Security & privacy
Conversation content goes to two specialist providers to do the work. It does not become a Between Us database, support ticket, analytics event, or developer dashboard.
Nobody at Between Us can view or retrieve your conversations through product or support systems.
Current native architecture · final legal review still required before paid launchWhat leaves your Mac
Deepgram receives audio. Anthropic receives transcript text. No other outside company receives conversation content.
01 · audio
Transcribes the recording and separates the two speakers. Audio travels directly from the app to Deepgram using a short-lived token.
02 · transcript text
Analyzes speaker-labelled transcript turns to produce structured observations. No Between Us account, couple, device, email, billing, invitation, or session identifier is included.
The complete data path
On your Mac
Both people consent. Recording state stays visible. Audio begins in a protected temporary location on the Mac.
External provider
The app sends audio directly to Deepgram for transcription and speaker separation. Between Us servers never receive the audio.
On your Mac
Speaker-labelled transcript turns return to the app and live in memory or protected temporary storage while the conversation is active.
External provider
A stateless Between Us relay forwards transcript text and the analysis rubric to Anthropic. Product and account identifiers are excluded.
On your Mac
Useful derived results return to the Mac and are encrypted locally. Temporary audio and transcript material is deleted after processing.
A precise note about the relay
The transcript does pass through a narrowly scoped Between Us relay on its way to Anthropic. The relay must read enough of the request to validate its shape and forward it, but it is built not to log, persist, or attach product identifiers to that content. Saying the transcript never crosses Between Us infrastructure would be inaccurate; saying Between Us does not retain it and cannot retrieve it through product or support systems is the verified operating promise.
What the developers can see
Between Us needs enough information to run accounts, consent, access, limits, and billing. That metadata is deliberately separated from what you said.
Available
Not available
Retention, not hand-waving
The honest limits
Removing account identifiers does not make spoken words anonymous. A conversation may name people, places, employers, diagnoses, or other identifying details.
Between Us makes an operational promise, not a cryptographic impossibility claim: no product or support path retrieves conversations, no Between Us storage retains audio or transcripts, and the control plane rejects content-bearing metadata.
The public paid launch remains gated on clean-machine network inspection, deletion inspection, content-free log review, provider-policy review, and final legal language.