This policy explains Greywell's privacy practices in plain language. Greywell does not sell personal information and does not use programme records for advertising.
Last updated: September 18, 2026.
1. Information Collected
Greywell may collect information submitted during intake, Term Route Assessment, waitlist registration, Greywell App use, Telegram bot use where selected or directed, partner consent, dashboard administration, checklist review, DNS declarations, document generation, fee status checks, requests, appeals, infractions, suspensions, exits, archives, and support contact.
- Contact and routing details, including email address, selected contact route, app access identifiers, and Telegram username where applicable.
- Intake answers about schedule, premises, routines, constraints, living situation, preferences, and selected programme options.
- Messages and reports sent through the Greywell App or approved contact route, including musters, movement notices, requests, appeals, welfare reports, and checklist submissions.
- Evidence submitted for the checklist, inspection orders and assignments, which may include photographs, video, files and, where an assignment asks for them, audio recordings.
- Live view, if you turn it on: when you gave or withdrew consent, and each time the Governor looked — when it was requested, when it started and stopped, and why it stopped. The picture itself is never recorded, and there is no playback.
- App session, device notice, admission token, document key, offline submission queue, and sync status needed to operate app access.
- Partner nomination, consent, role, access status, partner-route messages, and revocation records where partner involvement is selected.
- Fee status, Stripe checkout/session identifiers, payment status, and recovery logs. Greywell does not store full card numbers.
- Limited first-party usage events, such as page visits, button clicks, form progress, and submission outcomes.
- Operational logs, including dashboard actions, bot routing events, webhook errors, and access checks.
Health information. A few intake answers concern your health: any injury or medical limit that makes exercise unsafe, and the movements it affects; allergies and intolerances; whether you take prescribed medicine — yes or no, never what or why; and the subjects you ask not to be given to read. Greywell asks for these for one reason: so that nothing the programme gives you is unsafe for you. They are treated as especially sensitive.
The Governor sees them at admission and during your Term. Your restrictions and allergies also appear in the documents made for you — your training programme and your menu. They, and the subjects you ask not to be given to read, are given to your House Officer, so that it never assigns a movement, a food or a book you have ruled out; it is also shown your other reading answers, so that it can choose your books. Your House Officer runs on an AI model provided by Anthropic (section 3), so those answers are processed by Anthropic for that purpose, and every book proposed for your reading plan is checked by that model against the subjects you asked to avoid. Your answer about medicine is seen only by the Governor: it is never restricted, never judged, and never raised again. The Governor may tell your House Officer that cannabis is permitted for you, without saying why.
Health information is never sold, never used for marketing, and never disclosed outside Greywell except as sections 4 and 9 describe. It is deleted 6 months after your Term ends, or sooner at your request (sections 6 and 7). You can answer "None" to allergies and to the reading question, and you never need to give a reason for a subject you ask to avoid.
2. How Information Is Used
Information is used to review intake, administer Terms, route app or approved contact-route access, generate documents, confirm readiness, maintain records, process partner involvement, review requests and appeals, support safety boundaries, prevent unauthorized access, and operate the service.
Greywell records limited first-party usage events such as page visits, button clicks, form progress, and submission outcomes to maintain and improve the application process.
Greywell does not use programme records to sell advertising or market unrelated services.
3. Services Used
Greywell relies on third-party services to operate:
- Cloudflare for hosting, Workers, database storage, access control, DNS, and operational security.
- Telegram for participant, House Officer, Governor, and partner bot communication where selected or directed.
- Stripe for fee checkout, fee status, and payment receipts.
- Google Workspace for support email and administrative communication.
- Anthropic, whose AI model runs the House Officer and the automated review of submitted evidence, weekly reports, letters and the books proposed for a reading plan. It receives the parts of your record each of those tasks needs.
Those services process information according to their own terms and privacy practices as well as Greywell's configuration.
4. Access and Disclosure
Programme records are intended for Greywell administration. Governor/dashboard access is restricted. Partner access, when approved, is limited by role and does not include unrelated intake disclosures, fee information, private Governor notes, or general account access.
