Privacy

last updated 14 October 2026

Caime is messaging that understands the difference between the people in your life. This page says what Caime keeps about you, why, who else sees it, how long it’s kept, and what you can do about it. Caime is run by DATA C OÜ (16589957, Harju maakond, Tallinn, Lasnamäe linnaosa, Sepapaja tn 6, 15551), which is responsible for your data (its controller, in the words of data protection law). Questions about it go to hello@cai.me.

What Caime keeps

• Your account. Your email address, your name and @handle, your date of birth, the country you live in, and your password, kept only as a salted hash, never the password itself. Your date of birth is only to check you’re old enough and for the protections that apply under 18; your country only sets your defaults (the days your work notifications wait for, the currency of amounts, the Arabic Cai and the Caime Friends speak with you), and with AI assist on, their AI is told the country too, so what it suggests fits where you are. Neither is shown to anyone. Caime also keeps your device’s language and time zone, so times and quiet hours are right, and, if you joined from someone’s link, whose it was: that’s only counted, and never shown to anyone.
• Your profile. What you choose to show: a photo, About you, pronouns, your gender if you say it (never guessed), a status and your presence (Automatic, Busy, Away or Invisible). Caime also keeps when you were last active.
• The people you know. Who you’re connected with, how you’ve told Caime you know each of them (and how you described them before), what you call them, your requests to connect, the invite links you make (how you’d know whoever joins, what they’re shown, and how many joined), the links you make to join a group or a space you run (where each leads, how many joined through it and when it runs out; the link itself only as a fingerprint, and never who opened it), your asks to join through a link that asks (when, and whether you were let in; its owner and admins see who asked until they answer), and who you’ve blocked.
• What you send. Messages, photos, videos, files, voice messages, places you share, cards (a meeting, an order, a poll) and your votes, and reactions, with which messages each person has received and read, so Caime can show them to the people they’re for. A live location keeps only its latest point, which stays in the conversation. What you start typing is kept as a draft, so it’s there on your other devices too; in a private conversation it stays on the device you’re writing on. Where a photo or a video was taken, and its other hidden details, are removed before anyone sees it: a JPEG, PNG or WebP photo is made again without them, and a HEIC photo, an MP4 or QuickTime video or a recording has them cleared where they are; one that can’t be read for certain isn’t kept at all. Other files, GIFs and WebM videos among them, are kept as you send them, with anything they carry. The first link in a message you write in a conversation that isn’t private is opened once by Caime’s server, to show the title, the description and the picture its page gives itself: the site sees Caime ask, never you or anyone you sent it to, and their devices get the picture from Caime. You can take the preview off before sending; a link in a private conversation or in mail is never opened.
• Private conversations. What each message says is sealed on your device, and the server keeps only envelopes it can’t open. It still knows who is in the conversation, what it’s called and what it’s for, who sent each message and when, which message it answers, reactions, and who has read what. Private conversations carry text only.
• Your calls. Who called whom, voice or video, when, for how long, and whether it was answered, missed or declined. What’s said and shown in a call isn’t kept: it goes between the devices in it, unless everyone in it agrees to Cai recording it (below).
• Cai’s notes in a call. Only when someone in a call asks and everyone in it says yes, each by a button that says so. Then one browser in the call, of someone on Caime, sends each thing said, as it ends, to the speech-to-text provider named below, which turns it into words; Caime keeps the words, each under the name of whoever said it, deletes the audio as soon as it’s heard, and has the provider delete its own copy of the words once Caime has them (it keeps one by default), as it does for a voice note. Caime keeps who asked, each person’s yes or no, and when the notes began and stopped. Whoever was in the call reads the notes from when they joined; anyone may delete their own words, and anyone’s no, at any time, stops the notes for everyone from that moment. The notes go with the call’s line in its conversation. Never in a private conversation, and never with anyone under 18 in the call. Hearing them counts towards the AI assist of whoever asked. A meeting may say ahead that Cai takes notes in its call; everyone is still asked as they join. Whoever was in the call may ask Cai to catch them up on the notes or find their follow-ups: what they may read of the notes goes to the AI provider named below for that answer alone, the catch-up is kept nowhere, and the follow-ups are kept as their own suggestions.
