Software by GLAdrian Gutierrez · Personal Software & AI
Sentinel
Sentinel · Legal

Privacy Policy

Last updated: October 27, 2026

Sentinel by Gold Life LLC lets you chat with Apple Intelligence (Built-In & Free), ChatGPT (OpenAI), Claude (Anthropic), Gemini (Google), and Muse (Meta) in one app. You can chat for free with built-in on-device AI or connect cloud providers with your own API key. Your chats, saved memories, and AI Soul are protected with GLS1 zero-knowledge encryption and sync seamlessly across your devices. When using cloud providers, your device sends messages straight to the AI company you chose, after you allow sharing. The Sentinel app has no ads and no analytics of its own, and we do not sell your data.

1. Your Gold Life ID

To use Sentinel, you sign in with your sovereign Gold Life ID: an eight-digit account number that works across Gold Life apps. You sign in with an email or phone one-time code and Passkey.

  • Gold Life ID: No password. We send you a one-time verification code. Your first sign-in creates your Gold Life ID and anchors your zero-knowledge encryption vault.

If you prefer not to sign in, tap Explore with sample data. You see made-up chats. No message is sent to any AI company, you cannot connect a real key, and no chats, memories, or keys are saved. The sign-in system, Stytch, still starts when the app starts, sample data included, and may contact Stytch with basic technical information about the app and your device (see section 6).

2. What Gold Life stores for your Gold Life ID

Your Gold Life ID is kept in two places: on Gold Life LLC’s own servers, which run on Cloudflare, and with Stytch, the company that runs sign-in (see section 6). This is what each one holds:

  • Held by Stytch: the email address or phone number you sign in with, and any extra email address or phone number you add as a way to sign in with your Gold Life ID.
  • Held on our servers: your Gold Life ID number; an internal ID that points to your Stytch record; which of your sign-in email addresses and phone numbers may receive sign-in codes (kept as a pointer and a switch, never the address or number itself); and the profile details you add: your name, phone number, mailing address, profile photo, and your language and appearance choices. If you added a signature in another Gold Life app, that is kept too. Every profile detail is optional. You can change your name, phone number, and address on the Gold Life ID screen, or leave them blank.
  • Request counters: to stop abuse, our servers count requests, keyed to an IP address, a Gold Life ID number, or an email address. The type-your-ID and forgot-your-ID sign-in steps in some Gold Life apps use these counters. The Gold Life ID sign-in in Sentinel does not. Counters tied to your signed-in account are deleted with your Gold Life ID. The others have no expiry date and may remain.

When you delete your Gold Life ID, we delete the Stytch record with a request to Stytch. How long Stytch itself keeps anything is outside our control (see section 6).

Zero-knowledge vault separation. Your plaintext chats, saved memories, AI Soul, spend history, and API keys never reach Gold Life. One system feature to know about: as you type your mailing address, suggestions come from Apple Maps, so what you type in that one field reaches Apple under Apple’s own privacy policy. When you pick a profile photo, Apple’s photo picker gives the app only the photo you choose.

3. Zero-knowledge encrypted sync and on-device storage

Your Sentinel data is stored locally with iOS file protection on iPhone and iPad, and your Mac’s account-protected app storage on Mac, and your chats, saved memories, and AI Soul are encrypted on-device with your master vault key (GLS1 AES-256-GCM) before syncing across your devices:

  • Your chats, encrypted end-to-end with GLS1 (local file attachments stay on-device).
  • Saved memories: whole sentences from your own messages, saved word for word. After an AI answers, Sentinel saves any sentence of 10 to 160 characters that starts with or contains a phrase such as “my name is”, “I live in”, “I am”, “I like”, “I prefer”, “never”, “call me”, “always remember”, or “my project is” in English or Spanish. This is a phrase match, so it can save sentences you did not mean to keep. Sentinel keeps up to 1,000 notes and drops the oldest first. You can see and delete them in AI Soul, under Saved Memories.
  • Your AI Soul: the name, persona, environment notes, and owner message you set.
  • Your spend history, your spending limits, and a short log of past calls (which AI and model, token counts, and cost estimates), which remain strictly on your device.
  • A cached copy of your Gold Life ID profile: your Gold Life ID number, name, email, phone, address, photo, signature, language, and appearance. The Gold Life ID part of the app keeps it in the app’s ordinary settings storage, not in the file-protected files above. It is included in device backups and is deleted when you sign out.

