Sanctum LLC (“Sanctum”, “we”, “us”) makes three apps: Arc, for your training; Cloister, for your
work; and Alcove, for your studies. We also run our company website, sanctum.company, and a
website for each app.
This policy has one shared part, this page, and a section for each app and for our websites. An
app’s section applies only when you use that app. Arc’s health information is covered by its own
Consumer Health Data Privacy Policy at https://sanctum.company/health-data.
What this policy covers
It covers our apps, our websites, and email you send us. It doesn’t cover the services you connect
to our apps, such as Microsoft, Google, Apple or Oura. Their own policies cover what they hold.
Each app keeps its own data. Cloister and Alcove use the same sign-in, but each keeps its own
library and neither reads the other’s. Arc has its own sign-in.
What we never do
We never sell your personal information, rent it or trade it.
We never use it for advertising, and never share it so others can show you ads.
We never use your content to train AI models. Our AI model providers, Anthropic and OpenAI, may
not use it to train theirs either.
No one at Sanctum reads your content unless you ask us to and give us access, or we must do so
to keep the service secure or to obey the law.
What we collect
What you give us: your name, email address and sign-in, your settings, and what you type or
add in an app.
What you connect: when you connect an account, such as your mailbox, or a source, such as
Apple Health, we read only what you allow. Each app’s section lists exactly what.
What your device sends: when an app connects to our servers, they record your IP address,
your device and app version, the time and the request. We use this to run and protect the
service. Our websites are covered in their own section.
Your subscription: your plan, trial dates and billing status. Card details go to our payment
processor or the app store, not to us.
Some information is sensitive, such as the health information in Arc. We use it only with your
consent, and only for the feature you turned on. Your mail, meetings and files also hold
information about other people. We use it only to provide the service to you.
How we use it
To run the apps: sign you in, keep your data in sync, and show it to you.
To do what you ask: sort, rank, draft, transcribe, summarize and search, as each app’s section
explains.
To keep accounts secure and fix problems.
To bill you and manage your subscription.
To answer you when you write to us.
To meet our legal obligations.
We don’t use your information for a new purpose without asking you first.
AI processing, with your permission first
Some features use AI models run by Anthropic and OpenAI, which we use through their commercial
services. Cloister also uses Voyage AI to build its search index. These companies work for us as
service providers: they may use what they receive only to provide the service to us. When a
feature needs one, the app sends only the information that task needs, such as the email it is
drafting a reply to, and shows you the result.
When you set up an app, it asks your permission before it sends your personal information to an
AI provider. It names the providers and says what will be sent. Nothing is sent until you agree.
You can withdraw your permission at any time in the app’s settings. The features that need it then
stop, and nothing more is sent. Each app’s section says what its AI does.
What the AI providers keep. Anthropic and OpenAI keep what they process for us for up to 30
days to check for misuse, then delete it unless the law requires them to keep it longer. Neither
uses it to train its models. This is set by Anthropic’s Commercial Terms and by OpenAI’s API terms
and its Data Processing Addendum. Voyage AI turns text into search indexes for Cloister and
processes it only for that purpose.
How we share
We share personal information only in these ways.
With service providers who work for us. They may use it only to do that work, and we require
them to protect it as this policy does.
Provider
What they do
Apps
OVH, with servers in Canada
Store and run our apps’ data
All apps
Vercel
Host our websites
Websites
Anthropic and OpenAI, in the United States
AI models, through their commercial APIs
All apps
Anthropic
Runs the web searches Ask writes for your question, which can contain words from your own content
Cloister
Voyage AI, in the United States
Build search indexes (“embeddings”) of your text
Cloister
A speech-to-text provider and a text-to-speech provider
Live class transcription and read-aloud
Alcove
A speech-to-text service
Meeting transcription
Cloister
Apple
Sign in with Apple, App Store purchases, notifications
All apps
Google and Microsoft
Sign-in, and the accounts you connect
Cloister, Alcove
Our payment processor
Card payments on our websites and in our desktop apps
Any app you pay for by card
Our email provider
Sends sign-in codes and service email, and holds email you send us
All apps, websites
When you tell us to. For example, Cloister saves a draft to your own Drafts folder, and Arc
writes a workout to Apple Health.
