Any closed alpha

Privacy Policy

Effective 13 September 2026

Archived policy, superseded on 21 October 2026. Read the current Privacy Policy.

Any Association ("we", "us") operates the Any closed alpha (the "App") and is the controller of the personal information described in this policy. This policy explains how information is handled when you join the test, install, register for or use the App, including its optional AI features.

This policy covers the App. Our websites and community forum provide separate privacy information for their services.

1. The essentials

• Content stored on our sync and backup network is end-to-end encrypted. We do not hold your recovery key and cannot decrypt that content.
• AI is optional. You can use Any without it. AI requests go directly from your device to your chosen AI service using your own API key. Any's servers do not receive your prompts or responses through the AI feature.
• An AI service receives the information included in a request. Encryption of content on our sync network does not prevent that separate disclosure.
• We collect account, network and usage information as described below. App analytics operate in every network mode, including local-only and self-hosted modes.
• We do not sell your information or share it with third parties to advertise their products to you.

2. Account information and content

Identifiers and names. Your account and device have identifiers based on public cryptographic keys generated on your device. These allow recognition of accounts and devices and validation of requests. We treat them as pseudonymous identifiers: they need not contain your real name, but may be associated with information about you.

Your local name is visible to participants in spaces you share or join. If your account uses an existing public identity name recorded on-chain, that name and its associated identifier are public records.

Encrypted content. Private and shared spaces contain your content. Encryption keys are generated on your device; your recovery key is not stored on our servers. Shared-space encryption allows authorized participants to access shared content. Content stored on our network remains end-to-end encrypted.

When you switch to local-only mode or your own network, content created after that change is not stored on our network. Section 8 explains deletion of content stored on our network.

Alpha participation. We use information you provide in communications about joining or participating in the test to respond and manage your participation. The current closed alpha has no paid Any plans. AI-provider charges are handled under your separate provider account.

Support and surveys. We receive information you send us, potentially including your email, account identifier and troubleshooting details. If you include an AI prompt or response in a support message, we receive the material you send; normal AI requests do not pass through our servers. Do not send us your recovery key or API key.

Surveys are not linked to your account identifier, although a survey may ask for an email address. Information you publish in our community forum may be visible to anyone.

3. Network information and analytics

When you use our network, we may collect activation dates, usage events, device model, device family, memory size, operating-system information, account and device identifiers, and space and object identifiers. These support authentication, synchronization, deletion, security, troubleshooting and analytics. Registration IP addresses may be retained for up to seven days after account creation to prevent abusive registrations.

This network collection does not apply to activity on your own network or in local-only mode. Separate App analytics still apply in those modes.

App analytics include session lengths and counts; numbers of spaces, objects and blocks; App version, language, network mode and operating system; account and device identifiers; and error information with identifying details removed. These data help us understand usage and improve reliability. Linked identifiers are pseudonymous rather than necessarily anonymous.

Amplitude receives analytics through a proxy that prevents your device's IP address being disclosed to Amplitude. The current App has no analytics opt-out. It does not collect real-time precise location or use cookies. Google is not an App analytics provider; if you select Google for optional AI, it receives and processes your AI requests as described below.

4. Optional AI and agents

Any currently supports AI on a bring-your-own-key basis. You supply an API key for your chosen AI service. The key is stored on your device rather than on our servers. Requests travel directly from your device to that service; Any's servers do not receive prompts or responses through the AI feature.

Agents can read only content inside the App that you have permitted them to access. They cannot access data outside the App. Agents can create, edit and delete content, and perform actions available to a person within the App.

Agents sometimes ask for confirmation in chat, but do not ask before every action. Within an authorized task, an action can occur without another confirmation and may affect shared content or communications inside the App. Grant access and instructions with this behavior in mind.

Using AI may disclose your prompts and permitted App content to the selected service. That service needs access to the information sent for processing, even when the same content is encrypted on our sync network. Consider whether selected content includes personal information about you or others.

The supported integrations are OpenRouter, Anthropic, Google, and OpenAI. With OpenRouter, requests first reach OpenRouter and are then forwarded to a model provider according to the selected model and routing settings. Both OpenRouter and the downstream provider may process the content.

Provider processing is governed by the terms and privacy arrangements applicable to your provider account. Retention, training and human-review practices depend on the provider, service tier, model, and account arrangements. Supplying your own API key does not establish a universal no-training or no-retention commitment. Acknowledging this policy is not a blanket consent to additional processing by a provider.

The role of each recipient depends on the service and applicable agreement; the AI services you select are not automatically acting as Any Association's subcontractors.

5. Purposes and legal grounds

We use information to manage and maintain the closed alpha, respond to support requests, improve security and reliability, understand usage, conduct surveys, prevent abuse, enforce our terms and address disputes.