• A call Cai records. Only when someone in a call asks Cai to record it and everyone in it says yes, each by a button that says Cai records; anyone’s no stops it for everyone from that moment, and nothing more is taken. The same browser that takes the notes records everyone’s voices, together, and any screen someone shows, each as a part of its own; cameras are never recorded. It sends them to Caime in pieces of about ten seconds while the call goes on, and Caime keeps them, with the notes, for thirty days (fewer where an organization keeps its conversations for less), then deletes them for everyone. Someone who joins later plays only what was recorded after they joined. Anyone who was in the call may delete the recording for everyone at any time; the notes stay. Whoever asked for it may keep it past that day, and then it counts against their storage until they let it go or someone deletes it; never past an organization’s own retention. Anyone who was in the call may share the recording into a conversation they’re in, where whoever is in that conversation plays the parts the sharer could, for as long as it’s kept; a share goes when the recording does, and is never forwarded on. It goes with the call’s line too, and your export lists the recordings you may play and whether you keep each. While a screen is shown, the same browser also keeps a still picture of it at each change (one every five seconds at most, never a camera), kept with the recording for the same people and time; Cai’s notes of the call read up to eight of those pictures once, through the AI provider named below, so the notes can say what was on screen, and what Cai read stays with the picture. Nothing else of the recording, no voice and no screen video, is sent to any AI provider. Never in a private conversation, and never with anyone under 18 in the call.
• Cai joining in a call. Only when someone in a call asks Cai to join in and everyone in it says yes, each by a button that says so. Then, when someone calls Cai by name, it answers aloud from the notes alone, and everyone in the call hears it; what is one person’s own (their open things, something they ask Cai to keep or to do) Cai writes to that person alone, in the call and in their chat with it, and never says. Cai’s own words go to the text-to-speech provider named below, which turns them into sound; nothing anyone says, and no one’s name, goes to it, and Caime has it delete what it kept of each exchange. The sound is kept an hour for the one browser that plays it, and what Cai said stays in the notes as its own line. Asked about a shared screen, Cai asks the same browser for one picture of the screen shown at that moment (never a camera), sends it with the question to the AI provider named below, and deletes it as soon as it has answered. Anyone’s no, at any time, stops it for everyone.
• Meetings with guests. When you invite someone to a meeting by email address, Caime keeps the address, who invited them and when, and gives the meeting its own group, where the guest sees only that meeting. Their link to join is kept only as a fingerprint, and ends when they’re invited again. Given another time, the meeting invites them again, and what they answered before is let go; called off, they’re sent its cancellation. Joining keeps the name they give, when they first came in and whether they said they’re 18 or over; they’re signed in to that meeting only, until a day after it. The invitation comes from Cai’s address (assistant@), for whoever invited them, and their calendar’s answer to it (coming, not coming, maybe) is kept and shown to whoever invited them; nothing else sent to Cai’s address is read. Someone invited who isn’t on Caime can do nothing else on it. A guest can be invited by a link instead, which the inviter sends them themselves: then Caime keeps only the name the inviter gave, with no address, shows the link to the inviter once (and keeps it only as a fingerprint), and whoever opens it joins that meeting alone. A guest may keep the meeting as a Caime account of their own: the account is that guest, so the meeting and what was said in it stay theirs, and the guest’s sign-ins end then, on every device.