For legal reasons. When the law, a court order or valid legal process requires it, or to
protect someone’s safety or our rights.
If Sanctum changes hands. If another company takes over Sanctum or an app, your information
goes with it only under this policy’s promises, and we’ll tell you before that happens.
Security
Everything between your devices and our servers travels over HTTPS (TLS).
In Cloister, each account’s data is kept in its own database, apart from every other account’s,
and every request and every background task runs inside one account. Each account’s database,
files and backups are encrypted with that account’s own key, and when you delete your account,
the key is destroyed. The Microsoft and Google sign-ins you connect to Cloister are stored
encrypted.
No one at Sanctum can open your Cloister account except through a time-limited grant that you
can see and revoke.
No system is perfectly secure. If a breach affects your information, we’ll tell you as the law
requires.
How long we keep it
We keep your information while your account is open and you choose to keep it. You can delete
things as you go.
If you cancel your subscription and don’t delete your account, we keep your information for one
year after you cancel, so you can come back to it, then delete it. This applies in every app.
When you cancel, we show you the date it will be deleted, and we remind you before that date. If
you subscribed through Apple, you cancel in Apple’s settings instead, and the app shows you the
date the next time you open it.
When you delete your account, we delete your information from our live systems within 30 days
of your request, and from our backups within a further 30 days.
We keep some records longer because the law requires it. Payment and subscription records,
including your consent to renewal, are kept as long as tax and accounting law requires, usually
seven years. Our app servers’ logs are kept for 30 days. Email you send us is kept for two years
after the conversation ends.
Each app’s section gives its own periods.
Your rights
You can ask us to:
tell you what we hold about you and give you a copy;
correct it;
delete it;
give it to you in a structured, commonly used format you can take elsewhere;
stop using it for something you agreed to (withdraw your consent);
tell you which third parties received it.
We don’t sell your information, use it for targeted ads, or profile you in ways that decide
anything about you, so there is nothing to opt out of. If that ever changed, we would offer the
opt-out first. Using your rights never changes your price or service.
We offer these rights to everyone who uses our apps in the United States and Canada, whether or
not your state’s or province’s law requires it.
How to ask. Email privacy@sanctum.company. Someone you authorize can ask for you, with proof
that you authorized them.
Verifying you. We confirm the request comes from you, for example through your signed-in app or
your account email. We ask only for what we need to do that.
When we answer. Within 30 days, free of charge. If we need more time and the law allows it, we
tell you why within those 30 days.
Appeals. If we turn down a request, in whole or in part, we tell you why. You can appeal by
replying to our answer or by emailing privacy@sanctum.company with “Appeal” in the subject.
Someone who did not decide the first request reviews it, and we answer within 45 days and explain
the result. If you’re still not satisfied, you can complain to your state attorney general, to the
Office of the Privacy Commissioner of Canada, or, in Quebec, to the Commission d’accès à
l’information. When we deny an appeal, our answer tells you how.
Children
Our apps and websites are not made for children. You must be at least 18 to use our apps. We don’t
knowingly collect information from children under 13. If we learn we have, we delete it. If you
think a child has given us information, email privacy@sanctum.company.
Information stored outside your province or country
Sanctum is a United States company. Our apps’ servers are hosted by OVH in Canada. The AI
processing done for us by Anthropic and OpenAI, and by Voyage AI for Cloister, happens in the
United States. Our websites are hosted by Vercel. Some of our other service providers may also
process your information outside Canada, including in the United States.
If you live in Canada, including Quebec, your information may be stored outside your province, and
the parts our AI providers process are communicated outside Canada, to the United States. If you
live in the United States, your information is stored in Canada. Wherever your information is,
courts, law enforcement and national security authorities of that country may be able to reach it
under their laws.
Automated decisions
Our apps sort and rank your own information and suggest what to do next. For example, Cloister
puts the email that needs a reply first, and Alcove gives you feedback on a practice answer. These
help you decide; they are not decisions about you, and they don’t affect your rights, money or
access to anything. If we ever make a decision about you based only on automated processing, we’ll
tell you when we do. You can then ask what information was used, why the decision was made, and for
a person at Sanctum to review it.
