Updated October 26, 2026
Who operates The Carry
Brantley Beaird operates The Carry, a reflection companion for trusted groups. It is not therapy, medical care or an emergency service. Contact bbeaird@gmail.com for privacy, safety or support questions.
Information used for the service
The connected service uses your name, email, account and sign-in identifiers, circle membership, meeting attendance, consent choices, plans, reflections, notes and support requests. If you choose to upload media, it processes audio and may receive video. Conversations may contain sensitive personal information. Do not upload material without permission from everyone involved.
Account and meeting metadata are readable by the service. Ordinary private reflections and personal notes use recipient encryption for storage and access; the server and AI providers can read temporary material during generation. Hosted Men v2.0 reflections use a separate server-readable encryption exception. For new meetings attended by Brantley Beaird, the service may save server-readable reflections without member-key setup; these reflections do not use recipient encryption. Ordinary meetings and previously encrypted reflections keep their encryption requirements. This is not end-to-end encrypted AI processing.
Recording and third-party AI
Recording starts only after the recording lead confirms everyone’s consent and explicitly starts capture. Imported recordings require consent too. If anyone declines recording or AI processing, do not record or import that conversation. Reflection exclusions still process the excluded person’s voice temporarily; they do not mean the microphone ignores that person.
AssemblyAI receives audio and participant names for transcription. Anthropic receives transcript text, speaker names and permitted reflection context to generate reflections and patterns and check generated text for unsafe content. Each private output is checked separately; unsafe or uncertain sections are withheld. These automated checks can make mistakes. The service reads this material to perform the requested workflow. Review AI output for errors. Provider retention and account settings may outlast The Carry’s cleanup; we do not promise that a provider retains no copy.
The service also uses hosting, storage and email-delivery providers to operate accounts and meetings. Information may be processed in the United States. It is not sold or used by The Carry for advertising or cross-app tracking.
Those providers have their own retention and data-use terms. The Carry’s cleanup does not override them; account-specific privacy settings and backup retention require separate verification.
Who can see retained content
Private reflections, personal notes, goals and commitments are for their owner. Plan sharing is disabled for this release, including access through earlier grants. Previously downloaded or exported copies cannot be recalled. Group and Meeting Process Reflections are shared with the audience stated in that meeting’s consent notice. Current meetings share both with attendees; some historical meetings also included named facilitators. Any attendee can remove a shared section for everyone. The speaker controls what he said, and the subject controls what is retained about him; either may veto.
A recording lead can access temporary source material during attribution and processing. Circle membership alone does not grant access to another person’s private reflections. Downloads, screenshots and copies another person makes outside the app cannot be recalled by The Carry.
Retention and deletion limits
For ordinary meetings, source cleanup runs after reflection generation, before review opens. A failed required cleanup blocks review. Addressable provider artifacts are deleted using provider-returned references; a provider without a deletion endpoint is recorded as not deletable. Working files, database rows, storage backups and provider-held copies are different retention layers, so an app deletion receipt is not proof of immediate forensic erasure everywhere.
When permanent archiving is enabled, Men v2.0 retains a separate encrypted audio archive indefinitely. Deleting a reflection section does not delete that archive; deleting the meeting does. Temporary-processing exclusions disable archiving. Turning off new archiving does not remove existing archives. A separate development audio copy may remain for up to 14 days.
Reflections follow the retention and expiry shown in the app; you can remove your private content and veto shared sections. Account and consent records support access, deletion and audit history. Encrypted recordings awaiting upload can remain on the recording device until delivered or discarded. Devices that are offline, exported copies and historical backups are not immediately erased by a server action.
Optional voice recognition
A voice profile is biometric data. With your separate consent, The Carry collects and stores a numeric voice embedding only to match your voice in your own consented meetings. Automatic voice matching examines every speaker, so every participant must give biometric consent first; otherwise the meeting uses manual speaker review. Enrollment is optional. It is not used for sign-in, advertising, sale, other identity searches, health or emotion inference, or training a shared model.
