Privacy

Ask Bunter is a private, invitation-only board: one page that shows a person their own mail, calendar, files, bank, health and other sources they connect, with an assistant that answers questions about them. One person runs the server and invites the others; each person has a board of their own. This page says what is stored, where, who can reach it, which outside services are involved, and how to delete it. Last updated 10 October 2026.

What is stored about you

Your account: your name, username, email address, a hash of your password (never the password itself), and the browsers, phones and Chrome extension you are signed in on.
What your connections bring in: the mail, events, files, payments, balances, health figures, news and website data you choose to connect, copied into the board's database so your board can show it and your assistant can search it.
The keys and passwords you give the board to reach your connections (an API key, your Garmin password, a bank's private key, your session for a linked website). They are kept on the server, never shown again and never given to the assistant. They are stored in the board's database without separate encryption.
What you make on the board: your layout, your chats with the assistant, your briefings and their spoken clips, your reminders, your text message rules, your friends, groups and messages.

Your data is not sold, not used for advertising, and not shared with anyone, except what you choose to share yourself (below) and the outside services listed on this page, each only for the job described.

What it reads from Google

When you connect a Google account, you grant read-only access to:

Gmail (gmail.readonly): your messages, to show recent mail on your board and let your assistant search it.
Google Calendar (calendar.readonly): your events, to show your day and week.
Google Drive (drive.readonly): your files' names and text, to list recent files and let your assistant search them.

Ask Bunter cannot send, delete or change mail, events or files with these permissions. Your Google sign-in is stored on the server as a token, never shown again and never sent to the assistant. The person who runs the server may also connect read-only search statistics for their own websites (webmasters.readonly) to their own account; it is never asked of anyone else. If you sign in to the board with Google, only your email address is read for that.

Ask Bunter's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Your bank

Bank accounts are read through Open Banking, via Enable Banking, a licensed provider you register with yourself. Your bank sends your balances and payments, read-only, to Enable Banking, which hands them to the board under your own approval (renewed at least every 90 days). Nothing can move money this way. Enable Banking's own privacy terms apply to what passes through it.

Health: WHOOP, Garmin and Apple Health

WHOOP and Garmin: the board reads your recovery, sleep, activity and heart figures from your own account with them, with the access you approve (WHOOP) or your Garmin Connect sign-in (Garmin; your password is kept on the server and used only to renew Garmin's session).
Apple Health: if you connect it in the Ask Bunter iPhone app, iOS asks you which figures it may read (steps, walking distance, active energy, exercise minutes, heart rate, resting heart rate, heart rate variability, blood oxygen, sleep). The app reads them on the iPhone when you open it and sends one figure of each per day to your board. It never writes to Apple Health. You can stop it in the app (Settings → Connected accounts → Apple Health → Turn off) and change what it may read in the Health app (your picture → Apps → Ask Bunter). On an iPhone it goes to one account: if someone else signs in to Ask Bunter on your iPhone, the app sends them nothing of your Health unless they connect it there, which first warns them and then stops it going to you.

Health figures are treated like the rest of your data: shown to you, used by your assistant when you ask it, never sold or used for advertising.

Text messages and Apple Pay

If you set up the text message shortcut on your iPhone, it sends the texts you choose to your board as they arrive. Your rules (Settings → Text messages in the iPhone app) decide what becomes of each: a payment, a message kept, one kept and flagged for you, or not kept. A text not kept is not stored at all: only how many texts the rule took, and when the last came. A notification about a flagged text names who sent it, never its words. The Apple Pay shortcut sends the merchant, the amount and the card of each in-store payment.

Websites you link with the Chrome extension

The Ask Bunter extension records, on the one tab you choose and only while its bar is shown, how the website fetches your data: the addresses it calls and the answers, which contain your data on that site. It sends this only to the Ask Bunter server, over HTTPS.
On the server, the recording is kept with passwords, cookies, tokens and other credentials removed. The assistant reads it that way, once, to learn the site and suggest cards for your board.
Your session for the site (the cookies or token that keep you signed in) is kept on the server separately, as that connection's key, so the board can fetch your data later. If you allow it, the extension opens the site in a background tab for a few seconds now and then to hand the board a fresh session. A password you type on the board to sign a site back in is used for that one sign-in and not kept.
The extension shows whose board it is connected to. It is disconnected when you sign out everywhere else, change or reset your password, or delete your account.

