Privacy
Privacy, in plain language.
Your work stays yours. Persona's current beta is intended for users in the United States.
The short version
Your posts, captions, briefs, brands, and media live in folders you own and sync through your own iCloud. Persona does not receive or store your library unless you turn on cloud sync.
- Cloud sync is off unless you turn it on. When it is on, your posts and their original media are stored on our servers, and the section below says exactly what that means.
- Optional usage and diagnostic events tell us which part of Persona ran, never what you wrote. You can turn each category off.
- Feedback reaches us only when you write it and press Send.
- Account details exist only if you sign in with Apple or email.
- If you join the website waitlist, we receive the name and email address you submit.
Your library
Your brands, posts, captions, briefs, hashtags, and media are stored as ordinary files on your device and sync through your own iCloud account. Signing in does not move them. With cloud sync off, deleting your account does not touch them.
Cloud sync is a separate choice, described in full below. It is off until you turn it on, and Persona works completely without it.
Cloud sync
Cloud sync backs up your posts and their original media to Persona's servers. It is off until you turn it on, it is currently available only to a small number of invited accounts while we test it, and Persona works completely without it. This section is the explanation we promised to publish before making it available.
What it stores
When cloud sync is on, Persona uploads each post as a single file, exactly as that post is stored on your device. That file holds what you wrote and planned: the post's title, brief, caption, hashtags, mentions, first comment, any per-platform versions of that text, the platforms and dates you scheduled it for, its status, its text-card and framing settings, its identifiers, and the file names of the media attached to it. Persona also uploads the original media files themselves, byte for byte.
File names count as something you wrote, so we say so plainly: if you named a file anniversary-toast-final-v3.mov, that name reaches our servers, even though nothing on our side ever opens the file to look inside it. The same is true of a post you have deleted while it sits in Recently Deleted — the record we hold includes the folder name it had, which is built from its title.
Alongside the files we store an index: your account identifier, an identifier for each post, a fingerprint and size for each file, and a record of each revision — that a post changed, when, and which of your devices wrote it. That record holds no text from the post. Persona names your devices itself, in order, as Device 1 and Device 2. It does not read a name from your computer.
When you are signed in, each of your devices also tells our server whether it has finished moving its library to cloud sync or still keeps it in iCloud, and we note when each device last checked in. Persona uses this for one thing: it never clears away your old iCloud copy while another of your devices still uses it. A device that has not checked in for 90 days stops counting. This record holds no content from your library and is deleted with your account.
Cloud sync does not upload thumbnails or the smaller preview copies Persona makes. It does not upload your brand details, creative profile, or theme tree. It carries no file paths from your computer, no home folder or user name, and no passwords or sign-in tokens.
Who can reach it
Storage has no public access. Every read and write passes through Persona's server, which confirms on each individual request that you are signed in and that your account owns that exact file. Our build fails if any route that requires a session is missing a test proving one account cannot reach another's files.
One thing we would rather state than imply: your posts are not end-to-end encrypted. They are encrypted at rest by Cloudflare and we hold the keys, so Persona is technically able to read a caption. Nothing in the system decodes your files, and we do not read them — but "encrypted" should not leave you thinking we are unable to.
How we protect it
Persona does not run its own servers. Your files are stored on Cloudflare, the infrastructure company that delivers and protects a large share of the internet, and they are reached only through software running on Cloudflare's network. The things that are hardest to get right — the physical security of the data centres, encryption of your files at rest, and protection of the connection they travel over — are handled by a company whose whole business is doing that well, and whose security program and independent audits are published for anyone to read.
On top of that, Persona adds its own checks. The storage has no public access of any kind. The server verifies the fingerprint and exact length of every file it accepts, so a file that arrives altered or truncated is refused rather than stored. Each account's files sit under their own prefix, and permission is re-checked against our database on every single request rather than assumed from an earlier one.
How long we keep it
We keep your uploaded posts and media until you delete them, or until you delete your account. When you edit a post, the previous version of the file is removed as the new one is stored, and only the record that a revision happened remains.
Deleting a post moves it to Recently Deleted, where it waits 30 days so you can recover it. Our servers follow the same clock: 30 days after you delete a post, we delete the uploaded file and its original media, and it is no longer recoverable from either place. Turning cloud sync off stops any further uploading, but it does not remove what was already uploaded.
When you delete your account, we remove your account record and everything indexed against it, and queue your stored files for deletion. A daily job deletes them, then keeps watching your storage area for a further week in case an upload was still in progress when you deleted, and removes anything that arrives late before closing the job out.
Sharing, which we are building now
We are building ways to share your work, and in keeping with this page's habit, we are describing them before they exist. None of this is available yet. When it ships, we will update this section from "will" to "does," and if any detail below changes on the way, the shipped description wins.
