How Olive Protects Your Data
Olive scopes every note to you, your couple, or your space with row-level security in the database, encrypts sensitive notes, and keeps a private tier so a space-mate never sees what you mark private to you. Data lives on Supabase, hosted on AWS in us-east-1; Vercel serves the web app. Export your notes yourself from Profile settings, or email privacy@witholive.app to ask about anything else, including deletion.
Last updated: October 6, 2026
This page answers the questions people actually ask before they trust an app with what they tell it. Every statement below points at where that’s true in Olive’s own code or policy — nothing here is a claim we haven’t checked.
Who can see my notes?
Every table that holds a note is scoped with row-level security to a user_id, couple_id, space_id, or group_id — that’s a non-negotiable engineering rule for this codebase, not a policy promise: “Every new table needs RLS scoped to user_id, couple_id, space_id, or group_id. No exceptions — RLS is what makes Olive’s privacy moat.” In plain terms: the database itself refuses to hand your note to an account that isn’t you, your partner, or a member of the space you sent it to.
On top of that, some notes carry their own private tier even inside a space you share with other people. The rule for that tier, stated once and enforced everywhere it’s checked (supabase/functions/_shared/agent-private.ts:10): “a note is visible to a viewer ⟺ it is shared OR the viewer authored it.” A note you mark private stays visible to you and invisible to everyone else in that space, full stop.
Can my partner see my private notes?
Not unless you shared it. The private-note tier above exists for exactly this: a note you keep to yourself inside a shared space is readable by you and by no one else in that space, by construction, not by convention.
Where is my data stored?
On Supabase, which runs on AWS in the us-east-1 region — verified live against the running project via the Supabase MCP tool (most recently on 2026-10-06), not read off a document that could have gone stale. The web app itself is served by Vercel.
Which third parties process my data?
Seven, and only seven: Supabase (database and storage), Clerk (sign-in), Vercel (hosting the web app), Google (Gemini, for understanding what you send), Cerebras and Groq (fallback providers if Gemini is unavailable), and Meta (the WhatsApp Cloud API, since that’s where Olive lives). Nobody else touches what you send her.
How is my data protected technically?
Sensitive notes are encrypted — the module that does it lives at supabase/functions/_shared/encryption.ts in Olive’s own codebase. And the group-privacy boundary is enforced at the same level as the private-note tier above: “Personal olive_memory_files NEVER joined into group queries. Group notes scoped to group_id only.” Your personal memory never leaks into a group’s, and a group’s notes never leak into yours.
Can I export or delete my data?
Yes to both. You can export your own notes in a portable format right now, from your Profile settings in the app. If you’d rather we handle it — an export, a correction, or deleting your data outright — email privacy@witholive.app and we’ll take care of it.
Related reading
The full legal language lives in Olive’s Privacy Policy and Terms of Service.
See how Olive works — free during beta.