Outside services

Anthropic (the assistant, Claude): when you ask a question, when your briefing is written, when your news summary is written (from the headlines in your News section), when something you asked it to watch is checked, when a linked website is learned, and when payments are sorted into categories, the question and the passages of your data needed for it are sent to Anthropic to produce the answer. Anthropic processes them only to return the result and, under the terms of its API, does not use them to train its models.
A natural voice: the briefing and the news summary are normally read aloud by a voice that runs on the server itself. Only if the person who runs the server has set up ElevenLabs is their text sent to ElevenLabs to be read.
Logos: the server fetches the small logos of the services and sites on your board from DuckDuckGo's icon service (and Google's, when DuckDuckGo has none) and serves them itself. It keeps them for you alone, so nobody else can tell which ones your board shows, and deletes them with your account. Those services only ever see the server asking for a domain name, never who looks at it. Pictures inside news stories and items (a product photo, a coin's logo) are loaded by your browser or app from the site that published them.
Apple: if you turn on notifications in the iPhone app, the server sends them through Apple's push service: who asked to be friends, accepted, added you to a group (and its name), or wrote to you (and the group's name), and how many requests and messages wait. Never what a message says, and nothing of anyone's board. The app's device token is kept until you turn notifications off or sign out on that iPhone. The iPhone app itself comes through Apple's TestFlight. If you turn on Sign in with Apple, Apple tells the board which Apple ID it is (an id made for this app); the board keeps only that id, on your account, to know whose board to open. Words you speak to the chat in the iPhone app are turned into text by Apple's speech recognition, on the iPhone itself where it can.
Your own AI assistant, if you connect one (Settings → Account → AI assistants, for Claude Code or another MCP client): it reads your board with a token of its own, read-only, and what it reads goes to the company that runs that assistant, under their terms. Nothing goes to it unless you connect it; turning it off stops it at once.
Mail: confirmations, password resets, friend requests and the goodbye mail are sent through the Gmail account of the person who runs the server, with Ask Bunter as the sender's name.
Your connections themselves (Google, your bank through Enable Banking, WHOOP, Garmin, a website you link, a service whose key you give) are reached only to read your own data from them.

Nothing else from your data leaves the server, unless you connect an assistant of your own (above). The board's page loads its typefaces from the board itself, never from a font service.

Nothing is shared until you pick it. On Share your board you pick whole sections or single cards, and you can take any of them back at any time.
Money figures (balances, what you spent, each payment, what your collections are worth) are not shared until you turn on Show amounts, for all your friends or for one of your groups: until then others see ••• in their place.
Friends are people on this server whose friend request you accepted, or who accepted yours. They see the cards you picked, as they are now and read only. They see your name and username, never your email address.
Groups you make of your friends see what you pick for each of them, on top of what all your friends see. Everyone in a group sees its name and who is in it (names and usernames, never email addresses).
Your link, if you make one, opens the cards you picked for anyone who has it, without signing in: send it only to people you would show them to. You can replace it or turn it off at any time. The page it opens asks search engines not to index it.
A shared card shows what the card shows and no more: a mail card shows the sender, the subject and a short preview, never the recipients; a calendar shows when and where, never an event's notes or guests; the spending card shows totals, not each payment. Your own email addresses are taken out of everything shared. Needs attention, linked websites and the assistant's usage are never shared.
A friend request sent to an email address reaches only the person who has shown that address is theirs, and never tells the sender whether the address has a board here.

Messages

You can write to your friends, and in the chat of a group you are in. Messages are text only and are kept in the board's database, for the people in that chat. They are not end-to-end encrypted: like the rest of the data, the person who runs the server could technically read them (below).
Someone added to a group reads its chat from the moment they were added, and someone who leaves it no longer sees it. You can unsend a message you wrote (its words are deleted for everyone), and clear a chat for yourself.
Messages are never sent to the assistant or any other service, and notifications never carry what a message says.

Where it is kept, and who can reach it

On a server in Germany (Hetzner), in a database that is not reachable from the internet; the board is served over HTTPS and needs your sign-in.
You see your board. Other people on the server have boards of their own and never see yours, except what you share.
The person who runs the server administers it and can, technically, reach its database and files: everything on your board, the keys and passwords you gave for your connections, your chats and your messages. They do so only to keep the service running.
Logs: the server's log records requests and errors, and your email address when you sign in, never passwords or keys. Server logs are kept for up to 30 days.
Backups: if the person who runs the server keeps backups of the database, your data is in them until they are replaced.

Password resets

A forgotten password is reset with a link mailed to your confirmed address, or with a one-time link the person who runs the server makes for you. You get a mail when such a link is made for you and when it is used, so a reset you did not ask for never goes unnoticed.
Any password reset signs you out everywhere (the Chrome extension too: press Connect the extension again on your board), stops the access token your shortcuts send with, and stops notifications on your iPhones until you sign in there again.

Removing your data

Everything: on the board, ☰ Settings → Account → Delete my account (in the iPhone app, Settings → Account). It deletes your account and every record, file, chat, briefing, connection and key that belongs to it, your linked websites, your groups (and their chats) and every message you wrote, withdraws your Google access at Google, and signs you out everywhere. You get a goodbye mail, and the person who runs the server is told that you left.
A connection: ☰ Settings → Sources → ⋯ → Remove connection deletes its key and the items it saved. Chats and briefings that quoted them are kept.
A Google account: ☰ Settings → Connected accounts → remove (the first account too). The board's access is withdrawn at Google and what was synced from it is deleted. You can also withdraw the permission at myaccount.google.com/permissions; the board then receives nothing more.
A linked website: its row under Linked websites → Remove deletes what was recorded and learned, its session and its cards.
A message: unsend it from the chat; its words are deleted for everyone in it.

Questions

Ask the person who invited you to this board.