unwynd holds the most sensitive combination of data a person has: your work patterns and your body. We think the only honest way to earn that is to make the protections structural — built into the database, the encryption and the code paths — and then show you exactly what they are. This page is that. No dark patterns, no ads, no data sales, ever.
Every table that holds your data is protected by PostgreSQL Row-Level Security — enabled and forced — so the database itself refuses to return another person's rows, even if our application code had a bug. Our app connects as a role that cannot bypass these policies. We prove the isolation with a cross-user test on the live system: the query that tries to read someone else's data must return zero rows, every deploy.
Documents you capture, connector tokens and push tokens are encrypted at rest with AES-256-GCM under keys held in AWS; device-linked stores additionally use per-user wrapped data keys. Deleting your account hard-deletes your rows across every table (a cascade we verify with an automated round-trip test) and purges your stored files — deletion is a real erase, not a flag. Disconnecting a source deletes its tokens and its data the same way.
Your health numbers — sleep, heart rate, HRV — never enter an AI model's prompt. Answers about your health are computed by deterministic engines from your own record, and your numbers are appended to the reply after the model's words. The guard raises an error if code ever tries to break the rule, and a test pins it on every change.
Your data is never used to train AI models. When you ask unwynd a question, it answers only from your own records and cites its sources — and when it doesn't have the data, it says so instead of guessing. Patterns are computed with conservative statistical gates: too little history means silence, not a made-up finding.
Mark any capture as sensitive and unwynd never reads it: no AI extraction, no text in any model context, ever. It's stored encrypted for your eyes only, and if you ask about it, unwynd hands you back the original document rather than describing its contents.
The calendar connector stores timing and a bounded title (trimmed to 120 characters) — so unwynd can say “the 16:30 lands on your Gym block” instead of “an event moved.” Descriptions, attendee lists, locations, links and notes are never stored. Your employer sees nothing — unwynd is yours, not theirs.
If you link WhatsApp, it works one way: things you send in become private captures. Replies are limited to a fixed set of acknowledgements — there is no code path that can put your documents, health data or extracted details into a WhatsApp message. Your phone number itself is never stored — only a salted fingerprint that lets us recognise you.
UK/EU infrastructure (AWS London for storage and AI inference), daily encrypted off-site backups, strict per-user and per-endpoint rate limits, and hard daily cost caps so no account can be abused into a runaway bill — yours or ours.