Privacy Policy · Exponential

1. Who we are

Exponential (the “App”) and exponential.today (the “Site”) are operated by Mefriend Inc.(“we”, “us”), a company organized under the laws of the United States. For anything in this policy, contact us at marc@naly.ai.

2. The short version

Chat content never touches our servers. Prompts, responses, and the files you attach go from your device straight to the model provider you chose (for example Anthropic, OpenAI, or Google). We are not in the path.
API keys stay on your device. Keys you enter are stored locally in the App. We never receive them.
Your workspace is plain files on disk. Tasks, notes, and agent memory are stored locally. Sync to other people or devices is opt-in and off by default.
We don't sell personal information, and we don't run advertising.

3. What we collect

3.1 On the Site

Server logs. Our hosting provider records standard request logs (IP address, user agent, requested page, timestamp) for security and to keep the Site running. These are retained for a short period and then discarded.
Email, if you give it to us. If you join a waitlist, newsletter, or write to us, we keep your email address and message so we can reply. You can ask us to delete it at any time.
Download requests. When you download the App we record the request in server logs like any other page view. We do not attach an identity to it.

The Site does not use advertising cookies or third-party tracking pixels. If we add privacy-preserving, aggregate analytics in the future, we will update this policy first.

3.2 In the App

Nothing by default. The App does not send telemetry, usage analytics, or crash reports to us unless you explicitly turn on a setting that says so. If such a setting exists in your version, it is off until you enable it, and it is described in the App at the point you enable it.
Update checks. The App may contact our update server or release host to check for a newer version. That request includes your current version and platform, not your identity or content.
Optional sync. If you turn on sync or team features, the data you choose to sync (for example tasks and their history) is stored with our infrastructure provider so it can reach your other devices or teammates. You control what is synced and can turn it off or delete it.

4. Third parties you connect

Exponential is a bring-your-own-key product. When you connect a model provider, agent, or integration (GitHub, Notion, Figma, a local model runtime, and so on), your data goes to that service under their terms and privacy policy, not ours. Please review them. We recommend using API keys scoped to what the App needs.

We use a small number of service providers to run the Site and any opt-in cloud features: web hosting and edge compute, a managed database for opt-in sync, and a release host for App downloads. Each processes data only on our instructions.

5. How we use information

To operate, secure, and improve the Site and App.
To deliver opt-in features you turn on, like sync.
To answer you when you contact us.
To comply with law and enforce our Terms.

We do not use your data to train models.

We share information only with the service providers described above, when required by law or legal process, to protect the rights and safety of users or the public, or as part of a merger or acquisition (in which case this policy continues to apply to your data). We do not sell or rent personal information, and we do not share it for cross-context behavioral advertising.

7. Retention

Local data lives on your device for as long as you keep it. Server logs are kept for a limited period for security. Email correspondence is kept until you ask us to delete it or it is no longer needed. Opt-in synced data is deleted when you delete it in the App or close your account, subject to short-lived backups.

8. Your choices and rights

You can access, correct, export, or delete your local data yourself, because it is plain files on your machine. For anything we hold (email, synced data), email us and we will access, correct, or delete it. We will not treat you differently for exercising these rights.

California residents.You have the right to know what personal information we collect and how it is used and shared, to request deletion, and to opt out of the sale or sharing of personal information. We do not sell or share personal information as those terms are defined under California law. We honor Global Privacy Control signals where applicable. We do not currently respond to browser “Do Not Track” signals because there is no tracking to turn off.

EEA, UK, and Switzerland. Mefriend Inc. is the data controller for the limited data described here. Our legal bases are performance of a contract (delivering the App and features you turn on), legitimate interests (security, keeping the Site running), and consent where we ask for it. You have the rights of access, rectification, erasure, restriction, portability, and objection, and the right to lodge a complaint with your supervisory authority. Data may be processed in the United States; where required we rely on standard contractual clauses.

9. Security

We use industry-standard measures (encryption in transit, access controls) for the systems we operate. Because most of your data is on your own device, your device security matters most: keep the OS updated and use disk encryption. No system is perfectly secure, and we cannot guarantee absolute security.

10. Children

The Site and App are not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact us and we will delete it.

11. Changes

We may update this policy. If the changes are material we will post a notice on the Site or in the App before they take effect. The “Effective” date at the top tells you when it was last revised.

12. Contact

Questions, requests, or complaints: marc@naly.ai.