Privacy · tego

What tego holds

Your account. An email address, a password, and the name you choose to be known by. A photo if you add one. Nothing else is asked for, and there is no profile to fill in.

What you write and record. Your messages, whether voice or text, and the transcript of a voice message. Updates, comments and reactions. If you record something, tego keeps the recording.

What a circle is made of. Its title, the situation in two versions (see below), the tone it chose, the care needs and their private details, and the roster: who is in it, their role, and their tier.

Notification settings. Your per-circle preference, and, if you turn on notifications for a device, the subscription that lets that one device be reached.

Some things stay on your own device and are never sent anywhere: where you got to in a recording, and whether you have dismissed a prompt before.

Who can see it

This is the part worth reading closely, because it is the heart of how tego protects people and it is not how most products work.

In every circle, each person has a role and a tier. The role is recipient, coordinator or supporter. The tier is inner or wider. Inner is the people who would already know the hard details. Wider is everyone else who loves them: the coworker, the neighbour, the cousin. Both are real membership. Only one of them sees the sensitive version.

Concretely, that pair decides:

The situation. A circle keeps two: the full one and a warm, public-safe one. Wider members see only the public-safe version. They are never shown the sensitive one, and nothing in their view hints that a fuller one exists.
Updates. An update posted to inner is invisible to wider members, and so are its comments and reactions.
Private messages. A message sent just to the person at the center is readable by exactly two people: you and them. Not coordinators. Not family. Not tego staff through the product.
Care needs. The address, the contact number and the dietary notes are hidden until you claim the slot. Before you claim it, you see that a meal is needed on Thursday. Not where someone lives.
Gifts. An anonymous gift stays anonymous, including from the coordinators. The circle sees a total. It never sees a donor list it was not meant to.
Everyone else. A person who is not in the circle reads nothing at all. Not a preview, not a member list, not a count.

When a circle becomes a memorial, the private messages sent to the person stay sealed. Permanently. They are inherited by nobody: not coordinators, not family. That is what every person assumed when they chose to say something just to them.

These rules live in the database, not in the screens. Every table starts closed, and access exists only where a rule explicitly opens it. The check runs underneath every page rather than inside one, so a mistake in a screen cannot hand you something the rules have not already allowed.

They are tested rather than asserted. There is a suite whose whole job is to try the things that must fail: a wider member reaching for inner content, a supporter attempting a coordinator action, a coordinator opening a private message, an outsider reading anything.

Your voice

Recordings are the most personal thing tego holds, so they are never a public address. Audio lives in private storage that cannot be read by a link alone. When you press play, tego checks that you are allowed to hear it and then issues a temporary address that stops working shortly after, typically within thirty minutes. There is no permanent URL to a message to leak, forward, or find.

What leaves tego

tego runs on a small number of services, and this is the whole list.

Supabase holds the database, the sign-in system and the stored files. This is where your circle actually lives.
Vercel serves the website itself.
Resend sends the few emails tego sends: an invitation to a circle, and a note that something you were making is ready.
ElevenLabs turns speech into text and text into speech. If you record something, that recording is sent to be transcribed. If you have something read aloud in a generated voice, that text is sent to be voiced.
Anthropic is used only if you ask tego to help write a prayer or a meditation. What is sent is the directions you typed and the tone you picked. Your circle’s messages, its situation, its roster and its members are not sent, and the result comes back as a draft that you read and approve before anybody hears it.

Mixing your voice with music happens on a machine tego runs itself. That audio is not handed to a third party.

No payment company is connected yet. Giving is designed and written but not switched on, so nothing on tego will take a card today and no card details exist to hold. There is also no text-message provider connected: tego does not send SMS.

What tego does not do

No tracking. There is no analytics service, no tracking pixel, and no advertising network anywhere in tego. Not a single one.
One cookie. The only cookie tego sets is the one that keeps you signed in. There is nothing else to consent to, which is why there is no cookie banner.
Nothing is sold. Your circle’s content is not sold, rented, or shared for advertising, and it is not used to build a profile of you.
Nothing sensitive in a web address. A circle link is a random token. It does not carry a name, a condition, an email, or an amount.

Health information

tego is not a healthcare provider, and it is not covered by HIPAA. No doctor, hospital or insurer sends anything here. What is in your circle is what you and the people in it chose to write.

What protects it is the tier system above, so it is worth being deliberate about it. The sensitive version of a situation is inner by default for exactly this reason, and it is the coordinator’s call who is inner.

Deleting your account

You can delete your account from your account page at any time, without asking anyone. Here is precisely what happens, spelled out before you confirm:

Your name and photo come off anything you leave behind. It reads “A circle member.”
The private messages you sent are deleted.
Your own prayers and meditations, and their audio, are deleted.
Gifts you made stay as financial records, with your name and your account taken off them.
Your devices stop being notified.
You cannot sign in again.

Messages you sent to a circle stay in that circle, attributed to “A circle member.” They were a gift to somebody in a hard season, and taking them back out of their circle would take something from them rather than from tego.

Questions

Contact is honest about how to reach a person right now. If something on this page does not match what you see in the product, that is a defect worth telling us about, and it will be treated as one.

What tego holds, and who can see it