• Booking or writing before an account. On an organization’s page, or a person’s bookable item, someone who isn’t on Caime can book a time or write a message with a name and an email address. Caime keeps the address and the name to send a six-digit code there; what they chose or wrote is kept nowhere until the code comes back (it rides, sealed, in the page’s own address, for fifteen minutes), and an address whose code never came back is removed within two days. With the code, the booking or the message is kept as that address’s, seen by the organization or the person it went to, in one conversation with them; their answers reach the address by email where Caime carries mail, and a reply to that email comes back into the same conversation. A booking held as a call on Caime, once it’s confirmed, and a meeting or an appointment held on Caime sent to someone by email, carry that person’s own link to its call, kept only as a fingerprint: it signs them in to that conversation’s call alone until a day after it ends, keeping the name they give, when they came in and whether they said they’re 18 or over. Signing up with the address makes all of it theirs; an address that has been silent for a year is removed, and its words stay with whoever they went to.
• What Caime works out for you. In conversations that aren’t private, Caime notes the dates, amounts, links, email addresses, phone numbers, reference numbers (an order, an invoice, a ticket), topics (such as Project Atlas), questions and requests in each message. From these, and from a team, a space or a work email domain you share with someone, it suggests actions, decisions, reminders and how you may know someone (such as “Sarah may be your colleague at Acme”). They stay suggestions, with the reason for them, until you accept one.
• Your notifications, each with a short preview, never of a private conversation.
• Your settings. Rules for who reaches you and when, privacy settings, automations and what you’ve saved; the spaces and organization teams you’re in, with your role and title; and the organizations you follow.
• Reports you make: who or what you reported, and why, with what you saw when you made it: the message you reported and up to four before it in that conversation, each with its sender’s name (never a private conversation’s, and never one you had deleted for yourself), or the update you reported.
• A report from a page, without an account (a person’s or an organization’s page, an item or a collection): what you chose and wrote, the page, and the name and email address you gave (neither is asked about a child’s safety). Caime writes to that address twice: to say the report arrived, and to say what was decided.
• An appeal, if your account is suspended: signing in shows you why, and lets you appeal and download your data. Caime keeps what you wrote and what was decided, with the note the person who decided it wrote to you, and mails you the decision.
• Your devices. Each one you’re signed in on, with the network address and browser it signed in from and when it was last used; its address for notifications, if you turned them on; and, for private conversations, its public keys.
• What you let act for you. Access tokens and apps you make, apps you let act for you, and your calendar’s address, with when each was last used. Their tokens and secrets are kept only as hashes.
• Passkeys. For each passkey you add: its public key, the browser it was made in, whether your password manager keeps it on your other devices, and when it was last used. Its private key, and the face, fingerprint or screen lock that unlocks it, never leave your device. A recovery code or a reset link removes your passkeys with every other way in.
• Security records. When you sign up, sign in, sign out, sign out a device, change your password, add or remove a passkey, make new recovery codes or recover your account, Caime records the time, the network address it came from and the browser or device. A sign-in that fails is recorded the same way, with the email or @handle that was typed. Other changes, such as approving a device for private conversations, making an access token, letting an app in or downloading your data, are recorded with the time.
• How Caime is used. Counts and times, such as how many people are active and how long an answer takes, never what anyone wrote or searched for. To apply your plan’s limits and keep Caime safe, it also keeps a log of what you do, never the words: when you send and read messages, connect with someone or use an AI feature, and which one. The server’s own log notes each address asked of it (which can include an @handle) and the network address it came from.

