Privacy

Who provides Gurato

Gurato is provided by Gurato - webxpert. Registration number 213186. Tax ID 376-564-180.

What we collect

In a room we hold the messages you send, and any brief you write for Mr. H. If you create an account we hold your name, email, and a password hash or a Google account link. A signed-in device may store a push token. We also keep session records, room titles, display names, consent records, and AI traces that record categories and ids. Application logs never contain message bodies.

How it is processed

Stage 1 is standard cloud infrastructure. Plaintext reaches our backend and the model provider that Mr. H runs on. This is not zero-knowledge, and we do not claim end-to-end encryption. Encryption in transit and at rest is in place.

Where it is processed

Built and hosted on our own machines in Germany. One thing leaves them for the conversation itself: the model Mr. H runs on is an external call, so plaintext reaches that provider too. Two further processors sit beside that path: a transactional email provider, for magic links and a copy of an invite, and Apple and Google push services when a signed-in device has registered. Production data sits in a managed EU Postgres. No analytics in the request path, no third-party service relaying your messages.

What we do not do with it

Conversations are not sold, not used for advertising, and do not train any model — ours or anyone else's.

• Your conversations do not train any model, ours or anyone else's.
• Your data is not sold. The model provider, the email provider, and push services process what they need to do their job — that is described above, and it is not a sale.
• There are no ads in Gurato.
• We do not run analytics or cross-site trackers. A session cookie is how you stay signed in.

Consent

Both people have to agree on the consent screen before anything in that room is processed. Consent is per room. Having an account does not replace it.

Retention and deletion

Transcripts have a short, fixed retention window, then they are deleted. When a session ends, a summary is retained and the transcript enters that window. Delete a conversation from the room and the messages, the summary, and everything derived from them go with it. A stripped tombstone remains briefly so the other person sees the room was deleted, then it too is removed.

Safety checks

Automated checks read the conversation to detect coercive control, a power imbalance, or a crisis. Those three end the session, close the room, and surface local support resources. A separate check reads anything Mr. H is about to say: if that draft would take a side, diagnose, or otherwise break the rules, it is discarded and the room stays open; if the draft itself is a crisis or coercion finding, the session ends. Categories are recorded, never the text. No Gurato employee reads your conversation to run these checks; the models do.

How room access works

A Gurato requires both a unique link and a 4-digit code. The creator shares both with the invitee. The code is stored hashed on our servers, never as plaintext. Neither the link nor the code alone is enough to enter. Codes expire with the invite (30 minutes by default), are limited to 5 attempts, and are single-room scoped.