There is no record of your session. No record is made, to safeguard your privacy.

Your conversation is held in the browser tab you have open. When you send a message, that message and the exchange with SUMAI so far travel to our application, which uses them to find relevant passages from SUMAI’s library and to write a reply. Then they are gone. Nothing is written to a database, a file, or a log on the way through.

This is why the conversation has to travel with each message: the application has nowhere to keep it between one message and the next. What may look like an inefficiency is actually the security mechanism.

It also means there is no session history to return to. Close the tab and the conversation is gone, without a deleted file remaining on the system, because there was never a record made to begin with.

A passkey is an access code issued to one person. When you enter it, the system checks it against a list of valid codes and lets you in. That is all it does.

Your passkey is not an account: it carries no name, no email address and no employer details, and it is not attached to anything you go on to say. We store passkeys as one-way hashes, which means the database holds enough to recognise a valid code and not enough to reconstruct one or to tie session data to any individual user.

The system records code redemption once, as the date the code was first used, and does not record visit frequency, maintaining the highest levels of confidentiality at every stage.

At the end of a session, you can download a transcript as a single Word document. Because nothing is retained on our side, that file is the only copy that will exist anywhere, and it stays entirely with you.

We suggest using a document password, given that it contains everything you said: once the record is on your device, its safety is a matter of your own security preferences and responsibility.

If you want continuity between sessions, you can upload that file at the start of a future session. That is the only mechanism for continuity, and your words and data remain entirely in your own control from start to finish. If you have added a password, remove it before uploading the file here to ensure that SUMAI can read the protected file. If you retain a copy of the file, after uploading it you need to reinstate the password on the copy you retain on your device.

You can edit the document before you upload it, for example to take out a name you may have mentioned in the first session. The session carries on from what the document says now, and our software holds no hidden copies. Bear in mind that Word itself can keep deleted text, in tracked changes or its version history, so turn off Track Changes before deleting something you want gone.

Being clear about the exceptions matters more than the headline. Here is everything the database holds. None of it is conversation content.

Passkeys, as one-way hashes checked for code validation

Enough to recognise that a code is valid, never enough to reproduce it. The plaintext exists only at the moment it is issued to you. The date a code was first used is recorded, so codes can be managed; how often or when you visit after that is not. Alongside each code are the number of days it gives access for, counted from its first use, and a scrambled copy of a random marker held in the browser it was first used in, so that it works only on that device. The marker is made up by this site; it is not taken from your device and says nothing about you.

The Foundational Library

TGGR Ltd, the company providing the SUMAI service, selects and uploads evidence-based research, and the search index built from these scientific papers. This is the material on which the mentoring is based. It is not available for sharing and downloading.

Sign-in counters

To slow down anyone guessing at codes. The identifier is itself stored as a hash: enough to recognise a repeat attempt, not enough to know whose.

Your own actions outside SUMAI sessions

The optional questionnaire at the end of a session, if you complete it, and anything you send through the contact form. Neither is linked to your passkey or to anything you discussed with SUMAI.

Running the service

Administrator accounts for TGGR Ltd's staff, password-reset links, a log of administrator actions in the library, and a few settings. None of it contains anything you said.

There is no conversation table, no message table and no session table anywhere in the database. That is a design decision, not a setting that could be changed by accident.

Three organisations are involved in running this service. Each account belongs to TGGR Ltd.

The words of a conversation pass through this site’s hosting and through Amazon Bedrock in London, only for as long as it takes to write the reply, and none of them is stored on SUMAI’s systems. No analytics service, advertising network or tracking script runs on this site.

If you speak rather than type, your words are turned into text by Whisper local transcription, directly on to your own device, so the recording never leaves it. Whisper operates entirely on your device, meaning that your audio data does not leave your machine, and it is not processed by a third party. The first time, your browser downloads the speech model from this website, once.If your device cannot run Whisper, SUMAI falls back to Amazon Transcribe, run by AWS in London, which turns what you say into text as you speak. When SUMAI reads its replies aloud, the text of each reply is sent to Amazon Polly in London to be spoken. If you stay in text mode, no audio is created at all.

A small number of cookies, set when you sign in, which together tell the site you are allowed to be here and keep the sign-in itself safe from tampering. None of them carries your name or anything you have said. Your sign-in expires automatically four hours after you were last active. One more cookie holds the random marker that links your passkey to this device, because the first device to use a passkey becomes the only one that can use it; it is not used for anything else. There are no analytics, advertising or tracking cookies of any kind.

Your own browser also remembers your passkey and your voice choices, so you do not have to enter them again, and your choice of light or dark appearance. These stay in your browser; your passkey is only sent to us when you sign in. Clearing your browser’s site data removes them.

This is a reflective space and it is not an emergency service. It is not monitored by a person, no one is watching a screen at the other end, and nothing you write is reported or escalated. If you, or someone you are contacting SUMAI about, are in danger or in crisis, please contact appropriate organisations, for example professional health advisers, the emergency services, legal advisers, or a crisis line.

If you have a question about any of this, or about a feedback submission you have made, please get in touch through the contact page.

TGGR Ltd is responsible for this service and for the accounts described above. Formal data protection contact details will be published here before the service opens beyond Stage 1 testing.