Enrollment audio is processed on The Carry’s own Render workers, not by AssemblyAI or Anthropic, and is discarded after embedding. Meeting samples are saved only from speech a human confirmed was yours. At most 12 samples are stored, encrypted to your member key. Your device may authorize use for one meeting for up to six hours. Other members cannot read or export your profile.
The active profile is destroyed at the earliest of your choosing Delete voice profile, completed account erasure, leaving or being removed from your last circle, or three years without actual authorized use in a consented meeting. Enrollment starts that clock; pausing, viewing the profile and accepting updated terms do not extend it. Leaving one of several circles removes samples from that circle; deleting a meeting removes its derived samples.
You can pause recognition or delete your profile in Account → Voice recognition. Pausing stops recognition without extending retention; deletion removes all active samples and consent and revokes meeting access. Re-enrolling starts a new profile. A material change to the voice notice requires your affirmative acceptance again before use.
Deletion covers the active service. Host snapshots, historical backups and offline copies have separate expiry and restore procedures; immediate forensic erasure of those copies is not promised. Legacy pilot profiles encrypted with a server key cannot be used for recognition; member-key setup and the current voice consent are required. Storage operators may still access those legacy copies until they are destroyed.
Encryption and recovery
Your iPhone prepares a personal encryption key. Optional passkey recovery can restore access and enable web access. Sign-in alone cannot recreate a lost key. If all usable key copies are lost, encrypted content cannot be recovered. Key recovery and microphone permission are separate choices.
Optional usage analytics
Optional usage analytics stay off until you turn them on in settings. The iPhone app (build 54 and later) sends no events before sign-in. Segment and Google Analytics receive approved top-level navigation and sign-out categories; the web client also sends approved sign-in, button, link and form-attempt categories. These events exclude content, names, emails, account/circle/meeting identifiers, private detail, recording and safety screens. A temporary random identifier stays in memory. There is no session replay or cross-visit identity.
Choose whether to share usage analytics in About & privacy on iPhone, or Usage analytics and privacy on the web. Browser Do Not Track and Global Privacy Control also disable it. Requests omit cookies and use an IP-zero override, but providers still receive the connecting network address. Turning analytics off stops future events, not copies already received. Synthetic demo, offline sample, local showcase and native development builds do not send these events.
Diagnostics and safety reports
We review safety reports within 24 hours and remove objectionable content or abusive accounts when a report is upheld. Routine reports are resolved within 7 days. This is not an emergency service; if someone is in immediate danger, contact local emergency services.
Signed-in iPhone sessions automatically send bounded diagnostic categories, timestamps and app version to The Carry’s server, linked to the account for troubleshooting. They do not include raw speech, transcripts, reflection text, exception messages or screen recordings. The local cache keeps up to 100 events from seven days and prunes on access. Server diagnostics persist until account deletion; automated diagnostic expiry is not implemented. This is separate from optional usage analytics.
Safety reports contain a selected reason and relevant account/content identifiers, not a copy of private content. Use Safety & support to report an issue or block a member. Blocking prevents future shared meeting rosters and plans; it does not erase existing meeting history or remove another person’s retained content.
Your choices and account deletion
We complete account deletion within 30 days. If source cleanup delays completion, we email you an update before that deadline. The request stays pending until verified completion.
To withdraw consent, turn off usage analytics in About & privacy, pause or delete your voice profile, decline or stop a recording, or request account deletion.
In Account & Security on iPhone, or Account & Privacy on the web, choose Request account deletion. You do not need to contact support to start it. This begins an operator-verified procedure; the app shows pending until completion is confirmed. New sign-in links are blocked while pending. The procedure removes your account, your retained content, sessions, diagnostics and recovery registration; other members retain their own content. Completion is communicated by email.
Provider-held copies, backups, downloads and offline devices have the limits described above. Contact bbeaird@gmail.com for an update or to exercise privacy rights. The completion timetable covers the active Carry service; it does not promise immediate erasure of copies outside that service.
Contact
Email privacy support. Do not include private meeting content in email.