Privacy Policy

This policy describes what the Invoke text-message service collects, who receives it, how long it is kept, and what you can delete. It describes how the service works on the effective date above, not how we intend it to work later. Where something cannot be deleted yet, this policy says so.

The service is operated by Invoke AI. Invoke AI is not yet a registered company; it is run by its developers from Massachusetts, United States. You can reach us at support@useinvoke.ai.

What Invoke Is

Invoke is a personal assistant you reach by text message. You text it in plain language and it replies: it remembers things you tell it, keeps a to-do list, and sends reminders you ask for. If you connect an email account, it can also help with your email and calendar. Google works today. Yahoo will work once Yahoo approves our access.

You opt in by entering your phone number on useinvoke.ai and checking the consent box, or by texting our number and replying YES. Either way you agree to receive recurring automated text messages from Invoke AI. Message frequency varies with how much you use the service. Message and data rates may apply; your carrier's messaging plan sets them.

Information We Collect

• Phone number. Stored as a plain number in the records that send and receive your messages: your account, your conversations, your messages, your connected-account records, and some link and delivery records. A SHA-256 hash of the number is also used as your identifier in our event log and in some other tables. See "How We Store Your Phone Number" below.
• First name and email address, when you sign up on the website. The email address is optional. We do not send a verification code to it. If you give one, we store it and use it only as this policy describes. If you later connect a Google account and your record has no email address, the Google account's address is saved as your email. We do not send marketing email. When you sign up, the operators receive a text with your first name, the last four digits of your number, and the domain of your email address.
• Message content. Every text you send and every reply we send, word for word, in both directions. Replies can include details from your email or calendar when you asked about them.
• Delivery status and timestamps. When each message was sent or received, and whether the carrier delivered it. Delivery reports from our SMS provider store your number and the delivery outcome.
• Images and video (MMS). An image you send is sent to a vision model to describe it. The description is kept in your conversation state for 24 hours so follow-up questions work. When image storage is turned on, the image itself is saved in a private storage bucket, with a download link that expires after 7 days, together with its description. Stored images are not deleted today. For a video, one frame is sent to the vision model and the audio track is sent to a transcription model; the video itself is not stored.
• Location (one-time). If you share your location through a one-time link we text you, your browser sends the coordinates to our server, and the coordinates are sent to OpenAI, the provider whose model (gpt-4o-mini) generates Invoke AI's replies, as part of that one request. The model is told to answer without repeating them. We do not save the coordinates in our database or logs; only a rough accuracy level (fine or coarse) is logged. The reply, like any other message, is stored in your conversation history. If you type a city name to ask about the weather, the city is saved in your conversation state and sent to the weather provider.
• Memory and preferences. After each conversation session, and sometimes during one, a model reads what you said and saves facts and preferences about you (for example, people, places, and how you like things done). We also save a two- or three-sentence summary of each closed session. These are shown to the model on later turns so it can remember you. Ask Invoke what it remembers about you to see what is saved.
• Connected email account data, when you connect one. Google works today. Yahoo is pending Yahoo's approval. See "Google Account Data" below, which also states the rules for any other provider.
• Gmail address at early-access intake. While the Google connection is in testing, Invoke asks which Gmail address you will connect before it can send you the connection link. That address is stored with your phone number, and both are texted to the operators, who enter the address into Google's tester console by hand. This step applies to Google only.
• Things you create. To-do items, reminders, and lists you keep with Invoke; feedback you type after //run-tests; and the text of any // command we do not recognize, which is saved as a feature request.
• IP address at signup. A SHA-256 hash of your IP address is saved on the verification record. The plain IP address is kept for a short time to limit repeated signup attempts and is then purged. The IP address is also sent to Cloudflare for the bot check on the signup form.
• Information about other people. If you share a contact card or use //connect, the other person's number and name are stored, even if they never text Invoke. When you ask about your email or calendar, senders, subjects, message text, and attendees pass through the request. In a group room, each member's number, display name, and messages are stored.

How We Store Your Phone Number

We store your phone number. We need it to send you text messages, so it is kept as a plain phone number in the records that send and receive them.

In our event log and in some other tables, the number is replaced with a SHA-256 hash of the number. A hash of a phone number is not anonymous. The set of possible phone numbers is small enough that someone with access to the hash could match it back to the number by trying each possible number. We treat the hash as another copy of your phone number, protected by the same access controls, not as a way of hiding it. Replacing it with a keyed hash, which cannot be matched back to the number without a secret key that we hold, is planned (issue #1666).

Message and email content is not written to the event log. The one exception is an unrecognized // command, where the command word you typed is recorded. The event log does hold identifiers: your phone hash, and, for Google events, the address of the connected account.