Why

Each of these is one of the grounds data protection law allows (in the GDPR, Article 6):

• To give you Caime: to deliver your messages and run the features you use (our agreement with you, the terms).
• To keep Caime safe: limits on how fast things can be sent, blocks, reports and security records (our legitimate interest in protecting the people on it).
• To bill a paid plan, and keep the records accounting law asks for (a legal obligation).
• With your permission: AI assist, and notifications on your devices. Turn either off at any time (You → Privacy → AI assist; You → Notifications and priorities → In this browser); withdrawing it changes nothing about what happened while it was on.

Caime makes no decision about you by machine alone that has a legal or similarly serious effect on you. What it sorts, suggests or infers is a suggestion you can see the reason for and decline.

Who else sees what

• The people you talk with see what you send them, your name and @handle, when their messages reach your device, and when you’re typing. You → Privacy decides whether they also see your profile photo, About you, pronouns, gender, status, your professional details (with an organization Caime has verified you’re on the team of), when you’re online, when you were last seen, and when you’ve read their messages.
• Anyone on Caime who finds you by your name or @handle (unless you turn off By your name or @handle), by your email address (unless you turn off By your email), or by a phone number you proved yours (while By your phone number is on), sees your name, @handle and what You → Privacy shows everyone: at first, your profile photo, About you and your professional details. People in your groups and spaces see the same.
• Organizations you write to. When you message a business, a clinic, a school or any organization on Caime, its team and the apps it uses see your messages, your name and @handle, and what You → Privacy shows everyone. Its apps can pass them on to the organization’s own systems, outside Caime, and the organization is responsible for what it does with them. If it has an AI agent, the agent reads your messages (not your name) and answers first; it always says it’s an AI, and everything it writes is marked “AI agent”. You see the organization, not which person on its team wrote. If you’re under 18, the organization and its apps are told so. What you write to a clinic, a pharmacy or a doctor may say something about your health: that is sensitive data, and it is the organization’s to look after, under its own duties to you; DATA C OÜ only stores and delivers it on the organization’s instructions, never reads it for anything of its own, and never uses it to train a model.
• An organization at your address’s domain. If an organization proved it controls the domain of an address you confirmed, and lets people with an address there join its team, Caime tells you, and joining is yours to choose. Once you join, its team sees you on it, never which address let you in.
• Apps you let in do only what you allowed. Remove one in You → Connected apps; what it already has stays with it.
• Companies that help run Caime, each only for what it does for Caime. The same list, from the same place in Caime’s code, is what an organization’s data processing agreement names:
  • Google Cloud, Doha, Qatar Runs Caime’s servers, database and file storage. Everything Caime keeps, encrypted on disk and in transit; nothing is read by it.
  • Cloudflare, Inc. Carries every request between your device and Caime’s servers: its network sits in front of them. Your network address and what passes between your device and Caime, which it decrypts at its edge and sends on to Caime’s servers encrypted again (a private conversation’s messages stay sealed); it keeps only what it needs to protect the service.
  • Stripe Payments Europe, Ltd. Processes payments for paid plans. Your name and email address (for an organization, its name and its owner’s email), your plan, and what you paid; your card details reach Stripe alone, never Caime. When you pay an organization by card on its own Stripe account, Stripe processes it for that organization: Caime sends the amount and the card’s note, and Caime takes nothing. Only when the feature is used.
  • Anthropic, PBC Provides the AI behind AI assist, Cai and organizations’ AI agents (Claude). For AI assist, only when you tap it, what that action needs (your draft, a message to translate, a sentence you typed in search, or up to the last 200 messages of the conversation with who sent each and when; for a question you ask Cai in Search, what search found for it in your own messages, decisions and to-dos, up to 12 of each with who and when; for a call’s notes, what you may read of them, each line with who said it and when; never photos, files or voice); for Cai, only with AI assist on and only for what its rules can’t answer, the last 12 messages of your chat with it and a short list of your open items (their titles and the names you see), without your name, and a photo you send it (up to three, at the size a screen shows them) for that answer alone; for an organization’s agent, what the organization told it and the latest messages of your conversation with it, without your name. Nothing from a private conversation, ever. Only when the feature is used.
  • Google, Mozilla, Apple or Microsoft (your browser’s push service) Delivers notifications to your browser when Caime isn’t open. A notification encrypted for your browser alone: the push service can’t read it. Only when the feature is used.
  • Expo (650 Industries, Inc.) Delivers notifications to the phone apps through Apple’s and Google’s push services. What a notification says (a name, a preview), and your device’s push address.
  • Cloudflare, Inc. Relays calls that can’t connect directly between two devices. Both devices’ network addresses, and the call’s media still encrypted end to end: the relay can’t hear it.
  • ElevenLabs, Inc. Turns voice notes, and what’s said in a call while Cai takes notes, into words. The audio of a voice note whose sender has AI assist on, or of one thing said in a call whose people all said yes to Cai’s notes, and nothing else about anyone. Nothing from a private conversation, ever.
  • ActiveCampaign, LLC (Postmark) Sends Caime’s mail: a confirmation code, a password reset link. Your email address and the message, which carries no conversation.
  • ActiveCampaign, LLC (Postmark) Receives mail sent to Caime addresses, and sends as mail the replies written on Caime. Those messages as mail carries them: the addresses, the subject, the words and any attachment.
