Privacy by design

Privacy by Design (placeholder)

When I started building Life Butler, I made a decision that shaped everything that came after: privacy wouldn’t be a feature we added later. It would be how we built the product from day one.

Most apps treat privacy as a compliance checkbox. They collect everything, then figure out how to protect it. They add encryption as an afterthought. They ask for broad permissions “just in case.” They build features first, privacy second.

We did the opposite. Privacy by design means every architectural decision, every API endpoint, every Butler integration starts with the question: “How do we minimize data exposure? How do we give users control? How do we ensure they own their data?”

What Privacy by Design Actually Means

Privacy by design isn’t a marketing slogan — it’s an architectural principle. Here’s what it means in practice:

Privacy by design means building systems where privacy is the default, not an opt-in. Where data exposure is minimized by architecture, not by policy. Where users have control because the system is designed to give it to them, not because we added a settings page.

This isn’t about adding encryption after the fact or writing a privacy policy. It’s about making architectural choices that make privacy violations impossible, not just difficult.

Our Core Privacy Principles

These principles guide every decision we make about data:

1. You Own Your Data

All data you create in Life Butler belongs to you. Not to us. Not to third-party Butlers. You. We store it on your behalf, but you can export it, delete it, or take it elsewhere at any time. This isn’t a feature — it’s how the system is architected. Your data lives in your account, partitioned by your user ID, and you have full control over it.

2. Scoped Access by Default

Butlers only see the data they need. The Cooking Butler can’t see your health records. The Expense Butler can’t see your journal entries. The Socials Butler can’t see your financial transactions. This isn’t enforced by policy — it’s enforced by architecture. Each Butler requests specific data scopes, and the system only grants access to what’s requested. No Butler gets blanket access to everything.

3. Transparency Over Trust

You shouldn’t have to trust us — you should be able to verify. Every AI interaction includes a transparency log showing exactly what data was sent. Every Butler access is logged. Every data export shows what’s included. We don’t ask you to trust that we’re doing the right thing — we show you what we’re doing, and you can verify it yourself.

4. Encryption by Default

All data is encrypted in transit (TLS) and at rest (DynamoDB encryption). This isn’t optional — it’s how the system works. We don’t have a “enable encryption” toggle because there’s nothing to enable. Everything is encrypted, always.

5. No Data Selling, Ever

We don’t sell your data. Not to advertisers. Not to data brokers. Not to anyone. This isn’t just a policy — it’s baked into our business model. We make money from subscriptions and optional advertising (via the Ads Butler, which you control), not from selling your personal information.

How This Works in Practice

Let me walk through how these principles shape real features:

Butler Data Access

When a Butler needs data, it doesn’t get blanket access. Instead:

The Butler requests specific scopes: “I need read access to EXPENSE data” or “I need write access to CONTACT data.”

You grant or deny permission: When you install a Butler, you see exactly what data it wants to access. You can grant it, deny it, or customize the permissions.

The system enforces the scope: Even if a Butler tries to access data outside its scope, the API won’t allow it. The architecture prevents violations, not just the policy.

This means the Cooking Butler literally cannot see your health records, even if it wanted to. Not because we trust it not to, but because the API won’t return that data when queried with the Cooking Butler’s credentials.

AI Privacy

AI features introduce unique privacy challenges. Here’s how we handle them:

AI Interaction Privacy

✓Server-to-server only: AI API calls happen server-to-server. Your device never talks to Claude or other AI services directly. This means we can control exactly what data is sent and log every interaction.

✓User-initiated only: Data is only sent to AI services when you explicitly ask for it. No passive data streaming. No background analysis without your consent. Proactive insights are opt-in.

✓Transparency log: Every AI interaction includes a log showing exactly what data was sent. You can review it, understand it, and verify that only necessary data was shared.

✓Your data, your control: All AI conversations are stored in your account. You own them. You can export them, delete them, or review them at any time.