How We Use Your Information

• To read your messages and send replies.
• To remember facts and preferences across sessions.
• To send reminders you set, at the time you set them.
• To act on your email and calendar when you ask and confirm.
• To send service messages: waitlist admission notices, referral notices, and a note when a new feature becomes available to you. We do not send advertising or offers by text.
• To find and fix errors, and to measure whether the service is working.
• To keep records that telecommunications rules require, such as when you opted in or out.

Who Receives Your Information

We do not sell your personal information. We share it with the service providers below, which process it to run the service for us, and with authorities where the law requires it.

We do not share mobile numbers or text messaging opt-in data and consent with any third parties or affiliates for marketing or promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties, other than service providers that handle it only to operate the service for us, such as the companies that deliver our text messages and host our data, or where the law requires it.

• Model provider (OpenAI). Every reply is generated by sending OpenAI your current message, the messages of your current session, up to six messages carried over from your previous session, up to three recent session summaries, up to ten remembered facts, the email addresses of your connected Google accounts, references to your recent email and calendar results, and any image description from the last 30 minutes. When you ask about email or calendar, the content fetched for that request is sent too. Images, a video frame, a video's audio track, one-time location coordinates, and test feedback are also sent when you use those features. Your phone number and name are not sent unless you typed them in a message. OpenAI keeps what it receives under its own API retention terms, which we do not control. Invoke AI does not train any model on your data.
• SMS carrier (Twilio). Every message in both directions, your number, and any images you send pass through Twilio, which keeps its own copy of message records. Twilio also sends us delivery reports. For signups that came through a referral link, we ask Twilio whether the number is a mobile line.
• Database and file storage (Supabase). Everything described in this policy that we store is stored in Supabase, including the backups Supabase keeps on its own schedule.
• Hosting (Fly.io and AWS). Fly.io runs the text-message service. AWS runs this website and sends the signup verification email (Resend is the fallback email sender). Server logs on both can contain your phone number in some error and rate-limit lines; log retention is set by those providers.
• Error reporting (Sentry). When the service hits an error, a report goes to Sentry. Reports are filtered: phone-number-shaped text is replaced, and request data, cookies, and local variables are removed. An error message can still quote text from a message. A small sample of request records (URLs and headers) is also sent, and those are not filtered.
• Bot check (Cloudflare Turnstile). The signup form sends your IP address and a challenge token to Cloudflare to check that you are not a bot.
• Weather (OpenWeather). The city you type when you ask about the weather.
• Email providers (Google today, Yahoo pending approval) and Spotify. Only if you connect an account; see the sections below.
• Shopping (Shopify). If you use a shopping command, your search terms and cart go to the store, and the store reports your phone number back to us when an order is placed.
• Operator AI tooling (Anthropic). The operators build and run the service with AI coding tools from Anthropic (Claude). Those tool sessions can read production records, including message text and phone numbers, when an operator uses them to fix an error or check the system. What a session reads is sent to Anthropic under its API terms.

Google Account Data

If you choose to connect a Google account, Invoke AI asks Google for these permissions and uses them only to provide the features you request in the text conversation:

• Identity (openid, email, profile): the email address, name, and profile picture of the Google account. We use the address to tell you which account is connected, and we save it on your connection record and in our event log.
• Gmail (gmail.modify): we search and read messages only when you ask Invoke AI to find or read email. Search results carry the sender, subject, date, and a short snippet; a message you ask to read is capped at about 1,500 characters. We send an email only after you reply YES to a specific draft. We move messages to Trash only after you reply YES to a specific list of messages. Trashing changes the message's labels; we do not permanently delete mail.
• Calendar (calendar.events): we list events you ask about, and we create, update, or delete an event only after you reply YES to that specific change.

We do not request access to Google Drive or to any other Google service.

Storage and retention: Google access tokens are stored encrypted (AES-256-GCM) in our database. Email and calendar data fetched for a request is used to answer that request and is sent to the model provider as part of it. References to those results (message ids, senders, subjects, dates, event titles and times, not message text) stay in your conversation state until the session closes so follow-up messages work. A draft email or calendar change waiting for your YES is stored until you answer or it expires. We do not keep a copy of your mailbox or calendar. Replies we send you can include details from your email or calendar, and those replies are stored in your conversation history like any other message.

Disconnecting: Texting //disconnect google stops Invoke AI from using the connection, sends Google a request to revoke it, and deletes the stored tokens in the same step. The connection record itself (which account, when it was connected and disconnected, no tokens) stays until you delete your account (see "Deleting Your Account"). To make sure access is removed, you can also remove Invoke AI at myaccount.google.com/permissions.