  • Calls, group calls too, go directly between the devices in them, encrypted. To connect, each device learns the network address of every other device in the call, with the help of a public server that tells a device its own (Google’s). When a network won’t let two devices connect directly, the call goes through a relay Cloudflare runs for Caime instead, still encrypted: the relay sees both network addresses.
• Your contacts, when you look for your people in them. Whether they come from your phone, your browser’s contact picker, a file, or your Google or Microsoft account, Caime reads them on your device and sends only their email addresses and phone numbers, to say which of them are on Caime and can be found by them (a number finds only someone who proved it theirs and lets a number find them); nothing of them is kept, on the server or in your data, and an invitation to the rest is one you send yourself, by WhatsApp, a text or an email. To read a Google or Microsoft account, you sign in to it and allow Caime to read your contacts: Caime’s server trades that permission for access that lasts an hour, hands it to your device without keeping it, and asks for nothing that would let it read them again without you. The account remembers your permission until you remove it there (in your Google Account’s third-party connections, or your Microsoft account’s apps and services). Caime’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
• A Google or Microsoft account you connect, for your calendar. When you connect one under You → Apps and turn its calendar on, you allow Caime to read when you’re busy there, in each calendar of your own (Google asks you separately whether Caime may see the list of your calendars; without it, only your main one is read), and Caime keeps the account’s email address, a permission to read again (encrypted on Caime’s server with a key of its own), and the start and end of each busy time for the next 90 days, read again every 15 minutes, and again before your bookable times are shown or one is booked when the last read is more than 60 seconds old; never an event’s title, its people or its place. Those times only keep your bookable times from being offered while you’re busy, and nobody sees them. From Google, Caime asks for busy times and the list of your calendars alone; Microsoft offers no such permission, so Caime asks to read your calendar’s basics and keeps only the times. When you turn its Plans on, Caime writes your meetings and appointments in Caime into that account’s main calendar, each with its title, whom it’s with by name, when, where (for one held on Caime, its link to join) and a link back to Caime (one still asked for as tentative), keeps them up to date as they’re agreed, moved or cancelled, and invites nobody by it. On an organization’s team that keeps its conversations from its members’ own apps, its meetings and appointments are written as what they are, the organization’s name and the time, never whom they’re with or their own words. Of each event it wrote, Caime keeps the account’s id for it, when it is and a fingerprint of what it wrote, so it can change it or take it out; it reads nothing else of the calendar for it. One the calendar refuses on its own is tried 3 times as it is and then waits until it changes: of it, Caime keeps which one, the calendar’s answer and how many tries, until it’s written or no longer yours to write. From Google, Caime asks to manage events on the calendars you own; Microsoft offers nothing narrower than reading and writing your calendar. An event whose meeting is cancelled or removed in Caime is taken out; one that is over stays in your calendar, as yours. Disconnecting first takes out the events Caime wrote that are still ahead; disconnecting, deleting your account or signing out everywhere deletes what was kept and gives the permission back. Your export lists the accounts you connected.
• Your places. You can add the places you are (home, work), each with its address and, only if you ask, the point where you stood when you added it; nobody looks an address up, and no map service sees one. Each is shown only to whom you choose (nobody until you choose; under 18, your family at most). When you pick one for a meeting or a delivery, its words are copied into that card and stay with it. One you choose for something people book or order from you, which can only be a place anyone may see, is named on its page and copied into each booking or order of it. An organization's places are shown to anyone on its page, to its customers, or to its team, as it chooses. Your export lists your places; deleting one, or your account, deletes it.
• Email addresses and phone numbers you add as yours. Beside the email you sign in with, you can add more addresses and numbers under You → Apps. Each is proven by a six-digit code sent to it (an email by mail; a phone number over WhatsApp, which Meta delivers and which reads nothing of yours) before it counts for anything. Once proven, mail from it is from you, and people who have it can find you by it as by your sign-in email: an address if you let people find you by email, a number if you turn on By your phone number (it starts off for accounts made before it existed). Caime keeps the address or number, how and when it was proven, and the code only hashed, for ten minutes. Removing it, or deleting your account, deletes it. Your export lists them.
• A file from your Google Drive or OneDrive. When you turn on Files for a connected account, you can attach a file from it in a conversation. From Google, you pick it in Google’s own window, which gives Caime that file and no other; from Microsoft, Caime lists your OneDrive as you browse it, since Microsoft offers no such per-file permission, and keeps nothing of the list. The file you pick is copied into Caime as your own upload, and from then on it’s kept, shown, exported and deleted like any file you send. Caime keeps no link to it there.
• Services you choose. If you add the Calendar feed (You → Apps) to Apple Calendar or any other calendar app, that app reads your open actions with a due date, with who asked you or who you’re waiting on, and the meetings and appointments you’ve agreed, with their titles, whom they’re with, notes and places, and so can anyone with its address; while an account you connected writes your plans, the feed leaves to it the meetings and appointments it writes there. Apps under You → Apps → Discover are listed by their developers and looked at once by Caime; Discover shows how many people connected an app, never who, and an app reaches only what you allow it when its own sign-in asks. Opening a shared place on the map takes you to OpenStreetMap.

