Safety & Trust

You govern access to yourself.

Elvera is built for truths that need control. Everything you add can be private, shared, sealed, or inherited.

Privacy States

Four states. Total control.

Every piece of content you add to Elvera has a visibility state. You set it. You change it. Nothing is shared without your explicit action.

Private

Visible only to you. Nothing you mark private is readable by your circle, AI used for model training, or anyone else. This is the default state for all new content.

Shareable

You choose who in your trusted circle can see this. Shareable content is never public — it's visible only to specific people you've explicitly granted access to.

Sealed

Locked until a release condition is met. Sealed content cannot be accessed by anyone — including you — until the unlock condition you defined occurs. No early exceptions.

Inherited

Designated to pass to a named recipient at a future time or upon a triggering event. You define who, when, and under what conditions. Inherited content can still be sealed until release.

Who Sees What

Default visibility by content type.

These are defaults. You can change the visibility of any content at any time.

Content type You Your circle Witnesses Public
Prompt responses Always Never by default Never Never
Portrait (AI model) Always Only if you share Never Never
Witness contributions Always Never by default Their own only Never
Sentiments Always Never Never Never
Legacy packets Always Never Never Until release condition

AI & Your Data

AI interprets. You own.

AI organizes and synthesizes based on your permissions. It doesn't read what you've marked private. It can be wrong. And it never owns what it touches.

  • AI follows your visibility rules. If a prompt is marked private, AI cannot include it in synthesis, in portrait generation, or in witness-facing responses.
  • AI is not omniscient. The model can only reason about what you've surfaced. It doesn't infer from what it can't see.
  • AI can be wrong. Elvera surfaces AI interpretations as hypotheses, not diagnoses. You can reject, dispute, or edit any interpretation.
  • Your data is never used to train models. Nothing you put into Elvera is fed into external AI training pipelines. Your intelligence belongs to you.

"AI access follows user-selected visibility rules."

When you grant your portrait access to your circle, AI is used to help them understand what they've contributed — not to reveal what you haven't shared.

When a legacy packet is sealed, AI cannot unlock, preview, or summarize the contents — not even for you. The seal is technical, not just policy.

You can audit what data informed any AI output. Elvera shows you the source content behind every interpretation so you can verify or correct it.

Circle Permissions

You define what your circle can do.

Adding someone to your circle doesn't give them access to everything. Each permission is discrete and revocable at any time.

Who can answer prompts

  • Only people you've explicitly invited as witnesses
  • Each witness prompt set is separately permissioned
  • You can close witness access at any time
  • Witness responses are visible only to you by default

Who can send sentiments

  • Only people in your named circle
  • Sentiments are rate limited to 3 per day
  • You can disable sentiment receiving at any time
  • Blocked senders cannot re-enter your circle

How to remove, block, or revoke

  • Remove from circle: ends all access immediately
  • Block: prevents re-invite and hides your profile
  • Revoke witness access: their prompts remain but future access closes
  • Shared content can be unshared at any time — the person loses access to future reads

Sensitive Messaging

One-time. Rate-limited. Reported or blocked.

Some messages carry weight. Elvera's sensitive messaging system is designed to protect the receiver, not enable the sender.

One-time open

Certain sensitive messages are designated one-time-open. Once the receiver reads them, they cannot be re-read from within the app by anyone, including the sender. This is a deliberate design choice — some things are meant to be received, not referenced.

Receiver safety controls

Receivers can decline to open any sensitive message without the sender being notified. They can also flag the message before opening it based on the sender's identity. No pressure to receive.

Rate limiting

Sensitive messages from any single sender are rate limited to 3 per day. This limit applies regardless of account tier or relationship status. It cannot be overridden.

3 messages · per sender · per day

Reporting & blocking

Any message can be reported without opening it. Reports are reviewed by the Elvera safety team. Confirmed abuse results in permanent account suspension. Blocked senders cannot use alternate accounts to re-contact you.

Export & Delete

Your data is yours to take.

You can leave at any time, with everything you built. We don't make it difficult.

Full data export

Everything, in one file.

Request a complete export of your Elvera data at any time — prompt responses, witness contributions, portrait data, sentiments, legacy packets (where not sealed), and settings. Delivered within 72 hours as a portable archive.

Account deletion

Gone means gone.

Delete your account and all associated data is permanently purged within 30 days. This includes your portrait, all prompt responses, witness data, and any active shares. Sealed legacy packets are transferred to their designated recipients or deleted, per your settings.

Portrait source deletion

Delete what trained your portrait.

You can delete any individual prompt response or witness contribution that was used to build your portrait. The portrait will be recalculated based on remaining data. You control what the model sees.

Share revocation

Revoke access without notice.

Any shared content can be un-shared at any time. The recipient loses read access immediately and is not notified. Previously shared content they've already read cannot be erased from their memory — but Elvera's systems no longer surface it to them.

Legacy Release Rules

A gift that arrives when the time comes.

Legacy packets are your words, your portrait, your witness truth — delivered to the people you choose, when you define it's right.

  • Unlock conditions are set by you. You define what triggers release — a date, a milestone, or a designated manual trigger held by a trusted contact.
  • Recipient access is scoped. Recipients only see what you designated for them. Multiple recipients can each have different packets with different visibility scopes.
  • Sealed means sealed. Even the recipient cannot request early access. Even Elvera's team cannot override the seal. The condition you set is the condition.
  • Inherited content can carry all four privacy states. A legacy packet can itself contain private, shareable, and sealed sub-components. Nested permissions are respected at release.
  • You can revoke or edit until release. Until the unlock condition fires, you can modify, add to, or revoke any legacy packet. Once released, it cannot be recalled — only deleted by the recipient.

"Sealed vs. Inherited — the difference."

Sealed means no one can access it — not even you — until the condition fires. It's a vault with a timer, not a permission.

Inherited means it has a designated recipient and a release mechanism. It may also be sealed while it waits. Inherited packets are always released to a specific person — they are never broadcast.

You can have a sealed packet that is also inherited. The seal lifts at the condition. The recipient can then access what was designated for them.