Chats, saved memories (up to 1,000), and your AI Soul are encrypted on-device with your master vault key (GLS1 AES-256-GCM) and synced via your Gold Life vault so they stay available across your devices. Gold Life has zero access to your plaintext or master key. BYOK API keys and spend history remain strictly on-device.

Signing out, or your sign-in session ending, deletes all of it from this device, along with any unsaved (session-only) API keys and your Allow Sharing choice. If you turned on Save API Key for a provider, that saved key stays in your iCloud Keychain for your Gold Life ID until you disconnect it in Connect AI or delete your Gold Life ID. The app warns you before you sign out.

Your device’s own backup (iCloud Backup, or a backup to a computer) may include these files, because Sentinel does not exclude them. If you restore a backup onto another device, the files come back with it. Session-only API keys are held only in memory and are never backed up. Saved API keys are stored in iCloud Keychain for your Gold Life ID so they stay available across your Apple devices and across Gold Life apps with Sentinel enabled.

4. Bring Your Own Key (BYOK) and your API keys

Sentinel does not sit in the middle of your AI use or mark it up. You give it your own API key for each AI company you want to use:

  • Session-only or saved in iCloud Keychain: When you enter a key, Save API Key is off by default, so the key is held only in memory for your current sign-in session and is wiped when you sign out. If you turn on Save API Key, review this Privacy Policy and the Terms of Use, check the confirmation box, and tap Agree & Continue, the key is saved in your iCloud Keychain tied to your Gold Life ID. A saved key syncs end-to-end encrypted through Apple’s iCloud Keychain across your Apple devices and across Gold Life apps with Sentinel enabled, and reloads only when that same Gold Life ID is signed in. Another Gold Life ID signing in on the same device cannot see or use your saved key.
  • Zero server collection: Gold Life LLC servers never receive, log, inspect, or store your AI API keys.
  • Each key goes only to its own company: Sentinel sends a key to the company it belongs to, and nowhere else. It does this when you connect the key (to check that it works), when you refresh that company’s model list, and with each message you send to that company. Checking a key or a model list sends none of your chats.
  • Fixed addresses: Messages go to the company’s own API address: OpenAI, Anthropic, Google, or Meta for Muse. You cannot point Sentinel at a different server.
  • Billing: Each company bills your key for what you use. Gold Life adds no markup.

5. What is sent to AI companies

Sentinel sends none of your messages, files, AI Soul, or saved notes to an AI company until you have read what it shares and tapped Allow Sharing. Connecting a key or refreshing a model list does contact the company with your key only (see section 4). The sheet appears the first time you send a message with an AI connected. It appears again after you sign out, or if we change what it says. If you close it without allowing, nothing is sent.

Once you allow it, each message goes to one AI company, from your device, with:

  • What you type in the chat, and the earlier messages in that chat. Sentinel sends your latest six messages in full (yours and the AI’s). For each earlier message, it sends one short line: the first 100 characters of that message, and the names of any files attached to it. There is no limit on how many of these lines are sent, so this summary grows as the chat gets longer. If you switch AIs in the middle of a chat, the new AI gets all of this, including answers from the AI before it.
  • Photos, PDFs, and text files you attach. Attachments on any of the last six messages are sent again with every new message, up to 12 MB of photos and PDFs in total (the newest first). Text files are sent as text. Photos are shrunk to 1,024 pixels on the long side when you attach them. Older attachments are not sent again; only their names appear in the summary. Muse reads text only, so photos and PDFs are not sent to it; only their names are.
  • Your AI Soul: the name, persona, environment notes, and owner message you set.
  • This device’s details: whether it is an iPhone, an iPad, or a Mac, its hardware model code (for example, iPad16,3, which Apple uses internally and which does not give the model name), its iOS, iPadOS, or macOS version, Sentinel’s version and build, your app language, and which screen layout is showing. It never includes the device’s name or an identifier that follows you.
  • Up to four of your saved memory notes (see section 3), chosen by how well they match words in your message and how recent they are, within a small size limit.

Your API keys (except the key to its own company, which is how that company bills you) and your Gold Life ID details are never sent. The company also sees the technical details every internet request carries, such as your IP address.