Sharing will always start with you. A post becomes visible to someone else only when you create a link to it, and a link shows exactly that one post — not your library, not your brand, not your other posts. Creating a link is what uploads that post and its media to our servers, so a post you never share is never uploaded by sharing. You will be able to protect a link with a password, set it to expire, or turn it off at any time, and a link that is off or expired shows nothing.
People who open your link will not need a Persona account. Working inside your brand is different: inviting someone to contribute to a brand will require them to have an account, and a contributor will see that brand's posts. When collaboration ships, the sentence above about your account owning every file it reaches will be rewritten to describe exactly who can see what.
Anything you share counts toward your account's storage allowance, and links are served the same way as everything else on this page: through our server, with the storage itself staying private.
Your controls
Turn cloud sync on or off in Persona's settings. Delete your account in Persona's Account settings to remove your uploaded posts and media, as described above. Your local library stays on your device either way, and you can delete it like any other folder. Questions or deletion requests: kamren@kamstudios.com.
Shared links
When you share a post, Persona uploads that post, its media, and its preview images so people with the link can see them. Anyone with the link can see the post, plus its passphrase if you set one.
When a link is pasted into an app like Messages or Slack, that app may fetch the link's name and the post's first image to show a preview. Those apps can keep their own copy of that preview, even after the link expires or you delete it. A link with a passphrase never shows a preview of the post, and neither does a link that has expired or been deleted.
People you share a link with give their name and email before they comment or approve. Persona keeps their name, email, comments, and approvals with that link so you can see who said what. If you have those emails turned on, Persona also emails you when they comment or approve.
On a free account, a shared post is kept only for its link. It is removed after the link expires or you delete it, along with everything people left on the link, and anything uploaded for a link that was never created is removed within two days. On any account, deleting a link removes the comments, approvals, names, and emails attached to it.
What we receive
Usage and diagnostic events
When their separate controls are on, Persona sends bounded events such as app launch, post creation, export completion, feature opened, and error category. Each event includes a random per-install identifier, app version, operating-system version, platform, and approximate country and region derived by Cloudflare from the network connection. The identifier can link to your account after you sign in. When Send crash & error reports is on, Persona also sends one event after it first downloads your library onto a device: how long it took for the first post and for all posts to appear, how many posts there were, how many needed their full original file, and how many megabytes it downloaded. It contains no post, brand or file names. Events do not include captions, briefs, post titles, brand names, hashtags, filenames, or media. Usage and diagnostic events are retained for three months. To compare release adoption over time, we separately keep the first date each install reported each app version for up to 400 days. That record contains only the random per-install identifier, app version, and first-report date — not your content.
Crash reports
When you leave Send crash & error reports on, Persona automatically sends a minimized report after an app crash. It includes the app-install identifier, a report ID and fingerprint, the build that crashed, numeric crash codes, and up to 40 frames from the attributed thread. Each frame has only a binary image name, binary UUID, text-segment offset, and depth.
Crash reports never include memory addresses, post titles, brand names, captions, briefs, filenames, filesystem paths, the raw MetricKit payload, or a free-text error message. Each crash receipt becomes eligible for deletion 90 days after we receive it.
We copy each new kind of crash into an internal tracker in Notion so we can fix it. A tracker entry holds the crash fingerprint, the build, the numeric crash codes, how many times it happened and on how many installs, when it was first and last seen, and the minimized stack with function names filled in from Persona's own build files. It never includes the app-install identifier or a report ID. A tracker entry is a working record of a bug, so it is kept after its receipts are deleted.
Library recovery diagnostics
When Send crash & error reports is on, Persona can send a short anonymous signal when your library stays stuck across launches, or when this device's own changes stop a restore. It is not tied to your account or app-install identifier. It contains the app version, the platform, the kind of library and problem, whether you are signed in, and rough counts of pending changes, duplicate posts and held posts. It carries the help code described under Feedback. It carries no account, install, post or brand identifiers, no content, filenames or paths, no operating-system details and no device times, and we do not store your IP address with it. Persona tries to send it at most once each time the app opens.
We use this signal only to find and fix problems. It is connected to you only if you send a bug report, which carries the same help code, so we can help with the problem you reported. Each signal becomes eligible for deletion 90 days after we receive it.
Feedback
When you use Send Feedback, we receive the name, subject, description, app version, and operating-system details you submit. Bug reports can include counts, sync status, and a scrubbed tail of Persona's own log. Sync status also includes Persona's last few startup checks of where your library lives, and the random identifiers of any posts and brands that are stuck, never their titles or content. When Send crash & error reports is on, a bug report also includes a random help code stored on your device. You can see all of it before you press Send. We keep feedback in our database and a working copy in Notion. Both are deleted 90 days after we receive it. A deleted Notion copy can take up to 30 more days to be permanently removed from Notion's trash.