Some of these companies, and Caime’s servers where the hosting provider above says so, are outside the European Economic Area, in countries the European Commission hasn’t found to protect personal data as the EU does. Where your data goes there, it goes under the safeguards the GDPR asks for (Article 46): the European Commission’s standard contractual clauses in each company’s data processing terms, or, for a company in the United States certified under it, the EU–U.S. Data Privacy Framework. Write to hello@cai.me for a copy of the safeguards for any of them. We don’t sell personal data, and we don’t share it for advertising.

How long it’s kept

• What you keep in Caime stays while your account exists.
• Your conversations with an organization are the organization’s to answer for (it is the controller; DATA C OÜ processes them for it). An organization can set how long it keeps them: each message then goes when that time is up, as a disappearing message does, and the conversation says so to you. It can export its conversations, and it can erase yours at your request, which empties every message in it and leaves a line saying so. Ask the organization; its team does it from its inbox.
• When an organization closes, nothing more is written in its conversations, and you keep yours with it, to read, as your own. Whoever ran it last can still export it for 30 days; then what was the organization’s alone is deleted: its team, its page and settings, its catalog, its AI agent and what it was told, its apps, its updates and its team’s notes on its conversations.
• In a conversation with disappearing messages, each message is emptied within about an hour of its time being up: the setting when it was sent, counted from then, so a change to the setting applies only to messages sent after it. It then shows as “Message deleted”: its words, card and links go, and its files with them unless a copy someone forwarded still holds them, as do the notifications about it. A message you delete for everyone goes the same way at once, and so does what an organization’s apps were sent of it (they’re told it was deleted); reactions to it stay. Decisions and actions made from a message and copies someone forwarded stay, and so does the copy made for an organization’s apps of one that disappeared, for 30 days or the organization’s own time if that’s shorter.
• What a link’s page said of itself, read for its preview, is kept for 30 days by a code made from the link, without the link, who sent it or where, and goes sooner with a message that disappears or is deleted for everyone.
• Security records are kept for a year, and a device’s sign-in for 30 days after it ended. The log of what you do, without the words, is kept for 30 days, and copies of what you send an organization, made for its apps, for 30 days (or the organization’s own time, if shorter). Counts that name nobody are kept a little longer than a year.
• An invite link that ran out or was taken back is kept for 30 days, then forgotten; the people who joined through it stay your connections. An organization’s invite to its team, with the address it was sent to, is kept the same way once it ran out, was taken back or was used; whoever joined through it stays on the team. A link to join a group or a space is kept the same way once it ran out or was taken back; whoever joined through it stays in it. An ask to join is kept the same way once it was answered or taken back, and so is an invitation to a group or a space once it was answered or ran out (who asked you is never in it). A link you gave out to one of your files is kept the same way once it ran out or was taken back, with how many times its page was opened, never by whom; it opens nothing once its message is deleted, you leave that conversation, or it’s taken back. A notification is kept for 180 days, then goes.
• Mail to your address (your @handle at cai.me) is a message like any other, kept and erased with the rest; what the mail was on the wire (its ids, its subject, the addresses) stays with the message, and erasing the message clears the subject and the sender’s address. A sender is taken for who they are only when their mail proves it came from their address (its signature or the server that sent it, checked by Caime itself). Mail that doesn’t is never taken as anyone’s: it’s kept for you under Notices, saying its sender wasn’t confirmed, from a stand-in of its own named only by the address it claims, never answered and read for nothing; unless its domain asks for such mail to be refused, which it then is, unread, as it is at an organization’s address and for anyone under 18. Someone who writes to you by mail and isn’t on Caime is kept as a person only you can see (their address and the name their mail gave) until a year passes with no mail either way, or until every conversation with them is gone; signing up with that address makes that person, and your conversations with them, theirs. A list’s mail or one from an address nobody answers (a newsletter, a no-reply sender) is a notice: kept the same way, one conversation per sender under Notices, muted, and read for nothing. A mail’s layout (its HTML) is kept with it as it came, shown only to the conversation’s people in a sandbox where nothing in it runs or loads (so a tracking image tells its sender nothing), and erased with the message. A mail in’s signature is kept apart from its words, and erased with them. A mail sent from Caime links back to the conversation; following that link, or replying, tells its sender it was seen. Unless its sender turned it off, it also asks the mail provider to say when it’s opened, which shows its sender “Opened, probably”: every such mail says so at its end. A card sent to someone reached by email goes as words in a mail, a meeting’s or an appointment’s with an invitation their calendar adds and answers; that answer, from the address invited and checked as any mail is, moves the card and is kept only as that move. An invitation someone’s calendar mails to your address, from that address’s own organizer, becomes a meeting card from them; your answer to it goes back to their calendar from your address, and their later changes move the same card; the mail itself is kept as any mail is.
• A handle you stop using, by changing it or deleting your account, is kept from everyone for a year, you included, so a link to it can’t come to open someone else. Only the handle and the days are kept, never whose it was, and then it’s forgotten. An organization keeps its handle, even once it has closed.
• Billing records (your plan, what it cost and Stripe’s reference to you) are kept as accounting law requires, also after you delete your account. Reports are kept so the people who run Caime can look into them: what a report holds stays with it whatever is deleted afterwards, until it’s closed and for 180 days after (a year for a report about a child’s safety), and then goes with it; the name and address of someone who reported a page without an account go with it too. An appeal is kept until it’s decided and for 180 days after.
• When you delete your account, it goes at once, with your profile, devices, connections, how you describe people, rules, automations, suggestions, actions, notifications, what you saved, and your reactions and poll votes. Messages you sent stay in other people’s conversations, shown as from a deleted account. Lines in a conversation about what you did (“Sam added Lina”) still show your name, and so do notifications people already have. Files you uploaded that aren’t in any message or album are removed. A group, space or organization you ran passes to someone in it; one nobody else is in is closed. What stays: your handle, kept from everyone for a year (the handle and the days alone, never that it was yours); security records and the log of what you did, until their time is up; copies of what you sent an organization, made for its apps, for 30 days; billing records; reports by or about you; your calls, in the history of the people you called; and your devices’ public keys, so the people you wrote to privately can still check your messages.