Other AIs you connected. Two features can send a message to a different AI than the one you picked. They only use AIs you have already connected. Smart Task Routing is a switch in the Menu that is off until you turn it on. When it is on, Sentinel picks a model for each message from the AIs you connected, based on how hard the message looks. If the message has photos or PDFs, it prefers an AI that can read them. Automatic switch is always on: after an AI company’s servers answer with a server error (an HTTP 5xx error) three times in a row, Sentinel uses another AI you connected for 60 seconds. A wrong key, a billing problem, a rate limit, or a dropped connection does not count. The chat tells you when a different AI answered.

How to stop. In Connect AI, switch an AI off and tap Disconnect. That deletes its key (including any key saved in iCloud Keychain for your Gold Life ID), stopping any further requests to that company. Signing out also deletes any session-only keys and your Allow Sharing choice, so you are asked again. What a company already received stays with it, under its own rules. Sentinel cannot take it back.

Each AI company handles what you send it under its own terms and privacy policy. Each also sets its own rules about whether it uses your content to improve or train its models, and the rules can depend on the plan your key is on. Check your own plan before you send anything private.

  • OpenAI (ChatGPT): Governed by OpenAI’s Privacy Policy. OpenAI says on its API data page that data sent to its API is not used to train its models unless you opt in.
  • Anthropic (Claude): Governed by Anthropic’s Commercial Terms of Service and Privacy Policy. Those terms say Anthropic may not train its models on customer content from its services.
  • Google (Gemini): Governed by the Gemini API Additional Terms and Google’s Privacy Policy. These terms treat free use (such as Google AI Studio and the free quota of the Gemini API) differently from paid use. For free use, Google says it may use what you send to improve its products and that people may read it, and it asks you not to send sensitive, confidential, or personal information. In the European Economic Area, Switzerland, and the United Kingdom, Google applies its paid-use data terms to free use as well.
  • Meta (Muse): Governed by Meta’s Privacy Policy and its developer terms. Check them for how Meta uses what you send.

Those are the companies’ own rules, not ours, and they can change. Gold Life does not control what these companies do with what they receive.

5A. Sentinel for Mac

On macOS, Sentinel includes local desktop tools and a menu-bar quick prompt in addition to the features above:

  • Where Mac data is stored: Your Mac sessions, settings, and encrypted vault cache are stored inside your Mac user account’s app storage (settings storage and Application Support), and your chats, saved memories, and AI Soul sync across your devices with the same GLS1 (AES-256-GCM) zero-knowledge encryption described in section 3. Signing out wipes your local Mac sessions and settings.
  • Seven local desktop tools and trust tiers: Sentinel for Mac can run seven local tools on your Mac: Read File (reads a file at a path), List Directory (lists files and folders at a path), Search Files (searches filenames and text within a folder), Write File (creates or overwrites a file, with Undo), Update File (replaces target text inside a file, with Undo), Delete File (moves a file to the Trash by default so it can be restored, or deletes it permanently if requested), and Run Command (runs a shell command in zsh with a 30-second timeout). Every tool runs only on your Mac under the trust policy you choose in Settings → Trust & Permissions (Autonomous with Undo, Confirm 1st in Session, Confirm Destructive, or Always Confirm). Read tools default to Autonomous with Undo, write tools default to Confirm Destructive, and Delete File and Run Command require confirmation. When Sentinel runs one of these tools during a chat turn with a cloud AI provider you connected, the tool’s input arguments (such as the file path, search query, or command) and the tool’s output result (such as the file contents, directory listing, or command output) are included in the conversation sent from your Mac to that AI provider. Nothing from these tools is ever sent to Gold Life’s servers.
  • macOS system permissions: In Settings → Trust & Permissions, Sentinel checks whether you have granted macOS Accessibility, Screen Recording, and Full Disk Access permissions and offers a button to open macOS System Settings. These permissions are optional and are used only when you ask Sentinel to run local tools on protected folders or desktop workflows on your Mac.
  • Menu-bar quick prompt: Prompts you send from the Sentinel menu-bar window go into your active session and follow the exact same Allow Sharing consent and provider rules in section 5.