Features that analyze your own information. Some features work something out from your own
information to help you: Arc’s scores and trends about your body and training, Alcove’s readiness
by topic, and Cloister’s view of who owes you what. They are each app’s main features, and each
app’s section says what they do.
Do Not Track
Our company website sets no cookies and runs no scripts, and no third party collects information
about your browsing through it. Our apps don’t track you across other companies’ sites or apps.
Since there is no tracking to switch off, a Do Not Track or Global Privacy Control signal changes
nothing. Alcove’s browser extension reads only the course pages you allow; see Alcove’s section.
Changes
We’ll post any change here and update the date above. If a change matters, we’ll tell you in the
app and by email at least 30 days before it takes effect, and ask for your consent again where the
law requires.
Contact and the person in charge
The person in charge of protecting personal information at Sanctum is our Privacy Officer. They are
accountable for this policy and answer questions and complaints. You can reach the Privacy Officer
at privacy@sanctum.company.
This policy also describes our privacy governance: who is responsible for your information (the
Privacy Officer), how long we keep it (see “How long we keep it” and each app’s section), and how
to complain (see “Appeals”).
Summary for state privacy laws
What
Where it comes from
Why
Who receives it
Account details: name, email, sign-in, IP address
You, your sign-in provider, your device
Account, security, support
Hosting, sign-in providers, our email provider
Subscription and purchases
You, Apple, our payment processor
Billing
Apple, our payment processor
Content you bring or connect: mail, messages, calendars, transcripts, files
Your connected accounts, you
The features you use
Hosting, the AI providers named above; in Cloister, Anthropic also runs the searches Ask writes
Audio of meetings and classes
Your device
Transcription, then deleted
Speech-to-text providers
Sensitive data: health (Arc)
You, sources you connect
The feature you turned on, with consent
Hosting; Anthropic and OpenAI, which write Arc’s briefings for us
Approximate place, about 10 km (Arc)
Your iPhone, if you allow it
Sunrise and sky times
Hosting
What the apps work out: rankings, scores, readiness
The apps
Showing you
Hosting, AI providers
Device details: push notification tokens
Your device
Notifications
Apple, hosting
We don’t sell personal information or use it for targeted advertising.
Our websites
Last updated: October 14, 2026
This section covers our company website, sanctum.company.
What the website collects
Very little. The website is plain pages. It sets no cookies, runs no scripts, and has no
analytics, advertising or tracking tools. Its fonts and images come from the site itself, so
visiting it sends nothing to any company other than our host, Vercel. It has no forms or sign-in.
Request information
The website is hosted by Vercel. When your browser asks for a page, Vercel processes standard
request information, such as your IP address, your browser, the page you asked for and the time, to
serve the site and protect it. We don’t use this information to track visitors.
If you email us
If you write to us, we use your email address and message only to answer you and to keep a record
of our conversation. We keep it for two years after the conversation ends. Our email is handled by
our email provider.
Links to our apps
The website links to our apps’ pages and to app stores. Those have their own sections in this
policy, and the app stores have their own policies.
Arc
Last updated: October 14, 2026
Arc reads the ring or watch you already wear and gives you one straight answer each morning.
Your health information has its own policy
Everything Arc knows about your body, health and habits, including what it reads from Apple Health,
Oura and Withings, the food, supplements and lab results you log, and the scores Arc works out, is
covered by Arc’s Consumer Health Data Privacy Policy at https://sanctum.company/health-data. That
policy explains what we collect, why, who receives it, and your rights over it. This section covers
the rest.
What else Arc collects
Your account. Your email address and sign-in. You sign in with Apple, or with a one-time code
we send to your email. There is no password. Arc’s sign-in is its own; it isn’t shared with
Cloister or Alcove.
Your devices. The iPhone, Apple Watch and browsers you use Arc on. Arc’s reminders are made on
your device and don’t pass through a notification service.
An approximate place. If you allow it, your iPhone sends Arc a single place rounded to about 10
km, used to work out your sunrise and sky. Arc keeps only the latest one. It never tracks where you
go, and no screen lists where you’ve been.
Your connections. If you connect Oura or Withings, the access keys they give Arc so it can read
your data. They are deleted with your account.