Greywell may disclose information if required by law, to protect service security, to prevent abuse, or where necessary to address an urgent safety concern.
5. App Access, Device Notices, and Offline Queue
The Greywell App may store a paired session, limited app state, queued submissions, and recent display records on the device so the app can load, submit evidence, and retry submissions if connectivity fails. Queued submissions remain on the device until sent, cleared, or app storage is removed.
If device notices are enabled, Greywell stores the information needed to send operational notices to that device. Device notices may be disabled in the app or through device settings.
6. Retention
Greywell keeps records for operational continuity, audit trail, payment reconciliation, safety boundary review, and improving the programme. When a Term ends, the programme stops, but your record does not. Your documents stay readable to you through the links you were sent.
Raw first-party usage events are retained for up to 90 days.
Inspection and checklist photographs. Photographs you send to answer an inspection or to complete a pre-Term checklist item are deleted six months after your Term ends. The record that you sent one, and what was decided about it, is kept; the photograph itself is not. Photographs taken from your phone are stripped of location data as they arrive, so Greywell never holds where they were taken.
Health answers. Your health answers, what you told us about alcohol and other substances, and any religious food rules are deleted 6 months after your Term ends. Your documents stay readable, and say so.
Refused applications. When the Governor declines an application, the application is deleted. If the Governor also bars the applicant, Greywell keeps a scrambled form of the email address or Telegram account that application used, together with the date and the reason, for two years, and then deletes it. The scrambled form cannot be turned back into an address. It is used only to recognise the same address or account if it applies again. None of the application's answers are kept.
Greywell takes routine backups of its database so the service can be restored after a failure. When records are deleted at your request, they are removed from the live service once the request is carried out, which is within 30 days of receiving it. Copies may then remain in those backups for up to 30 days, after which the backups expire automatically. Backups are used only to recover the service, never to restore records that were deleted at your request.
7. Your Choices
- You may withdraw from participation.
- You may request app account closure or session revocation.
- You may ask for partner access to be revoked.
- You may contact Greywell or use the in-app Account & Rights form to ask about records, access, correction, deletion, or a copy of app-visible records.
- Requests for access, correction, deletion, or a copy of app-visible records made through this form are reviewed within 30 days of submission.
- A deletion keeps only 2 things: your payment records, for tax, and a log of any safety alarm, without your words, for 3 years.
8. Security
Greywell uses Cloudflare Access, Governor sign-on requiring a password and a time-based authenticator code, Telegram webhook secrets, tokenized document links, app session checks, route-level authorization, and operational logs to reduce unauthorized access. No online service can guarantee perfect security.
Participants and partners are responsible for the security of their own devices, email accounts, app sessions, and Telegram accounts where applicable.
9. Safety and Welfare Reports
The app includes an official welfare/safety reporting surface. These reports are recorded for Governor review and are not treated as casual chat. Greywell is not an emergency service; if there is immediate danger, contact local emergency services or an appropriate professional service first.
Crisis language. What you write is checked automatically for words that suggest you may be in danger, so the Governor can be told.
Your conversations. Your conversations with your House Officer are not read by anyone as a matter of course. They are checked automatically for crisis language. The Governor opens them only for your safety, to decide an appeal or dispute, or when you ask, and your app shows every time the Governor did. A safety alert shows the Governor the words that raised it, and your app lists those too. Your House Officer's weekly assessment, which the Governor reads, draws on them.
If you need to speak to someone now. These services are free, confidential, available at any hour, and have no connection to Greywell — nothing you say to them reaches us, your Governor, or your partner.
- UK and Ireland — Samaritans, 116 123. You do not have to be suicidal to call.
- US and Canada — Suicide & Crisis Lifeline, 988. Call or text.
- Anywhere else — findahelpline.com lists free, confidential lines by country.
In an emergency, contact local emergency services — 999 in the UK, 911 in the US.
10. No Children
Greywell is for adults only. It is not intended for anyone under 18 years of age.
11. Contact
Privacy questions, record requests, withdrawal requests, account closure requests, or safety/privacy concerns may be sent to support@greywellinstitute.com.