Privacy policy

1. Who we are

Sia is a research project operated under the name Superintelligent Agents. In this policy, “Sia,” “we,” and “us” refer to that project and its authorized operators.

Privacy questions and requests can be sent to privacy@superintelligentagents.ai. Security concerns can be sent to security@superintelligentagents.ai.

2. Your participation choices

Research mode

When you sign in, review the current consent, and join the research release, eligible task activity is uploaded to our encrypted research archive.

Local mode

You may continue locally without signing in. Local-only records are not eligible for later cloud upload. You can also stop new research capture by turning capture off where available or by signing out.

Connected apps

Google and Slack connections are optional, use separate provider consent pages, and can be disconnected independently. Google starts read-only. Editing and sending require a separate permission upgrade.

3. Information we collect

Account and consent information

• Your account email address and the identifiers needed to operate your Sia account.
• The consent version, decision, and timestamp associated with your participation.
• Connection status and provider account identifiers needed to show which optional apps are connected.

Raw task activity in research mode

Except for excluded Google Workspace connector turns described below, Sia records the complete task-visible activity it observes, which may include:

• Exact prompts, replies, and reasoning surfaced in the task.
• Commands and command output.
• Tool names, arguments, results, approvals, errors, and status changes.
• File paths, diffs, workspace activity, and task-visible file content.
• Browser and computer-use events, including captured images visible inside the task surface.
• Schedule creation, changes, runs, and outcomes.

Raw task-visible strings and images can contain private information, confidential material, or secrets. The research archive is not an anonymized dataset.

Operational information

We process timestamps, app and service status, request identifiers, security events, archive integrity information, and metadata needed to operate, debug, and protect the service.

4. Information Sia does not intentionally obtain

Sia is designed not to obtain provider credentials, Chrome cookies, Keychain contents, secure fields, private-window contents, or hidden authentication surfaces. These controls reduce exposure but do not make task-visible content anonymous. If a secret appears inside the task surface, it may be included in raw research data unless that turn is excluded by the Google Workspace rule in Section 6.

5. How we use information

• Conduct research and evaluation about complete agent behavior.
• Operate, debug, secure, and improve the Sia alpha.
• Provide support, exports, deletion, and incident response.
• Maintain immutable metadata-only records of administrator access to the research archive.

Research data is not used for model training under the current alpha policy.

6. Connected services and Google user data

When you connect Google or Slack, the provider shows the requested permissions and asks for your approval. Sia accesses connected-service data only to perform tasks you request or to show connection state. Provider data is read live when a task needs it and is not bulk copied into Sia.

Google Workspace API data is used only for the user-facing feature you request. Gmail, Drive, Docs, Sheets, and Slides connector results are excluded from research uploads, the research archive, and administrator research review. When a task invokes one of those Google Workspace connectors, Sia excludes the entire turn from research capture. The user-facing result can remain in your local Sia transcript until you delete it.

Operational connection metadata, such as whether a Google service was connected or disconnected, may be included in research records without the Google Workspace content. Task-visible content from Slack or another non-Google connected service can still appear in the raw research event stream when research mode is enabled.

Google Workspace connector turns are also excluded from Sia's optional local diagnostic trajectory files. The normal user-facing transcript remains local so you can review the result and delete the thread.

Sia's use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.

OAuth tokens and provider credentials are handled separately from task records and are not included in research or diagnostic trajectories.

7. Service providers and disclosure

We may disclose information only as needed to:

• Amazon Web Services, which hosts the Sia control plane, encrypted research archive, email delivery, and security logs in the United States.
• Composio, which brokers optional connected-app authorization and actions.
• The model or command-line provider you choose to use with Sia, which may process the task content you direct to that provider under its own terms.
• Google, Slack, and other services you choose to connect, for the actions you request.
• Authorized research administrators and support or security personnel who need access for the purposes described above.
• Government authorities or other parties when required by law, or when necessary to protect participants, the public, or the service.

We do not sell personal information.

8. Retention

• Cloud research content: objects expire after 90 days.
• Research access audit metadata: immutable access metadata is retained for 365 days and expires after 400 days.
• Local records: local records roll off after 90 days or earlier when the encrypted local research store reaches 128 MB or 500 batches. Pending eligible uploads are not silently discarded only because capture is turned off or the user signs out.
• Account and operational records: retained while needed to provide the alpha, meet security and legal obligations, resolve disputes, and complete export or deletion workflows.

9. Security and administrator access

Cloud research objects are encrypted using customer-managed AWS keys. Research archive access is limited to authorized administrators, requires multi-factor authentication, and writes immutable metadata-only audit records. We use additional access controls, bounded interfaces, integrity checks, queue monitoring, and alarms.

No security system can eliminate all risk. Research participants should use only material they are comfortable sharing under this policy.

10. Export, deletion, and withdrawal

The Sia app provides controls to export local and cloud research records and to request either research-only deletion or full account deletion.

• Research-only deletion removes research content and related research records under your Sia identity.
• Account deletion also revokes Sia-managed connections and deletes the Sia identity after the deletion workflow completes.
• Deleting your Sia account does not delete source data held by Google, Slack, your workspace, your model provider, or unrelated macOS services.
• Immutable audit metadata may remain until its stated retention period expires.

To request help with an export or deletion, email privacy@superintelligentagents.ai from the address associated with your account.

11. Children and participant eligibility

The research alpha is intended only for adults age 18 or older. It is not directed to children. Organizations may impose additional rules on who may authorize connected services.

12. International processing

Sia's cloud systems currently operate in the United States. If you participate from another country, your information may be transferred to and processed in the United States.

13. Changes to this policy

We may update this policy as the alpha changes. If a change materially affects research collection or use, Sia will present an updated consent version before new eligible research uploads continue.

14. Contact