6. Third parties

These companies are involved besides the AI company you choose in section 5:

  • Stytch, a Twilio company, runs the Gold Life ID sign-in. It receives the sign-in information you give (such as your email address or phone number and the one-time code). It never receives your chats. Stytch may check signals from your device to help protect sign-in from fraud and automated attacks. It handles this under Twilio’s privacy notice.
  • Apple distributes the app on the App Store, suggests addresses through Apple Maps when you type your mailing address, and provides the photo picker. Apple handles this under its own privacy policy.
  • OpenAI, Anthropic, Google, and Meta receive your messages when you use their AI, as section 5 says, under their own terms and privacy policies.

Gold Life does not sell your data to any of them or to anyone else.

7. No ads, no tracking

The Sentinel app has no ads, no ad networks, and no analytics or tracking code of its own. Nothing in it tracks you across other companies’ apps or websites. We do not sell, rent, or monetize your data. Our sign-in service collects some technical information itself, as section 6 says.

8. Deleting your data and your rights

You control your data. These are the ways to delete it:

  • One chat: Swipe the chat to the left in your chat list (in the Menu on iPhone, in Conversations on iPad), or use the delete button in the chat, then confirm. This also deletes the photos and files attached to that chat from your device. Sentinel has no button that clears all chats at once. To delete everything, sign out.
  • Saved memories: Open AI Soul, then Saved Memories. Swipe a note to delete it, or tap Delete All Memories.
  • An API key: In Connect AI, switch the AI off and tap Disconnect. That deletes the key from this session and, if you saved it with Save API Key, deletes it from iCloud Keychain for your Gold Life ID.
  • Everything on this device: Open the Menu and tap Sign out. The app tells you what it will delete from this device and asks you to confirm: your chats, saved memories, AI Soul, spend history, and any unsaved AI connection keys. Keys you saved with Save API Key stay in your iCloud Keychain for your Gold Life ID until you disconnect them in Connect AI or delete your Gold Life ID. Signing out clears this device while your encrypted GLS1 vault backup remains stored for your Gold Life ID until you erase your Sentinel data or delete your Gold Life ID.
  • Your Gold Life ID: Open the Menu, tap the gold Gold Life ID button under Personal, then tap Delete my Gold Life ID at the bottom. The Delete Account screen it opens lists the Gold Life apps and what each one still holds for you. My Business and Sentinel appear there, and an app with no cloud data reads “Nothing left to delete”. If an app still holds your data, you erase that data first on that screen (for Sentinel, this wipes your encrypted Sentinel vault from the cloud via DELETE /account?app=sentinel as well as clearing your local device). Until then, the Delete my Gold Life ID button on that screen stays dimmed, and our servers enforce the same rule. When the button is available, you type your Gold Life ID to confirm. Then, if your device has a passcode, you confirm with Face ID, Touch ID, or your passcode; if it has none, that step is skipped. It happens right away and cannot be undone. It deletes your Gold Life ID and the profile details on it, signs you out, and Sentinel deletes its data from this device and any API keys saved for your Gold Life ID.

Depending on where you live, you may also have the right to see what is held about you, to correct it, or to delete it. You can do all of this yourself in the app: the Gold Life ID screen shows and edits your details, and Delete my Gold Life ID (see above) erases your encrypted Sentinel vault and deletes your Gold Life ID and the profile details on it.

9. How long we keep it

  • On your device and in iCloud Keychain: Your chats, saved memories, AI Soul, spend history, and session-only keys stay until you delete them, or until you sign out or your sign-in session ends. Keys you saved with Save API Key stay in your iCloud Keychain for your Gold Life ID until you disconnect them in Connect AI or delete your Gold Life ID.
  • Your Gold Life ID: It stays until you delete your Gold Life ID. When you do, the ID and the profile details on it are deleted right away, and the Stytch record is deleted too. We keep the retired ID number and the date it was retired, with no link to you, so the number is never given to anyone else. The request counters in section 2 that are keyed to an IP address, a Gold Life ID number, or an email address are not part of your profile and are not deleted with it.
  • At the AI companies: Each company keeps what you sent it for as long as its own rules say. Sentinel cannot delete it for you. Contact the company.

10. Children

Sentinel is not directed to children. Our Terms of Use say you must be at least 18 years old, or the age of majority where you live. We do not knowingly collect information from children. A Gold Life ID can be deleted from the Gold Life ID screen in the app with Delete my Gold Life ID (section 8).

11. Changes to this policy

We may update this policy from time to time. The “Last updated” date above will reflect any change.

12. Contact

Questions about this policy? Email adrian@softwarebygl.com. See also our Terms of Use.