How we handle your data.

Incarnate is a voice-based rehearsal product for high-stakes conversations. You bring in the people you actually need to talk to, and we help you practice the conversation, out loud, against an AI character that remembers what worked last time.

Because the product is voice-first and memory-first, we do collect personal data: the audio of your rehearsal, the transcript, what you tell us about the person you're practicing for, and your basic account info. This page explains exactly what we collect, where it lives, who can see it, and what you can do about it.

We do not sell your data. We do not use it to train external AI models. We do not show ads against it. If that ever changes, we will update this page and notify you before the change takes effect.

This is the single privacy policy for everything Incarnate Labs operates. It applies in full to:

• The Incarnate web application (the place where you actually rehearse conversations, manage personas, and review feedback) at incarnatelabs.com.
• The Incarnate marketing site at incarnatelabs.com (including any waitlist, contact, or signup forms hosted there).
• The Incarnate Chrome extension distributed through the Chrome Web Store (extension ID kibgecckcoonbeombpopcfdlhenflcdk), which is one of several entry points into the same product.

When we say "Incarnate," "the product," "we," or "us," we mean Incarnate Labs, the company operating all of the above. Most of the data the product handles is collected through the web application; the extension itself only touches a narrow slice (described under "What we collect" below).

We only collect what we need to make the rehearsal work and to improve it. Concretely:

• Account information

  Your name, email address, and the authentication provider you signed in with (e.g., Google). If you upload a profile photo, we store the image URL.

• Rehearsal audio and transcripts

  When you rehearse a conversation, we capture your microphone audio in real time, transcribe it to text, and store the transcript. Audio is streamed to our speech provider for transcription and to the AI character so it can respond. We retain the text transcript for your review screen and feedback.

• Persona and scenario data

  What you tell us about the person you're rehearsing for (their relationship to you, traits, communication style, what triggers them) plus any scenario you describe (the situation, the goal, what's at stake). This is the core memory the product is built around.

• Session feedback and scores

  The AI-generated debrief from each session: numeric scores, written feedback, the "great lines" you said, and the observations the system inferred about you and the persona.

• Chrome extension data

  The Incarnate Chrome extension only runs on Reddit r/AmItheAsshole comment pages. When you click the rehearsal prompt under a post, the extension sends the post's title and body to our backend so we can generate a scenario from it. The extension also stores, locally in your browser, which posts you have already viewed or rehearsed (via chrome.storage) so the prompt does not re-prompt you for the same post. The extension does not read pages outside r/AmItheAsshole, does not track your browsing history, and does not access cookies or credentials from other sites.

• Product analytics and diagnostics

  Anonymised event data about how the product is used: pages visited, features tapped, which prompt copy was shown, error counts. We use this to figure out what is working and to debug crashes. Analytics events are sent to our analytics provider (PostHog).

• Device and connection metadata

  Standard server log fields: IP address, browser user-agent, and timestamps. Used for security, abuse prevention, and rate limiting. We do not collect precise location (GPS coordinates).

We do not collect health data, financial or payment card data, personal communications (emails, texts, chats from outside the product), your general web browsing history, or sensitive identifiers like government IDs.

We use the data we collect to:

• Run the rehearsal itself: turn your voice into text, generate the AI character's response, speak the response back to you, and produce the post-session debrief.
• Maintain the persistent memory the product depends on: remember what you told us about a persona last week so the rehearsal next week feels coherent.
• Show you your own history: past sessions, scores, transcripts, saved "great lines."
• Operate the Chrome extension (detect AITA posts, generate a scenario from the post you chose, open it in your Incarnate account).
• Keep the service running and safe: rate-limiting abusive patterns, debugging crashes, and protecting accounts from misuse.
• Improve the product in aggregate: understanding which prompts work, which features are used, which flows break.

We do not use your sessions, transcripts, persona notes, or feedback to train third-party AI models. Our LLM and voice providers are configured under data processing terms that prohibit using submitted data for training their own models. We also do not use your data to determine creditworthiness or for lending purposes, and we do not share or transfer your data for purposes unrelated to the rehearsal product.

Your account, persona records, session transcripts, and feedback are stored in an encrypted PostgreSQL database hosted on Amazon Web Services (AWS RDS) in the United States. Short-lived job state (e.g., a pending feedback computation) lives in a managed Redis queue. Backups are encrypted at rest and retained on a rolling schedule.

Connections between the Incarnate web app, our backend, and our database use TLS in transit. Access to production data is restricted to a small set of Incarnate engineers under role-based access control.