Where the GDPR applies, the legal grounds for these activities are:

• Contract: processing necessary to provide services you request, including account and test-access functionality and related support.
• Legitimate interests: operating a reliable and secure test, understanding usage, investigating errors, evaluating feedback, preventing misuse, enforcing our terms and handling claims, to the extent those interests are not overridden by your rights and interests.
• Legal obligations: records and disclosures required by applicable law.
• Consent: specific processing for which consent is required and obtained. Where we ask for consent, the request explains its purpose. You can withdraw consent without affecting the lawfulness of earlier processing.

Acceptance of our Terms or acknowledgment of this policy does not automatically constitute consent to every use of personal information. You can contact us about the legal grounds for processing and exercise applicable rights, including the right to object, as described in Section 10.

6. Recipients

We use service providers subject to confidentiality and appropriate contractual restrictions. Our service providers include:

We also use contractors and infrastructure providers to operate and support the service. Your selected AI service and, for OpenRouter, downstream model providers receive request content as described in Section 4. Shared-space participants receive content you share with them or authorize an agent to share through actions available in the App.

We may disclose information we hold to affiliates and contractors supporting the service or where required by law, court order or legal process. We make reasonable efforts to notify you of legally required disclosures unless prohibited. A legal request does not give us the ability to decrypt encrypted content on our network.

7. International processing

Our sync and backup network operates in Switzerland and the European Union. Service-provider processing includes the United States. AI processing locations depend on your chosen service, downstream providers and account arrangements.

International processing is subject to applicable data-protection law. Depending on the destination and recipient, relevant safeguards include adequacy decisions or recognized standard contractual clauses, with additional measures where required. Contact gdpr@anytype.io for information about the destinations and safeguards applicable to your data.

8. Retention and deletion

We retain personal information only for as long as needed for the purposes described in this policy or to meet applicable legal obligations. We determine retention according to the category of information, your use of the App, outstanding requests or incidents, and legal requirements:

• Encrypted content: content is stored to provide the synchronization and backup features you use. Use the App's account-deletion process to delete your account's encrypted content from our network.
• Registration IP addresses: up to seven days after account creation for registration-abuse prevention.
• Account metadata: while needed to operate your account, authenticate devices, manage participation and complete account-deletion requests. Limited records may be kept longer where needed for an unresolved security incident, dispute or legal obligation.
• Analytics and errors: while needed to evaluate feature usage and reliability, investigate faults and assess whether fixes resolve them. When account or device identifiers are no longer needed for these purposes, we delete them or convert the information into a form that no longer identifies you.
• Support, surveys and communications: while needed to respond to the request, evaluate the feedback or administer the communication. Relevant records may be retained for follow-up issues or disputes; communication preferences may be retained to respect your choices.
• Legal records: where necessary to comply with a legal obligation or establish, exercise or defend a claim, for the applicable statutory period or until the matter is resolved and retention is no longer necessary.

Deleting encrypted content from our network is distinct from deleting these separate records. It does not automatically delete copies already held by shared-space participants, public blockchain records, or information already sent to an AI service. The service's account controls and retention arrangements apply to information it holds. Contact us if you need help understanding what an account-deletion request covers, including information stored on your devices.

9. Security

We use measures designed to protect information against loss and unauthorized access, use, alteration or disclosure. Our ability to protect information also depends on your device security. Some local data may be unencrypted on disk; use device encryption and protect access to your device.

The closed alpha is experimental and may have defects that result in data loss, corruption, unavailability, or unauthorized disclosure. Keep independent copies of important information. The Terms of Use explain these testing risks. Alpha status does not remove our obligations under applicable data-protection law or turn acknowledgment of this policy into a waiver of your rights.

Keep your recovery phrase safe. We cannot recover the phrase for you or restore access if you lose both your key and other means of accessing your account. Network encryption does not protect content you separately send to an AI service or disclose to another person. Report security concerns to security@anytype.io.

10. Your rights

Depending on applicable law, you may request access, correction, deletion, restriction or portability of your personal information; object to processing; withdraw consent; and complain to the competent supervisory authority, including the Swiss Federal Data Protection and Information Commissioner.

You may also have protections concerning decisions based solely on automated processing that produce legal or similarly significant effects. The App's AI features involve automated processing; that does not by itself mean every agent action is such a decision.

Contact gdpr@anytype.io to exercise your rights. Requests concern information within our control; contact your selected AI service about information it holds.

11. Age and policy changes

The closed alpha is for people aged 18 or older. We do not knowingly collect personal information from children through the App. Contact us if you believe a child has provided personal information contrary to this requirement so that we can address it.

We will update this policy when practices or requirements change, identify its effective date, and provide notices required by law. Previous versions will remain available.

12. Contact

Any Association
c/o Sielva Management AG
Gubelstraße 11
CH - 6300 Zug, Switzerland
gdpr@anytype.io

Our EU representative is Anylab Gmbh, Meinekestraße 27, Berlin, 10719, Deutschland. Email: gdpr@anytype.io.