Legal

Privacy Policy

Effective November 3, 2026 · version 2026-11-03 · Terms of Service · Privacy Policy · Acceptable Use Policy

This policy explains how Enbrite LLC (“Enbrite”, “we”, “us”) handles personal data when you use Wren, the Wren web and mobile applications, the hosted Wren service at wrenpilot.com, and this website. It is part of our Terms of Service.

“You” means a person or business that uses Wren. “Your Wren” means the private Wren instance that works for you. If you run Wren on a computer you own instead of our hosted service, Section 11 explains what differs.

1. The short version

• Your Wren runs on its own private machine, separate from every other customer’s. Its contents (your chats, tasks, files, settings and connected sign-ins) are yours and are used only to do what you ask.
• Enbrite keeps a small account record (your email, a password hash, your plan and billing references) to run your subscription. It is separate from your Wren’s contents.
• Wren connects to a service (Gmail, LinkedIn, Instagram and others) only after you sign in to it and approve the access yourself, and it never sends, posts or pays on your behalf without your approval of that action.
• Hosted data is encrypted at rest with keys that Enbrite manages. This is managed encryption, not zero-knowledge: our systems hold the keys, so Enbrite could technically read your Wren’s data. We do not, except as described in Section 6.
• We do not sell your personal data, use it for advertising, or use it to train AI models.
• Deleting your account deletes your Wren and its backups.

2. What we collect

Account data. Your email address, a one-way hash of your password, any passkeys you add (their public keys only), the version of the Terms you agreed to and when, and the time of sign-in events. We keep this in our control service.

Billing data. Your plan, its status, and Stripe customer and subscription identifiers. Card details go to Stripe only; Enbrite never sees or stores your card number.

Your Wren’s contents. Everything inside your Wren: conversations with Wren, tasks and routines, files it creates or you give it, settings, and the sign-ins and tokens for services you connect. This may include personal data about you and about the people you deal with (for example the contents of your mailbox). This data lives on your Wren’s private machine and in its encrypted backups.

Service records. When your Wren started and stopped, resource and AI usage counts, error codes, and the IP address and browser type of requests to the account pages. These are for running, billing, securing and fixing the service.

Website and sign-up data. If you request an invitation on wrenpilot.com, the email address and any note you enter are emailed to us. Our website host keeps standard server logs (IP address, browser type, pages visited) for security and reliability. We do not use advertising trackers.

Support. Messages you send us, and anything you share with us so that we can help.

3. How we use data

We use data to provide the Service you asked for; to run your subscription and send account emails (confirmation, receipts, trial reminders, security notices); to keep the Service secure and reliable; to respond to support requests; to comply with the law; and to enforce our Terms. We send marketing email only if you ask for it, and you can stop it at any time.

Where the GDPR or UK GDPR applies, our legal bases are: performance of our contract with you (providing the Service and billing); our legitimate interests (security, reliability, preventing abuse, improving the Service in ways that do not involve reading your content); your consent (where you give it, for example marketing); and legal obligation (tax and accounting records).

4. AI model providers

To understand your requests and draft replies, Wren sends the text a task needs to an AI model provider. Which provider depends on your plan:

• AI included. Requests go through Enbrite’s own provider accounts (currently Anthropic, OpenAI and OpenRouter) under terms that do not allow the provider to train on your data, with a spending limit for your Wren.
• Bring your own key. Requests go to the provider under your own key and your own agreement with that provider.

Only the parts of your data a task needs are sent, for that task. Providers may keep requests briefly for abuse monitoring under their own policies. Enbrite does not use your data to train AI models, and does not allow providers to do so on our account.

5. Services you connect, including Google

When you connect a service, Wren receives only the permissions shown on that service’s own consent screen, uses them only for the tasks you ask for, and acts through them only with your approval. You can disconnect a service at any time from Wren, which deletes the stored sign-in.

Google. Wren’s use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. Gmail and Google Workspace data is used only to provide the features you choose (reading, filing, drafting and sending mail with your approval, and the routines you set up). It is not used for advertising, is not sold, is transferred to others only to provide those features, with your consent, for security, or as required by law, and is not read by humans except with your explicit permission for a support request, for security, or to comply with the law. Wren does not use Google user data to train generalized AI or machine-learning models.

