Goldfish Privacy Policy
1.Introduction
This Privacy Policy describes how Goldfish AI Inc. ("Goldfish," "we," "us," or "our") collects, uses, stores, and protects information in connection with the Goldfish desktop application and related website (collectively, the "Service").
Goldfish is a local-first desktop assistant. It reads text from your screen using your device's accessibility APIs, builds a memory of your work context on your device, and helps you write replies and understand that context in your own voice.
By downloading, installing, or using Goldfish, you agree to the practices described in this policy. If you do not agree, please discontinue use of the Service. Our core principles are minimal data collection, user control, and keeping your data on your device by default.
2.How Goldfish Works
Goldfish reads text from the active application on your screen using your device's accessibility APIs. It does not capture screenshots and does not record your screen. Only text is read.
The text Goldfish captures, and the summaries, wiki pages, identity profile, workflows, writing preferences, and other memory it generates, are stored locally on your device. This local memory is not uploaded to or synced with our servers.
When you actively invoke Goldfish, for example to draft a reply, answer a question, dictate, or process a workflow, the context relevant to that request is transmitted for AI processing. Goldfish also performs background AI processing to organize and personalize your local memory. In both cases, it selects the context the feature needs rather than sending your whole history.
3.Information We Collect
Local memory and captured context. Stored on your device and not transmitted to us for cloud storage: text read from supported applications via your device's accessibility APIs; generated summaries and memory; and your preferences and settings, including any apps or domains you have excluded from capture. This data is held in a local SQLite database and related local files on your device.
Data sent for processing (transient). For user-requested and background AI features, we transmit selected context relevant to that feature, and for dictation your voice input, to our AI model provider. This data is processed solely to provide Goldfish and is not retained by the AI provider.
Account and service information. If you create an account, we process information such as your name, email address, authentication and session information, plan, usage totals, and billing identifiers. Stripe handles payment-card information; Goldfish does not store it.
Product analytics. We collect limited event-only telemetry about how the Service is used and performs. This does not include captured text or other content processed by Goldfish.
4.How We Use Information
We use the information described above to provide the Service (read screen context, build local memory, generate replies and answers, organize that memory in the background, authenticate accounts, process subscriptions, and improve reliability), and to comply with legal obligations as required.
We do not use your data for advertising or behavioral profiling, and we do not use your data to train AI models.
5.AI Processing and Sub-Processors
Goldfish sends selected context for AI processing when you ask it to do something and when its background features organize and personalize your local memory. It sends what the task needs, not your whole history. Requests pass through Cloudflare to our private Azure OpenAI deployment and are processed under our zero-data-retention agreement with Microsoft. Results are returned to your device and stored locally when needed.
We use the following service providers to operate Goldfish:
| Provider | Purpose | Data and retention |
|---|---|---|
| Microsoft (Azure OpenAI) | AI processing | Selected context and, when applicable, voice input. Zero data retention; Microsoft does not store this data or use it to train models. |
| Cloudflare | Infrastructure and secure request routing | Processes request content in transit. Goldfish does not store or log that content in Cloudflare. |
| Specific | Accounts and authentication | Account, session, plan, and security information; no Goldfish memory content. Account records are retained while needed to provide the Service, and sessions expire after 60 days of inactivity. |
| PostHog | Product analytics | Limited event telemetry; no captured content. Retained for our configured analytics-retention period. |
| Stripe | Subscription billing | Customer, payment, and subscription information retained as needed for billing and legal obligations. |
| Resend | Email delivery | Contact and delivery information retained as needed to provide email services. |
| Optional sign-in and website resources | Account or ordinary request information handled under Google's applicable service terms. |
We do not sell your personal data, and we do not share your captured context with third parties for their own independent use.
6.Data Storage and Retention
Your local memory and captured context remain on your device until you delete them or uninstall Goldfish; we do not hold a copy. Data sent for AI processing is handled transiently and is not retained by Microsoft or Cloudflare. Account, billing, email, and analytics information is retained only as needed to provide and secure the Service, comply with legal obligations, and resolve disputes.
7.Data Security
We take measures to protect your information, including keeping your memory local to your device and encrypting requests in transit (TLS). Your local data is also protected by your device's account security and disk-encryption settings when enabled. No method of storage or transmission is completely secure, and we cannot guarantee absolute security.
8.Data Sharing and Disclosure
We do not sell your personal data. We share information only in limited circumstances: with the sub-processors described in Section 5, under agreements that limit their use of the data to providing services to us; where required by law, court order, or governmental authority, or to protect the rights, property, or safety of Goldfish, our users, or the public; and in connection with a merger, acquisition, or sale of assets, in which case information may be transferred as part of that transaction.
9.Your Rights and Choices
You can control Goldfish directly in the app: pause capture at any time; exclude apps or domains from capture, in settings or by instructing Goldfish directly; delete your local memory in part or in full; and revoke accessibility permission in your device's system settings, which disables Goldfish's ability to read screen text.
Depending on your jurisdiction, you may also have rights to access, correct, delete, port, restrict, or object to the processing of your personal data. Because your memory is stored locally on your device and under your control, you can exercise many of these directly in the app. To make a request regarding any other data, contact us using the details in Section 12.
If you are in the European Economic Area or the United Kingdom, you have rights under the GDPR, including the right to lodge a complaint with your local supervisory authority. If you are a California resident, you have the right to know what personal information we collect, to request deletion, and to opt out of sale; we do not sell personal information.
If you use Goldfish through an organization, your organization's agreement with Goldfish may also govern how account information is processed. Enterprise customers may contact us for our Data Processing Addendum, security information, and sub-processor details.
10.Children
Goldfish is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.
11.International Data Transfers
Your requests are processed by providers that may operate in countries other than your own. Where personal data is transferred internationally, we rely on appropriate safeguards.
12.Contact Us
If you have questions about this Privacy Policy or want to exercise your rights, contact us at support@goldfish.sh. Goldfish AI Inc.
13.Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the date above and notify you within the app or by other reasonable means.