The Chrome extension itself stores only a small amount of state locally in your browser via the standard chrome.storageAPI: specifically, which AITA posts the prompt has already been shown for and the configured Incarnate app URL. That local state never leaves your browser unless you click the extension's call-to-action, which then sends the post title and body to our backend over HTTPS.

We rely on a small set of vendors ("sub-processors") to actually run the product. Each one only sees the slice of data they need, and each is bound by a data processing agreement that prohibits using your data for their own purposes:

Beyond these sub-processors, we share personal data only when (a) you ask us to (for example, exporting your transcript), (b) we are legally required to (for example, a valid subpoena or court order), or (c) we have to in order to protect the safety of users or the integrity of the service. We do not sell personal data to anyone, and we do not transfer it to third parties for advertising, credit-scoring, or lending purposes.

Incarnate offers an optional Google Calendar integration so you can add your scheduled rehearsals to your own calendar. It is strictly opt-in: nothing touches your Google Calendar unless you connect your Google account and choose "Add to my Google Calendar" on a session. If you never connect Google, this section does not apply to you.

When you opt in, we request a single, narrow Google permission, the .../auth/calendar.events scope, and use it only to manage the calendar events Incarnate itself creates for your scheduled rehearsals:

• create a calendar event when you schedule a rehearsal,
• update that event if you reschedule or edit the rehearsal in Incarnate, and
• delete that event if you cancel the rehearsal.

We only ever read, modify, or delete events that Incarnate created on your behalf. We do not read, list, or change any of your other calendar events, and we do not access your calendar's sharing or access settings, which is why we request the narrower calendar.eventsscope rather than full calendar access. The Google access token is held by our authentication provider (Clerk) and used server-side only to call the Google Calendar API for the actions above. You can disconnect the integration at any time from your account settings, or revoke Incarnate's access directly from your Google Account permissions.

Incarnate's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not transfer or sell Google Calendar data, do not use it for advertising, do not use it to train AI or machine-learning models, and do not allow humans to read it except with your explicit consent, for security or debugging, or as required by law.

Account, persona, and session data are retained for as long as your account is active. If you delete your account, we delete your persona records, session transcripts, feedback, and associated observations within 30 days, except where we are required to retain something for a legitimate legal or accounting purpose.

Persona observations (the small memory snippets the system writes after each session) soft-decay automatically over a 60–90 day window if they are not reinforced by a new session, so the AI's memory stays current rather than accumulating stale notes.

Server logs (IP addresses, request metadata) are retained for up to 90 days for security and debugging, then rotated out.

You have the right to:

• Access the personal data we hold about you, including your personas, transcripts, and feedback.
• Correct inaccurate personal data.
• Delete your account and all associated data through your account settings, or by emailing us at the address below.
• Export your sessions and transcripts via the in-app data-controls page.
• Object to or restrict certain uses of your data, for example opting out of product analytics from your settings.
• Lodge a complaint with your local data protection authority if you believe we have mishandled your data.

To exercise any of these rights, email support@incarnatelabs.com. We respond within 30 days. If you are in the EEA or UK, you can also contact us through that address to assert your rights under GDPR / UK GDPR.

We use a small number of cookies and local-storage keys for the things they are actually needed for:

• Authentication. Session cookies set by Clerk so you stay signed in.
• Preferences. Small local-storage values (e.g., your selected theme, last-visited tab) so the app opens where you left off.
• Analytics. A PostHog distinct-id cookie that lets us measure aggregate product usage. You can opt out from your account settings.

We do not use advertising cookies, cross-site trackers, or third-party marketing pixels.

Incarnate is not directed at children under 13 (or under 16 in the EEA / UK). We do not knowingly collect personal data from children. If you believe a child has provided personal data to us, please contact support@incarnatelabs.com and we will delete it.

Incarnate is operated from the United States and our primary infrastructure lives in the US. If you use Incarnate from outside the US, your data will be transferred to and stored in the US. Where required, we rely on the European Commission's Standard Contractual Clauses (and equivalent UK transfer mechanisms) to legitimise these transfers.

If we change this policy in a material way (for example, adding a new category of data, a new sub-processor, or a new purpose), we will update the "Last updated" date at the top of this page and notify you in the product before the change takes effect. Continued use of Incarnate after a change means you accept the updated policy.

Questions, concerns, data requests, or anything else, write to support@incarnatelabs.com and a real person on our team will get back to you.

Incarnate Labs, the team behind the practice ground for high-stakes human presence.