LinkedIn. Wren receives the profile, posting and Page data you authorize, uses it only for the posting and Page-management features you choose, does not build profiles of LinkedIn members, and does not combine LinkedIn data with other sources to identify people.

Meta (Facebook and Instagram), TikTok and others. The same approach: the permissions you approve, used only for the task, published only with your approval.

6. When Enbrite staff access your Wren

Only:

1. when you ask us to, for support, and then only for that request;
2. to keep the Service secure and running (for example restoring a backup after a failure), touching your content only as far as that requires; or
3. when the law requires it. We will tell you unless the law forbids it.

We log such access and will show you the log on request.

7. Sharing and service providers

We do not sell or rent personal data, and we do not “share” it for cross-context behavioral advertising. We disclose it only:

• to the service providers in the table below, bound to use it only to provide their service to us;
• to the services you connect and the AI providers you or your plan use, as described above;
• when the law requires it, to respond to legal process, or to protect the rights, safety and security of Enbrite, our customers or others;
• to a successor if Enbrite is involved in a merger, acquisition or sale of assets, with notice to you; or
• with your consent.

We will update this table when a provider changes.

8. Retention and deletion

• Your Wren’s contents stay until you delete them or delete your account.
• Deleting your account, from the account page, cancels your plan, destroys your Wren’s machine, volume and backups, and removes your email and password from the account record. It cannot be undone.
• If your plan ends without deletion, we keep your Wren for 30 days so you can resubscribe or export, then delete it after notice.
• Payment and invoice records are kept for 7 years for tax and accounting.
• Service records without content are kept for 12 months. Records of which Terms you agreed to are kept for as long as needed to show what was agreed.
• Website logs are kept for up to 30 days.

9. Security

Each Wren has its own machine, network and encrypted volume; customers’ Wrens cannot reach each other. Your Wren’s own keys are created for it and placed only in it. Devices you pair (your phone, your browser) authenticate to your Wren directly, and Enbrite’s account login cannot act inside your Wren. Sign-in to the account page is rate-limited and locks after repeated failures, and new passwords are checked against known data breaches. Every approval of an outside action is confirmed from your own device. No system is perfectly secure; if we learn of a breach affecting your data we will notify you as the law requires.

10. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to restrict or object to its use, to withdraw consent, and to complain to a supervisory authority.

• Your Wren’s contents: you can export or delete them from your Wren directly, and delete everything by deleting your account.
• Account data: write to hello@wrenpilot.com. We will respond within 30 days (45 days where the CCPA applies, extendable once) and may ask you to confirm your identity from your account email.

California residents. We do not sell personal information or share it for cross-context behavioral advertising, and we do not use or disclose sensitive personal information for purposes other than providing the Service. You have the right to know, delete and correct your personal information, to limit use of sensitive personal information, and not to be discriminated against for exercising your rights. You may use an authorized agent. If we deny a request, you may appeal by replying to our decision.

European Economic Area, United Kingdom and Switzerland. Enbrite is the controller of your account data and a processor of the data inside your Wren, which you control. Your data is processed in the United States; we rely on standard contractual clauses or an adequacy decision where required. If you need a data processing agreement, write to us.

People you deal with. If you are not our customer but your data is in a customer’s Wren (for example you emailed one), the customer controls that data. Contact them to exercise your rights; we will help them respond.

11. If you run Wren on your own computer

If you run the Wren software on a computer you control instead of our hosted service, your Wren’s contents stay on that computer, we hold no copy and no keys, and Sections 2 (your Wren’s contents), 6, 7 (Fly.io and backups) and 8 do not apply to it. The AI provider and connected-service sections still apply to what your Wren sends out.

12. Children

Wren is not for anyone under 18, and we do not knowingly collect their data. If you believe a child has given us data, write to us and we will delete it.

13. Changes

We will update the date above when this policy changes, and email account holders at least 30 days before a material change takes effect. Earlier versions are available on request.

14. Contact

Enbrite LLC, 502 W 7th St, Ste 100, Erie, PA 16502, USA. hello@wrenpilot.com.