Your account
Sign in with Apple gives us Apple's stable identifier, plus your name and email if you choose to share them. Apple may provide a private relay address instead of your real email. We keep the token Apple issues so we can revoke Persona's access when you delete your account. It is stored encrypted and used for nothing else.
If you choose email sign-in, we receive the email address you enter. A one-time verification code is kept only as a protected hash for up to ten minutes, then deleted after use or expiry.
If you add a passkey, we store its credential ID, its public key, a counter, and when it was created and last used. A public key cannot sign in to your account by itself; the private key stays on your device. Each sign-in uses a one-time challenge that expires after five minutes and is deleted once used.
If you contact us, we may keep a short internal note about the conversation so we can help you next time. Notes are only visible to Persona and are deleted with your account.
Delete your account in Persona's Account settings. This deletes your account data and revokes the Apple sign-in. Your local library remains on your device.
Your Inbox
When you are signed in, Persona can place notes and letters from us in an Inbox inside the app. So that what you have read stays the same on every device you sign in on, the app tells our server how far into your Inbox you have read: one number, the id of the newest item you have moved past. We use that same number to see, for a note we sent, how many people have read it and which accounts have. We record nothing else about reading: no opens, no times, and nothing about what you do with a note. Only we can see this, and no one else can see whether you have read anything. Deleting your account deletes your Inbox and that number with it.
Instagram and Facebook
Publishing to Instagram and Facebook is not available yet. This section describes how it will work, so the rules are written down before the feature exists.
Connecting an account is your choice. When you connect an Instagram professional account or a Facebook Page, you sign in with Meta, not with Persona, and Meta asks which permissions to grant. Persona never sees your Instagram or Facebook password.
From Meta, Persona receives the connected account's ID, username, account type, and profile picture, plus an access token that lets Persona publish for that account. Tokens are stored encrypted on our servers. They never sync to your devices and are never written into your library.
Persona uses a connection for one thing: publishing the posts you choose, when you choose. To do that, Persona holds that post's caption, hashtags, and media on its servers and gives Meta a temporary link to fetch the media. Persona records whether each post went out and the ID Meta returns for it. Persona does not read your feed, followers, messages, or comments, does not use anything from Meta for advertising, and does not sell it.
Disconnect an account in Persona at any time, or remove Persona in Instagram or Facebook settings under Apps and Websites. Either one ends Persona's access. When you disconnect, or delete your Persona account, Persona deletes the stored token and account details. Posts already on Instagram or Facebook stay there until you delete them there.
Other connections
- Persona does no automatic AI processing of your library and sends nothing to an AI service by itself.
- If you connect Persona to Claude and ask Claude about your work, Claude receives the library content you choose to use under Anthropic's privacy policy.
- Persona checks GitHub for updates and release notes.
- Notion holds our internal crash tracker and the working copy of feedback described above.
- Cloudflare provides our website and Workers infrastructure. Cloudflare sees the connecting IP address for security and delivery; Persona retains only approximate country and region for telemetry.
- If you connect Instagram or Facebook, Meta receives the posts you publish there under Meta's privacy policy.
- Turnstile protects the website waitlist from automated abuse.
What we never receive
With cloud sync off, Persona does not receive your captions, briefs, post text, hashtags, media, or library as a whole. With cloud sync on, what reaches us is the list in the cloud sync section above and nothing beyond it. If you publish a post to a connected Instagram or Facebook account, that post reaches us as described in the Instagram and Facebook section. Your creative profile, brand bible, and theme tree are not uploaded in any case. We do not sell your data or use it for advertising.
Controls and contact
Turn off Share usage data or Send crash & error reports separately in Persona's Usage & Privacy settings. Turn cloud sync on or off in Persona's settings. Remove the Claude connection in Claude. Disconnect Instagram or Facebook in Persona. Delete your library like any other folder. Questions or deletion requests: kamren@kamstudios.com.
Kam Studios, LLC
Security
We use reasonable administrative, technical, and organizational measures for the information we control. No method of storage or transmission is completely secure, and we cannot guarantee absolute security. If we learn of a breach that legally requires notice, we will provide notice as required by law.
US privacy rights
Depending on where you live and whether a privacy law applies to Kam Studios, you may have rights to ask what personal information we hold, request correction or deletion, or opt out of certain uses. We do not sell personal information or use it for targeted advertising. Email kamren@kamstudios.com to make a request; we may verify your identity before completing it.
Children
Persona is not directed to children under 13, and we do not knowingly collect personal information from children under 13.
Changes
We may update this policy as Persona changes. This update describes optional cloud sync, which earlier versions of this page promised to explain before making it available. If a change materially affects how we use information, we will provide notice in the app or on this page before the change takes effect where practical.