Invoke AI's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We do not use data obtained through Google APIs to serve advertisements, and we do not sell, transfer, or share that data for any purpose other than providing or improving the user-facing features of Invoke AI.

We do not use Google user data to develop, improve, or train generalized AI or machine learning models.

No human at Invoke AI reads your Gmail or Calendar data except: (a) with your affirmative consent for a specific support issue, (b) to investigate abuse, malware, or security incidents, or (c) to comply with applicable law.

Other email providers. The same rules apply to any other email provider we connect, such as Yahoo once Yahoo approves our access. We read your mail only when you ask. We never use it for ads and never sell it. You can disconnect at any time, and "Deleting Your Account" covers deletion.

Spotify Account

If you connect Spotify, we receive your Spotify id, email address, and display name, and we store the access tokens encrypted. Texting //disconnect spotify stops Invoke AI from using the connection, marks it revoked in our database, and deletes the stored tokens in the same step; the connection record itself (which account, when it was connected and disconnected, no tokens) stays until you delete your account. Spotify does not provide a way for us to withdraw the grant on its side, so to remove Invoke AI's access to your Spotify account, visit spotify.com/account/apps.

Group Rooms

If you join a group room, your number, display name, and consent state are kept permanently as the record of your consent, and the messages you send to the room are stored and relayed to the other members. When any member uses a // command in the room, the room's last 30 messages from every member, labeled by name, plus the room's shared memory are sent to the model provider. When a room closes, its messages are distilled into shared memory. Leaving the room or texting STOP ends your participation but does not remove these records; deleting your account removes your membership and the room messages you wrote.

Links We Text You

//mypage texts you a link to a page that shows your display name, join and last-active dates, session summaries, remembered facts, connected apps, and lists you keep. Anyone who has the link can open the page. The link does not expire; text //resetlink to replace it. //profile texts you a link and a code to edit your display name, time zone, and reply length; it expires after 10 minutes. These links are stored in your message history like any other text.

Who at Invoke Can See Your Data

The two operators who run the service can read every record described here, including message text, phone numbers, names, and email addresses, through an admin dashboard, a database query tool, and the AI tool sessions described above. Some of those reads are logged; most are not yet. Operators read a user's records only to fix an error, to investigate abuse or a security incident, to answer that user's own request, or where the law requires it.

Retention and Deletion

What we keep, and for how long. Messages, delivery records, session summaries, event-log rows, your account record, to-do items, reminders, lists, feature requests, and test feedback are kept indefinitely. No automatic deletion job runs on them today. Signup verification records are purged after 24 to 48 hours. A draft waiting for your YES expires on its own. Our service providers keep their own copies for their own retention periods. Twilio keeps its own message records, and we do not delete them today. OpenAI keeps API content under its retention terms, Supabase keeps database backups, and Fly.io and AWS keep server logs; we cannot delete those copies on demand.

What you can delete today.

• Text forget everything to delete every remembered fact and preference, blank the summaries of your closed sessions, and clear any stored image description. Ask Invoke to forget a specific item to delete only that one. Your messages, your account record, and the event log are not affected.
• Text //disconnect google or //disconnect spotify to revoke the grant and delete the stored tokens. The connection record stays.
• Reply STOP to stop all messages. STOP blocks your number and pauses your reminders. It deletes nothing.

Deleting everything. You can delete your Invoke account and its data from your phone. Text //delete my account, or ask in plain words. Invoke replies with a list of what will be removed and how many items are in each group. Nothing is deleted at that point. The next section describes what the command removes and what stays.

Deleting Your Account

How to ask. Text //delete my account, or ask in plain words such as "delete my account." Invoke replies with a list of what will be removed and how many items are in each group. Nothing is deleted at that point.

How to confirm. Reply with the exact phrase DELETE MY ACCOUNT within 10 minutes. That phrase is the only reply that carries it out: YES does not, and any other reply keeps your account. If your account changed between the proposal and your confirmation, Invoke sends a new proposal instead of deleting. Deletion cannot be undone.

What is removed. In one database transaction, everything stored under your phone number:

• your account and sign-up records, including your name, email address, consent record, referral credits, and invite codes you created;
• your conversations and messages, in both directions;
• everything Invoke remembered about you, your preferences, and your session summaries;
• your to-do items, reminders (including reminders not yet sent), and lists;
• image records and their descriptions;
• your connected-account records and tokens, and any draft waiting for your YES;
• your group room memberships and the room messages you wrote (other members' messages stay with them; a room you created is marked as created by a deleted user);
• contacts you added, and connection requests you sent or received (another user's address-book entry for your number stays with that user);
• feedback, feature requests, and notes you sent;
• link tokens, delivery records, and shopping carts.

