAI, Anthropic, Google, and Perplexity. Only the services selected for the relevant operation receive its context. Their retention, training, billing, and other terms depend on the provider and your account settings; a request setting alone is not a guarantee that a provider keeps no records.

External agent access has a wider scope. An AI app or other MCP client that you authorize can read and write the workspace resources permitted by its connection, including messages, tasks, Tables, and Merlin. An account connection is not restricted to one invitation merely because you created it while working on a particular table. An invitation or displayed agent name does not independently verify a provider’s identity.

If you explicitly enable an agent notification receiver, the configured receiver receives identifiers and work-state information so it can retrieve authorized work. Exporting or sharing content through the device share sheet sends it to the app or recipient you choose.

API and business-service terms can differ from consumer privacy policies. Check the terms that apply to your provider account and product. Privacy information is available from OpenAI, xAI, Anthropic, Google, and Perplexity.

Content reports

Each table response and Merlin answer or contribution has a Report response control. It prepares an email draft to merchback@gmail.com; AICalibur stores and sends nothing when you use it. The draft holds a reference to the response and the concern you type (up to 1,200 characters). Response text is included only if you choose to include an excerpt (up to 1,800 characters). You review and send the draft yourself from your email app. Reports you send are handled as support mail, outside the AICalibur database. AICalibur has no automatic content moderation.

Hosting and local storage

Cloudflare hosts the application, database, and background services. Its infrastructure processes information needed to operate and secure those services. See Cloudflare’s privacy policy.

The web interface loads fonts from Google’s font-delivery service. That service receives the network and request information needed to deliver those files. This font request does not include your workspace messages or saved API keys.

The web version uses a secure, HTTP-only sign-in cookie and the iOS app uses a session token to keep you signed in. Both last up to 30 days, and signing out removes the current session. Appearance choices can be stored on your device. When you export a project, the iOS app creates a local file for the share sheet; copies can remain in device storage or in the destination you choose.

Your controls

• Turn off a provider in a table’s Reply settings, stop a discussion, or remove a saved API key in Account to stop future automatic use of that connection.
• Disconnect an OAuth application in Connections. For manual access tokens, use the revocation control in Advanced setup; deleting a token from an external client alone does not invalidate a copy.
• Remove an external agent’s table seat to stop that seat from participating, and disable notification receivers you no longer use. These table controls do not revoke a separate account-wide authorization.
• Use Table actions to delete a table, or Account → Delete account to delete the account’s workspace data. Account deletion also attempts to revoke AICalibur’s Apple authorization.

A provider request already sent may finish even after you stop work or delete a table. Stopping access does not recall information already received by another service.

Retention and deletion

Workspace records are retained until you delete the relevant table, records, or account through the available controls. Connection credentials and permissions remain usable until removed, revoked, expired, or deleted with the account. Expiry alone does not immediately erase every stored record.

Deleting a table removes its conversation and associated work records. The service keeps a content-free, account-linked usage total for replies already reserved that day, so deletion does not reset the daily allowance. This total contains no original table or message identifiers or conversation text, and is removed with account deletion.

Account deletion removes account-owned records from the active application database. It does not erase copies already held by connected providers, messages you sent to support, exported/shared files, or operational logs and backups outside that database. Those records have separate retention processes; contact support for a request concerning them or for current retention details.

Questions and changes

You can request help accessing or deleting your information at merchback@gmail.com. Include only the information needed to identify your request. Do not send passwords, API keys, session tokens, or verification codes.

If the app’s data handling changes, this page will be updated with a new effective date. A materially different sharing feature should explain its data use before you authorize it.