Your settings. Your preferences and the sources you turned on.
Your subscription. Your plan, trial dates and billing status.
Apple Health
When you allow Arc to read or write Apple Health data:
We use it only to provide Arc’s features to you.
We never use it for advertising, marketing or data mining, and we never sell it.
We never store your health data in iCloud.
Arc writes back to Apple Health only what you log in Arc, such as food, water and workouts, and
only the types you allow.
You can change what Arc reads or writes at any time in your iPhone’s Health settings.
AI in Arc
Arc’s daily briefing and weekly review are written by AI models from Anthropic and OpenAI, which
we use through their commercial services. They work from a summary Arc prepares, and they work for
us: they may not use it for anything else or train their models on it. Arc works out every number
itself; the AI only writes the words. When you set up Arc, it asks your permission before it sends
anything to them, and you can withdraw that permission at any time in Arc’s settings. The health
policy lists what the summary contains.
What Arc works out about you
Arc’s scores, signs of strain, trends and estimates analyze your own data to describe your body and
training. They are what Arc is for, and they work from the sources you connect. Location is off
until you allow it.
No sale, no ads, no trackers
We never sell, rent or trade your information, not even in anonymized form, and we never use it
for ads. Arc has no analytics, crash-reporting or advertising tools inside it.
Getting a copy and deleting your account
You can download your information, as files you can open, in Arc’s settings. You can also delete
your account in Arc’s settings; your information is then deleted from our live systems within 30
days, and from our backups within a further 30 days.
If you cancel and don’t delete your account, we keep your information for one year after you
cancel, then delete it. Until then, you can still download it. When you cancel, Arc shows you the
deletion date, and we remind you before it. If you subscribed through Apple, you cancel in Apple’s
settings instead, and Arc shows you the date the next time you open it.
Cloister
Last updated: October 14, 2026
Cloister reads your mail, calendars, meetings and chats and brings you what needs you, with a draft
ready when a reply is owed. You send every message yourself.
What Cloister collects
Your account. Your name, email address, time zone, sign-in (Apple, Microsoft or Google) and
subscription.
Microsoft (Outlook, Outlook Calendar and Teams), if you connect it. Cloister asks Microsoft for
these permissions:
your mail, to read it, file it and save drafts (Mail.ReadWrite). This does not include
permission to send mail;
your calendars, read-only (Calendars.Read);
your basic profile and the people you work with most (User.Read, People.Read);
your Teams chats and channel messages, read-only (Chat.Read, ChannelMessage.Read.All,
Team.ReadBasic.All, Channel.ReadBasic.All);
staying connected while you’re away (offline_access).
In Teams, Cloister only reads. It never posts, replies, reacts or marks anything as read.
Google (Gmail and Google Calendar), if you connect it. Your email address (openid, email);
your Gmail (gmail.modify), to read it, label it, archive or move to trash the mail you choose to
clear, and save drafts; and your calendars, read-only (calendar.readonly). Google’s Gmail
permission would also allow sending. Cloister never uses it to send.
From these accounts Cloister keeps the full text of your mail and messages, calendar entries
(titles, times, invitees’ names, end times, call links and invite text), and images in Teams
messages, which it fetches when needed and, by default, deletes after 30 days. When you first
connect, Cloister reads 30 days back.
Meeting recordings. When you record a meeting with the Cloister app, it captures your
microphone and your computer’s sound and sends them to a speech-to-text service to be transcribed.
Then:
We keep the transcript, which speaker said what, and attendees’ names as your meeting app
showed them.
The audio is deleted as soon as it has been transcribed, including when the transcription
fails. We don’t keep any recording.
The audio is used only to make the transcript. It is never played back.
Cloister tells speakers apart within one recording only, and keeps no voice print. Names you
give speakers stay with that transcript.
Your devices. Each device’s name and its notification token, and, if you allow browser
notifications, your browser’s notification subscription.
What you do in Cloister. Your answers, notes, priorities, edits to drafts, your Ask
conversations, and the history that lets you undo a change for 30 days.
In a browser. One cookie that keeps you signed in, and your light or dark setting.
How Cloister uses it
Ranking what needs you. Cloister sorts your mail and meeting actions into Needs you, Noted
and Kept outside, ranks your cards, and tracks what you owe and what is owed to you. These are
suggestions; you decide.