Where another person's record names you (for example, an account you invited, or an invite code you used), your identifier is cleared from their record and their record stays.

Connected Google accounts. Before the tokens are deleted, we ask Google to revoke Invoke's access for each connected account. If Google does not confirm, the tokens are deleted anyway and your receipt names the account so you can remove Invoke at myaccount.google.com/permissions.

What we keep, and why. One record with three fields: a keyed hash of your phone number (an HMAC with a secret key we hold, which cannot be matched back to the number without that key), the time of deletion, and whether you had opted out of text messages. It exists so that we do not text you again and so that we can show the deletion was honored. If you had opted out before deleting, that mark stays in force and we will not text you unless you reply START. If you text Invoke again, you start as a new user with no memory of the deleted account.

Event log. The rows in our event log for your past activity stay, with every identifier removed in the same transaction: your phone hash, email address, name, Google account address and id, carrier message ids, and any free-text fields. What remains is the event type, its time, and details that do not identify you, such as counts, tool names, timings, and an internal account id that no longer points to any record.

Copies held by other services. Stored image files and Twilio's records of your messages are written to a deletion queue in the same transaction. A background job then deletes them from those services, retrying a failed item up to 10 times over at most 7 days; an item it still cannot delete is left for the operators to remove. Your receipt says when items are queued. OpenAI's copies of request content, Sentry error reports, Supabase database backups, and server logs are kept by those providers for their own retention periods, and we cannot delete them on demand.

Your last message. After the deletion, Invoke sends one receipt saying what was removed and, if any, which Google account did not confirm. The receipt is not stored. If a step did not finish, the receipt says so and a retry job finishes it; the job retries up to 10 times and then tells the operators. Either way, we do not text you again unless you text us first.

Your Choices

• Opt out. Reply STOP, STOPALL, UNSUBSCRIBE, CANCEL, END, QUIT, OPTOUT, or REVOKE to any message. A plain-language request to stop, such as "please stop texting me," is honored the same way. You will get one confirmation text and nothing more. STOP blocks your number, pauses your reminders, clears any draft waiting for your YES, and removes you from group rooms.
• Opt back in. Reply START or UNSTOP to return to the access you had before STOP and to resume paused reminders. Group room memberships are not restored: START marks you as having left each room, and rejoining a room needs a new YES on that room's number. If you opted out by STOP, replying YES does the same as START.
• Help. Reply HELP to any message. If your number has been admitted, the reply names the commands, the reminder controls, and our contact address. If you have not joined yet or are on the waitlist, the reply explains how to join or that you are on the waitlist, and gives our contact address.
• See what we hold. Ask Invoke what it remembers about you. //my-preferences lists saved preferences, //connections lists connected accounts, and //mypage links to your page.
• Correct. //profile edits your display name, time zone, and reply length. To remove a remembered fact that is wrong, ask Invoke to forget it.
• Delete. You can delete your Invoke account and its data from your phone. Text //delete my account, or ask in plain words; see "Deleting Your Account."
• Export. We do not offer a data export today.

Age

Invoke is for people 18 and older. We do not knowingly collect information from anyone under 13. If we learn that a user is under 13, we will block the number and remove the data we are able to remove.

Security

Connections between our services and our providers use TLS. Connected-account tokens are encrypted with AES-256-GCM. The database is reachable by the service, by the two operators, by the AI tool sessions the operators run, and by the providers that host it. Text messages themselves travel over the carrier network, which we do not control. As described above, the phone hash is not anonymous, some server logs contain phone numbers, and most operator reads are not logged yet.

Carrier Liability

Carriers (for example T-Mobile, AT&T, Verizon) are not liable for delayed or undelivered messages. Message delivery is subject to your carrier's network availability and coverage area.

Changes to This Policy

When we change this policy, we update the effective date at the top and add a line to the change log below. Changes that affect what we collect or share take effect on the date shown. Continued use of the service after that date means you accept the updated policy.

Change log

• October 12, 2026: Email help generalized to any connected email account (Google today, Yahoo pending approval), with one paragraph saying the Google rules apply to other providers. The signup email address is now optional, and we send no verification code.
• October 6, 2026: Account deletion switched on. The three "built but not switched on yet" sentences replaced with how to ask for deletion.
• October 2, 2026: Rewritten to list every category collected, every provider that receives it, the Google permissions actually requested, retention as it is, and the deletion paths that exist. Drive removed. Opt-out keyword list and age statement added. "Deleting Your Account" section added for the account-deletion command.
• October 1, 2026: Location-fix and Spotify disconnect sentences corrected; phone-hash and Google-disconnect sentences corrected.
• September 12, 2026: Google Limited Use and connected-accounts sections added.

Contact Us

Questions about this policy: support@useinvoke.ai