Privacy policy

Mum AI SA, a Swiss company (“Mum”, “we”, “us”), makes Mum, a private AI assistant you talk to in Signal. This policy explains what happens to your information when you use Mum and when you visit mum.ai. Mum AI SA is responsible for your information under this policy.

• Signal carries your message, end-to-end encrypted. Signal can’t read it.
• Mum’s Signal line opens it inside sealed hardware. Mum’s Signal account lives in its own confidential computer. Its keys were created inside it and never leave sealed hardware. The processor encrypts that computer’s memory with a key it keeps to itself, so the encryption Signal puts on your message ends inside hardware we can’t read, not on an ordinary server.
• The line passes it to your own Mum, still sealed. Before the line hands anything to your Mum, the two sealed computers check each other’s hardware proof. Your message travels through our relay locked to your Mum, so the relay can’t read it either.
• Your Mum answers. Your Mum runs in its own confidential computer, which nobody else’s Mum shares.

Every sealed computer that touches your messages, the Signal line and your own Mum, works the same way:

• Memory encrypted by the chip. The processor encrypts the computer’s memory with a key that never leaves the chip. From outside, its memory is only scrambled data.
• A signed list of what may run. Each computer starts from a fixed policy that names the exact software and settings allowed inside it. Nothing outside that list can run, nobody can open a shell on it, and its output isn’t readable from outside, so there are no logs for anyone to read.
• Proof before trust. The chip produces a signed report of exactly which software is running. Keys and messages are only handed to a computer whose report matches.
• Public releases. Every version’s fingerprint is recorded in a public transparency log before it can receive any keys. A version that isn’t in the log can’t get your key.

Nobody can log in to them or read what’s inside, including us.

Inside your own Mum (sealed, only your Mum can read it): your chats, memories, notes and files you share. They’re encrypted with a key held in a hardware security module, which releases it only to a sealed computer that proves it’s running a published version of Mum. Copies saved for backup are encrypted the same way. What Mum keeps for you stays until you ask Mum to forget it or your account is deleted.

Outside, in our account records:

• a random account ID (we don’t ask for your name or email);
• your plan and how much of this week’s allowance you’ve used, as a running total, never when you chatted;
• the region your Mum runs in, and the invite you joined with.

The link between your Signal account and your Mum is kept by Mum’s Signal line, inside its sealed computer. Our other systems see only a stand-in reference, not your Signal number or account.

• Your messages. Nothing you say to Mum is stored outside your own sealed Mum.
• Who, when and where from. We don’t keep records of who you talk to, when you talk, or where you’re talking from.
• Logs from the sealed computers. There are none to read.
• Training data. Your conversations are never used to train AI models, ours or anyone else’s.

We don’t keep a record of your messages or when you sent them. While a message is in transit, our relay knows which Mum it’s for and when it arrived, and deletes that within minutes of delivery.

• Mum’s replies and voice messages run on AI hardware that is sealed the same way: the model runs inside a secure enclave on the graphics chip, and before your Mum sends anything, it checks the enclave’s hardware proof and that its software is published. Nobody outside the enclave can read your conversation, including us.
• Reading files and pictures you send, sorting your email, and consolidating Mum’s memories overnight (we call that dreams) run on the same sealed AI hardware.

Browsing with Mum is private. When Mum researches, books or shops for you, its browser and the AI that steers it work on the task for us, and the AI isn’t told who you are.

Mum’s visits are anonymized: they come through ordinary home internet connections in your area, and Mum’s browser uses a standard 1920×1080 window, the most common screen size, so it blends in with ordinary visitors. If you’ve asked Mum to sign in for you, that website knows it’s you.

Websites only get what the task needs, like the name on a booking or the card for a payment you approve. Their own privacy policies apply.

If you save logins or a payment card for Mum to use on websites, they’re kept private in your own encrypted vault in Mum’s browser, and card details are handled by a card payment service. Mum uses them only for tasks you ask for, and it asks for your yes in the chat before every payment. If you say no, nothing is charged.

• Calls and email. When Mum places a phone call or sends an email for you, it goes through call and email services that keep their own delivery record for up to 31 days.
• Services you connect. If you connect your email, calendar or another account, what Mum reads or writes there is only as private as that service. The same goes for an AI model you connect yourself.
• Places and travel. Some place and travel results use Google Maps content. Google’s Privacy Policy (https://policies.google.com/privacy) applies to that content.

If you add Mum to a Signal group, everyone in the group can see what Mum says there. A group’s Mum runs in its own sealed computer. People outside the group can’t see it, and neither can we.

When your Mum works with someone else’s Mum, for example to find a time for dinner, it shares only what your request needs.

Mum is free today. If you pay for a plan later, a payment processor handles the payment and knows who paid. It never sees your chats.

When your account is deleted:

• your Mum’s sealed computer is deleted, with its storage, and its key is destroyed in the hardware security module, so nothing it held can be opened again;
• your encrypted backups are deleted. Locked copies kept for safety disappear within 7 days, and they can’t be read without the destroyed key;
• your Signal link, model access and our account records are deleted;
• we keep one thing: a scrambled fingerprint of your Signal account with this month’s usage total, so deleting and signing up again doesn’t reset the free allowance. It can’t be turned back into your account.

You get a receipt link listing what was deleted. It stays up for 30 days.

To delete your account, sign in to your Mum portal at mum.ai and choose to delete it. It starts right away, and nobody needs to approve it.

While we finish moving everyone to the sealed computers, a copy of early testers’ data stays on our previous servers until each tester confirms everything moved. Then it is erased.

We can only hand over what we have: the account records in section 04. We don’t have your messages, chat history or memories, and the sealed computers can’t be opened, so we have none of that to give.

Wherever you live, you can ask us to:

• tell you what we hold about you, and give you a copy (access);
• give you that copy in a common, machine-readable format, or send it to another service (portability);
• correct anything that’s wrong (correction);
• delete it (deletion; see section 13);
• stop or limit a use of it (objection and restriction).

Most of what Mum knows about you is sealed inside your own Mum, where we can’t read it. Ask Mum in your chat to tell you what it remembers, or to forget something.

We use your information to give you Mum under these terms, and to keep Mum secure and stop abuse. We don’t sell or share your personal information, we don’t use it for advertising, and we don’t make decisions about you by automated means that have legal or similarly significant effects.

Write to hi@mum.ai. We answer within 30 days, free of charge, and we ask only for what we need to find your account. You won’t be treated differently for using these rights.

If you’re in Switzerland, you can complain to the Federal Data Protection and Information Commissioner. If you’re in the European Union or the United Kingdom, you can complain to the data protection authority where you live or work. If you live in a US state with a consumer privacy law, such as California, Colorado, Connecticut, Virginia or Texas, you have these rights under that law too: you can use an authorized agent, and if we refuse a request you can appeal by writing to us again, and then to your state’s attorney general.

mum.ai uses no cookies, analytics or trackers, and it loads nothing from other websites: its fonts and code are served from mum.ai itself. As on any website, the network that delivers mum.ai sees your IP address to send you the pages.

If this policy changes, we’ll post the new version here with a new date. Every new version of the software in Mum’s sealed computers has its fingerprint recorded in the public transparency log before it can receive any keys.

Questions about privacy are welcome at hi@mum.ai.