Where your data goes
BondBook · Updated 2026-11-13
Where it's stored
Everything you keep in BondBook is stored by Hetzner Online GmbH in Finland, in the EU.
Encrypted nightly backups on the same server, deleted 14 days after they're made.
Hetzner Online GmbH (Germany)
Hosts our servers, database and backups.
Where: Finland, in the EU.
When: Always.
What it gets: Everything stored in BondBook.
How long it keeps it: While your account exists. Backups go 14 days after they're made.
Under: Data processing agreement.
Anthropic PBC (United States)
Runs the AI (Claude) behind AI features.
Where: United States.
When: Only while AI features are on.
What it gets: What each AI feature needs, as listed under AI features, and nothing while AI features are off.
How long it keeps it: Only for a limited time, for safety and abuse monitoring. It doesn't train its models on what we send.
Under: Commercial terms with a data processing addendum.
Postmark, by ActiveCampaign (United States)
Sends account emails: codes, and a notice when your password changes.
Where: United States.
When: Always.
What it gets: Your email address and the email itself.
How long it keeps it: 45 days, Postmark's standard period. Open and link tracking are off.
Under: Data processing agreement.
Apple (United States)
Distributes the app, turns speech into text when you dictate, and shows a place in Apple Maps when you open one.
Where: On your iPhone where possible, otherwise Apple's servers.
When: Only when you dictate, or open a place in Maps.
What it gets: What you dictate, when your iPhone can't recognise it itself; A place's name or address, when you open it in Maps from an event.
How long it keeps it: Under Apple's terms for dictation and for Maps.
Under: Apple's developer agreement.
Let's Encrypt (United States)
Issues the certificate that keeps the connection to BondBook encrypted.
Where: United States.
When: Always.
What it gets: Our server's name, never anything about you.
How long it keeps it: Public certificate records.
Under: Its subscriber agreement.
What each AI feature sends
Nothing is sent while AI features are off. When they're on, each feature sends only this:
- Ask Bond: Your messages, your name, and a list of your contacts with their names, closeness and company. It also sends what it looks up to answer you: a contact's profile, without phone numbers, email addresses or street addresses, and your notes, events and reminders.
- Who a note is about: While you write a note, or when you ask Bond to read a saved one: the note, your name, and the names of the contacts it mentions.
- Note preview: The note as you write it, or a saved note you ask Bond to read, your name, and that contact's profile, without phone numbers or email addresses, to show what saving will add. Saving adds only that.
- Checking notes: Each note you save without Bond reading it first, on its own, to check whether it mentions something BondBook isn't meant for, such as someone's health or beliefs. A note that does is never sent again.
- Reviewing your notes: When you ask Bond to review your notes: each note it hasn't read, your name, and that contact's profile, without phone numbers or email addresses.
- Meeting prep: That contact's notes and profile details, and the meeting's purpose.
- What a meeting is for: The event or reminder's title and description, that contact's latest notes, and the check-ins still open.
- Gift ideas: That contact's profile and recent notes.
- Industries, skills and circles: That contact's job, background and interests, the names and groups of people they share connections with, and the names of your circles.
- Questions for next time: That contact's profile and recent notes.
- Answers to Bond's questions: The question, your answer, and that contact's profile.
- A relative as a contact: What you wrote about the relative, and the notes about the person they're related to that mention them by first name.
- Spellings that mean the same: The values in one field across your contacts, such as companies or interests, to group different spellings.
- Overnight updates: For contacts whose records changed that day: what detecting industries, skills and circles, gift ideas and questions for next time send.
Details BondBook isn't meant for
BondBook isn't for keeping details like these about anyone. When AI features are on, Bond checks each note before reading it. A note that mentions one is kept exactly as you wrote it, but Bond doesn't read it or add anything from it, and it isn't sent to our AI provider again. In a chat, the message that mentioned one, and Bond's reply, aren't sent again. Bond never adds one to a profile or works one out from a hint, and gift ideas, questions to ask and suggested circles never draw on them. Food allergies aren't among them.
- Health: physical or mental health: an illness, condition, disability, injury, pregnancy, medication, therapy or addiction, or a diet followed for a medical reason
- Religion or beliefs: religious or philosophical beliefs and practice, or a diet followed for a faith, such as halal or kosher
- Politics: political opinions, party membership, activism or how someone votes
- Sex life, sexuality or gender: sexual orientation, sex life or gender identity
- Race or ethnicity: racial or ethnic origin
- Trade union: trade union membership
- Crime: offences, arrests, charges, convictions or time in prison
- Genetic: genetic test results, DNA, or an inherited condition or trait read from someone's genes
- Biometric: fingerprints, face or voice prints, or other measurements of the body used to recognise someone
- Money trouble: debts, money trouble, bankruptcy, salary or wealth. Bond keeps these off profiles too, but a note that mentions one is still read.
Where your contacts come from
- Your iPhone's contacts: read on your iPhone. Kept: The people you choose to import.
- Google contacts: read on your iPhone, which sends us only the people you choose. Kept: The people you choose to import. We never get your Google sign-in. Not available yet.
- Outlook contacts: read on your iPhone, which sends us only the people you choose. Kept: The people you choose to import. We never get your Microsoft sign-in. Not available yet.
- A LinkedIn connections export: read on your iPhone, from the file you choose. Kept: The people you choose to import.
How long we keep things
- Your account and everything in it: Until 30 days after you ask to delete it. A contact, note or photo goes as soon as you delete it
- A record that an account was deleted: its reference, dates and the account's id, with no name: 12 months, so a restored backup can't bring the account back. The address the receipt goes to is kept only until it's sent
- Your chat with Bond: 90 days, or sooner if you clear it
- Reminders you've ticked off: 30 days after you tick them off, or sooner if you delete the contact they're about
- Copies kept so a merge or change can be undone, and what Bond proposed that you didn't confirm: 30 days
- What Bond read in a note before you saved it: Until you save the note, and a day at most
- Meeting briefs Bond prepared: 30 days, then prepared again when you need one
- What a review suggestion said, once you've decided: 30 days. A note that you decided stays, so it isn't suggested again
- Encrypted backups: 14 days after they're made
- Server logs, which never hold what you sent or your network address: 30 days
- Signed-in sessions: 90 days after you last use them, and a year after signing in at the latest
- Emailed codes: 15 minutes to reset a password, an hour to confirm an email
- "Secure my account" links: 72 hours
- Saved answers to requests the app retries: 24 hours
- Daily counts of AI use, for the limits: 7 days
- Copies of account emails at Postmark: 45 days
What we don't use
No advertising networks, no analytics or crash-reporting services, no data brokers and no services that look people up. Nobody pays us for your data.