Your choices, and your rights

• Download your data: on the web, You → Security → Download your data gives you a file with everything Caime keeps about you, for as long as it keeps each, as the app shows it to you: your account and profile, your privacy settings, how you describe people, your rules, connections, requests to connect and who you’ve blocked; the conversations you’re in or were in, with your settings and drafts, the messages you sent, what you added to others’ checklists, your shares of others’ splits, your reactions and votes; your files, each with a link; your actions, and those people asked of you; what Caime suggested, and the decisions you’re part of; your notifications and calls, your answers to Cai’s notes and your own words in them; your devices, with where each signed in from and which service delivers its notifications; your spaces, organizations and automations, what you’ve saved, the apps and tokens that can act for you, and your billing; what an organization’s apps were sent of your conversation with it; the reports you made; your security records, the log of what you do, and when you used AI features. It leaves out other people’s words (their messages, what they added to a checklist, their notes, and a notification’s or a suggestion’s quote of them); what the app doesn’t show you either, such as who on an organization’s team did what, whether a call or a request was turned down, and what a group you’ve left is called now; reports about you, which would say who made them; secrets, which Caime keeps only as hashes or never shows; and the server’s own log. To ask about anything in it, or not in it, write to hello@cai.me.
• Correct it: change your name, @handle, photo, pronouns, gender, About you and status in You → Profile at any time, and your date of birth there too if it was typed wrong. To correct your email address, write to hello@cai.me.
• Delete it: You → Security → Delete your account.
• Choose who sees what: You → Privacy decides who sees your profile photo, About you, pronouns, gender, status, when you’re online, when you were last seen and when you’ve read a message; whether people can find you by your @handle or your email; and who can send you a message request.
• Keep people away: block or report someone from their page, and report a message from its menu. Block or report an organization from its page.
• AI assist and notifications: AI assist is off until you turn on Use AI assist in You → Privacy (from 18), and you can turn it off there at any time. In a browser, turn notifications on or off in You → Notifications and priorities → In this browser.

Wherever you live, you can ask us what we keep about you, ask us to correct or delete it, object to how we use it, and take it with you. Where data protection law applies (in the EU and the UK, for example), you can also complain to your data protection authority. Write to hello@cai.me and we’ll answer within a month.