Data Export and Portability

You own your data, which means you should be able to take it with you. Life Butler supports full data export in standard formats (JSON, CSV). Your export includes:

All data points you’ve created (expenses, goals, contacts, etc.)
Your user profile and preferences
Complete history and timestamps
AI conversation logs
Butler configurations and permissions

You can export your data at any time, as often as you want. There are no limits, no fees, no restrictions. It’s your data, and you should be able to take it wherever you go.

What We Don’t Do

Sometimes privacy is best explained by what you don’t do. Here’s what we avoid:

We Don’t Do

✗Sell your data to anyone
✗Share data between Butlers without permission
✗Send data to AI services without your explicit action
✗Collect data “just in case” we might need it
✗Make privacy features premium-only
✗Hide what data we collect or how we use it

We Do

✓Give you full control over your data
✓Enforce data scopes at the API level
✓Show you exactly what data is accessed
✓Encrypt everything by default
✓Make data export free and unlimited
✓Build privacy into the architecture, not the policy

The Architecture Advantage

The key difference between privacy by design and privacy by policy is architecture. When privacy is built into the architecture, violations become impossible, not just against policy.

For example, our data model partitions everything by user ID. A Butler can only query data for users it has permission to access. Even if a Butler developer wanted to access another user’s data, the API wouldn’t allow it — the query would fail at the database level.

Similarly, our scoped access system means Butlers request specific data types. The API enforces these scopes. A Butler that requests EXPENSE access can’t suddenly start reading CONTACT data — the API literally doesn’t have an endpoint that would allow it.

Privacy by design means making privacy violations architecturally impossible, not just policy violations. When the system is designed correctly, bad actors can’t access data they shouldn’t have, even if they try.

Transparency Over Trust

We don’t ask you to trust us. We show you what we’re doing, and you can verify it yourself.

Every AI interaction includes a transparency log. Every Butler access is logged. Every data export shows what’s included. You can review these logs, understand what data was accessed, and verify that we’re doing what we say we’re doing.

This isn’t about compliance — it’s about giving you the information you need to make informed decisions. If you can see exactly what data a Butler accesses, you can decide whether to grant it permission. If you can see what data was sent to an AI service, you can decide whether that’s acceptable.

Privacy as a Foundation, Not a Feature

As we add new features and new Butlers, privacy by design ensures that privacy isn’t compromised. New features inherit the privacy architecture. New Butlers are subject to the same scoped access rules. New AI capabilities follow the same transparency and user-control principles.

This isn’t a one-time decision — it’s an ongoing commitment. Every feature we build, every Butler we integrate, every API we design starts with the question: “How do we minimize data exposure? How do we give users control? How do we ensure they own their data?”

Privacy by design isn’t something we achieved — it’s something we practice, every day, in every decision we make.

Your Rights and How to Exercise Them

You have rights over your data, and we make it easy to exercise them:

1Access Your Data

View all data we hold about you through the app settings. See what Butlers have access to what data. Review AI interaction logs.

2Export Your Data

Export all your data in standard formats (JSON, CSV) at any time. No limits, no fees, no restrictions. Your data, your control.

3Delete Your Data

Delete specific data points, revoke Butler permissions, or delete your entire account. When you delete, we delete — no hidden backups of your personal data.

4Control Butler Permissions

Grant or revoke Butler permissions at any time. Customize what data each Butler can access. See exactly what each Butler is doing with your data.

The Bottom Line

Privacy by design isn’t a feature we added — it’s how we built Life Butler. Every architectural decision, every API endpoint, every Butler integration starts with privacy in mind.

You own your data. You control who sees it. You can verify what’s happening. And you can take your data with you whenever you want.

This isn’t about compliance or marketing — it’s about building a product that respects your privacy because that’s how it’s designed, not because we added encryption or wrote a privacy policy.

Privacy by design means privacy is the default, not an opt-in. And that’s how it should be.