Drafts. Cloister writes a reply and saves it in your own Drafts folder in Outlook or Gmail.
You review it, change it if you like, and send it yourself. For Teams, it opens Teams with the
text filled in, and you send it.
Clearing mail. Cloister archives mail at Microsoft or Google only when you say so: when you
clear it, or through a rule you approved. You can undo it.
Briefs and summaries. Before a meeting, a brief of what to know; after it, what was promised.
Search and Ask. Finding things in your own information, and answering your questions about
it.
Who Cloister shares it with
When you set up Cloister, it asks your permission before it sends anything to an AI provider (see
“AI processing”). You can withdraw that permission at any time in Cloister’s settings.
Anthropic and OpenAI run the AI models, through their commercial services, that sort, rank,
summarize, draft, brief and answer Ask. They receive the parts of your mail, messages, calendar
entries and transcripts that each task needs.
Anthropic also runs the web searches Ask writes to answer your question. It receives them
from our servers, not from your device. Ask writes them itself, so they can contain words from
your own content.
Voyage AI receives the text of your mail, calendar entries and invites to build the search
index that lets you search your own information, and processes it only for that purpose.
Microsoft and Google, as your providers: Cloister reads from them and makes only the changes
above.
Apple delivers notifications. They carry only general wording; your device then fetches the
details from us directly. Browser notifications carry no content.
A speech-to-text service receives meeting audio to transcribe it.
How long Cloister keeps it
You choose how long Cloister keeps your information, in Cloister’s settings. Until you choose, it
keeps it for three years, then deletes older information from Cloister. It never deletes anything
from your mailbox or calendar.
If you cancel and don’t delete your account, we keep your information for one year after you
cancel, then delete it. When you cancel, Cloister shows you that date, and we remind you before it.
If you subscribed through Apple, you cancel in Apple’s settings instead, and Cloister shows you the
date the next time you open it.
You can export a copy at any time, and delete your account, in Cloister’s settings. When you delete
your account, your information is deleted from our live systems within 30 days, and from our
backups within a further 30 days. Meeting audio and Teams images are kept only as described above.
Recording other people
The laws on recording differ. In many places, everyone in a conversation must agree before it is
recorded. Telling the people in your meeting, and getting their agreement where the law requires
it, is up to you. Their words and names will be in your transcript.
Google user data
The use of information received from Google Workspace scopes will adhere to the Google User Data
Policy, including the Limited Use requirements.
Cloister uses your Google data only to provide and improve the features you see in Cloister.
We never use it for advertising and never sell it.
We never use it to create, train or improve AI or machine-learning models, and Anthropic and
OpenAI may not use it to train theirs.
We transfer it only to provide those features (to Anthropic, OpenAI, Voyage AI and our hosting
provider OVH), for security, or to comply with the law.
No person reads your Google data unless you agree to it for specific messages, or it is needed
for security, such as investigating abuse, or to comply with the law.
You can remove Cloister’s access at any time in your Google Account’s third-party access settings.
Alcove
Last updated: October 14, 2026
Alcove turns what you bring from your classes into a library you can study from. It works from
what you bring, and it keeps your library apart from everything else, including Cloister.
What Alcove collects
Your account. Your name, email address, sign-in (Apple, Microsoft or Google), plan, trial
dates and referral link.
Files you bring. Syllabi, slides, readings and handouts, from:
class folders you choose, such as a folder in iCloud Drive. Your files stay where they are;
Alcove reads them into your library;
your forwarding address, a private email address we give you. Alcove reads the files attached
to what you forward into your library. The message itself is received for us by our email
provider;
scans and shares from your phone;
the browser extension, which reads only the course pages you open, on sites you allow, in
your own signed-in browser. It never stores your password, never signs in for you, and never
posts to a course site. Bringing pages in automatically is off until you turn it on for a site;
your school mail, if you connect it. Alcove reads mail from your school and professors, and
saves drafts in your own Drafts folder when you ask. You send every message yourself.
If a file is password-protected, Alcove uses the password once to open it, then forgets it.
Live class transcription. When you transcribe a class, Alcove turns what is said into text.