Children

Caime is for people 13 and older, from the day they turn 13 where they live, and 18 and older for people who live in Egypt or Saudi Arabia, whose law asks a guardian’s consent for younger people. There, someone younger joins from 13 in Egypt and Saudi Arabia only with their parent’s or guardian’s consent, given in Caime: the parent, on Caime themselves, makes a link for that one child and the child signs up through it on their own device; or the child signs up and their account waits, reaching nothing, while they ask their parent: by the parent’s handle, once they’ve seen who it is, or with a link they send a parent not on Caime yet. Either way the parent agrees on the child’s own account, seeing the date of birth the child gave, which their yes confirms. Someone who says the account isn’t their child’s is never asked again by it, and after three such answers it’s deleted. Caime keeps who agreed, for whom, when and to which words, how it began and how many were asked (never who said no), for as long as the account. A date of birth or a country corrected later follows the same rules: under the youngest age Caime opens there, it isn’t taken; where a parent’s consent is what lets someone in, the account waits for one; and a child their parent looks after asks that parent, whose yes (or a document check that finds them 18 or over) makes the change. Until the child reaches the age where they live, their parent sees whom they’re connected with, never a message, and says yes to each new connection first, whichever of the two asked: a request reaches the other person, or the child, only once the parent has. The child sees who their parent is, what the parent sees, and the requests of theirs that wait. The parent may also choose to say yes to every new way in first: an invitation into a group or a space, an ask to join one, a message request to the child, and the child starting to write to an organization each wait for the parent, who sees who and where, never what anyone wrote; and the child writes first only to people they’re connected with, a connection request asking the parent. The child sees that their parent does, and what waits; the parent can turn it off, and then whatever waited goes on. The parent can withdraw the consent, which deletes the child’s account. A parent who never agrees within seven days, or says the account isn’t their child’s, has it deleted the same way. The rules for people under 18 apply until the day they turn 18. Under 18:

• Adults you’re not connected with can’t find you, by name, @handle or email, and can’t send you a connection or message request unless you share a connection. Nor can they open your profile, unless one of you asked the other to connect or you’re in a conversation together. An adult’s invite link connects you only with someone you know through someone.
• You can’t share a location, whether a place or where you are right now. A file kept as it was sent (a GIF, a WebM video, a document) still carries whatever it holds.
• You can start a conversation only with an organization that has verified who it is, and an organization never writes to you first. It’s told you’re under 18, and its AI agent never answers you. Its apps still can, and what they write is marked Automated.
• Nobody can send an Invoice, an Order, a Purchase order or a Payment request, or an organization’s own card with an amount, in a conversation you’re in.
• Group calls are only with people you’re connected with.
• AI assist, access tokens and apps, Your calendar, buying a plan and running an organization are for people 18 and over. Nothing on your profile (your photo, About you, when you’re online) is shown to everyone, whatever was set before: your connections at most.
• Someone over 18 in a conversation with you can still use AI assist on it, and an organization’s apps get what you write to it.

Security

Passwords are kept as salted scrypt hashes, and passkeys as their public keys alone, for the domain Caime is on. Sign-in sessions, recovery codes, access tokens, your calendar’s address, and apps’ tokens, codes and secrets are kept only as hashes; the exception is an organization’s webhook secret, which Caime keeps so it can sign what it sends. Caime is served over HTTPS, so what passes between your device and Caime is encrypted in transit. The keys of private conversations are made on your devices and never leave them. No system is perfect: if you find a weakness, please tell us at hello@cai.me. If a breach of Caime’s security puts your data at risk, we’ll tell you what happened, what it touched and what to do, without undue delay, and tell the authority as the law requires.

On your device

On the web, Caime sets one cookie, to keep you signed in, and no advertising or analytics cookies; the phone apps keep your sign-in in the phone’s secure storage. So it opens quickly and works offline, the app keeps what you’ve seen recently on your device: your account details, your inbox, the latest messages in up to 30 conversations, your people, actions and notifications, and messages, drafts and actions still waiting to be sent. Of a private conversation it keeps only messages that are still sealed. Signing out removes all of this from that device, and on the web asks your browser to clear the photos and files it kept. If you’re signed out from another device, all of this goes the next time Caime is opened on that device with a network; until then, it opens on what it kept. On the web, Caime also keeps its own files (never your messages) so it can open without a network.

Changes

When this page changes, its date above does. For a change that matters, we’ll say so here before it applies.

Contact

DATA C OÜ · 16589957 · Harju maakond, Tallinn, Lasnamäe linnaosa, Sepapaja tn 6, 15551 · hello@cai.me