Your device sends the sound of the class, in small pieces as it is heard, to a speech-to-text
provider. Each piece is turned into text and then dropped. The audio is never saved as a file, on
your device or on our servers. If your connection drops, your device holds the latest audio in its
memory, for up to about 10 minutes, until it can send it, then drops it. Alcove never stores class
audio, and it uses only speech-to-text providers that delete audio once it’s transcribed.
Alcove keeps the whole transcript: everything said in the room, by your professor, your classmates
and anyone else who speaks. It labels which lines are your professor’s and which are other
people’s.
Lecture videos. Alcove uses the transcript your course already posts. If there isn’t one,
Alcove downloads the video, has it transcribed, and deletes the video. The video isn’t kept.
What you make in Alcove. Briefs, guides, outlines, practice exams with your answers, feedback,
readiness by topic, your Ask history, questions you mark, and absences you note.
Grades you type. Your syllabus weights and the marks you enter. Your marks stay private to you.
Alcove never predicts a grade.
Practice exam timing. If you want practice exams timed like your real ones, you can set a time
multiplier and breaks. It’s optional, and Alcove never asks why. We use it only to time your
practice exams, and it is never sent to an AI provider. You can change or clear it at any time in
Alcove’s settings.
Read-aloud voice. You pick the voice Alcove uses to read material aloud.
Your devices. Notification tokens, and the permissions you grant: microphone, files and
folders, camera, notifications and calendar.
How Alcove uses it
To file what you bring under the right class and set aside what belongs to another section.
To write your briefs, guides, outlines and practice exams, give feedback on your answers, recap
classes, and read material aloud.
To answer your questions in Ask, using only your library, with numbered sources.
To add your class times to your Google, Outlook or Apple calendar, if you turn that on. It’s off
until you do.
Your school never sees your library, grades or marks.
Readiness by topic. Alcove works out how ready you are on each topic from your practice
answers. It is study feedback for you, never a grade.
Who Alcove shares it with
When you set up Alcove, it asks your permission before it sends anything to an AI provider (see
“AI processing”). You can withdraw that permission at any time in Alcove’s settings.
Anthropic and OpenAI run the AI models, through their commercial services, that write your
study materials, feedback and Ask answers from the parts of your library each task needs.
A speech-to-text provider turns class audio and lecture videos into text.
A text-to-speech provider turns text into read-aloud audio.
Our email provider receives what you send to your forwarding address.
Google, Microsoft and Apple, as your mail, calendar and file providers.
Transcribing a class
Before you transcribe a class, Alcove asks you to confirm that you have permission. Getting that
permission is up to you. The laws on recording differ, and your school or professor may have rules.
Alcove keeps everything said in class, so your professor’s and classmates’ words, and those of
anyone else who speaks, will be in your transcript.
How long Alcove keeps it
Alcove keeps every term in your library while your account is open. If you cancel and don’t delete
your account, we keep your library for one year after you cancel so you can come back to it, then
delete it. When you cancel, Alcove shows you that date, and we remind you before it. If you
subscribed through Apple, you cancel in Apple’s settings instead, and Alcove shows you the date the
next time you open it.
Delete everything. In Alcove’s settings, one step deletes your classes, library, transcripts,
outlines, Ask history and Alcove account data, and signs you out. It can’t be undone. Files you
keep in iCloud Drive or elsewhere stay where they are. Your information is deleted from our live
systems within 30 days, and from our backups within a further 30 days.
Getting a copy
Alcove has no export button. You can still get a copy of everything you’ve given us and what Alcove
made from it: email privacy@sanctum.company and we’ll send it in a structured, commonly used format
within 30 days.
Google user data
If you connect school mail through Google: the use of information received from Google Workspace
scopes will adhere to the Google User Data Policy, including the Limited Use requirements. We use
it only to provide the Alcove features you use, never use it for advertising and never sell it. We
never use it to create, train or improve AI or machine-learning models, and Anthropic and OpenAI
may not use it to train theirs. We transfer it only to provide Alcove’s features (to the providers
listed above and our hosting provider OVH), for security, or to comply with the law. No person
reads it unless you agree to it for specific messages, or it is needed for security or to comply
with the law.