Privacy Statement

SCHOTZ ENTERPRISES · SPEKT AI · BFI VENTURES & RELATED HOLDINGS

EFFECTIVE JULY 2026 · MASTER STATEMENT COVERING: SPEKTAI.COM · MYSELF.SPEKTAI.COM · APEIRON.SCHOTZENTERPRISES.COM · BOB (WHATSAPP INTAKE)

When you use our services, you trust us with information. This statement explains, in plain language: what we collect, why we collect it, how it is protected, and the controls you have. Our design principle is unusual and worth stating first: the product is your ownership of your own record. We built the architecture so that we hold as little as possible, and what exists is verifiable by you.

Information we collect

What you give us

Feeds to Bob: one image and one caption (≤120 characters) per feed, sent by you over WhatsApp.
Contact: your WhatsApp/phone identity arrives in the message envelope. We do not store the raw number in the public record — it is immediately converted to a salted cryptographic hash (see "How identity works").
Correspondence: emails you send to us.

What we collect automatically

Timestamps and message metadata required to operate the intake (delivery status, media type, country code).
Basic web logs on our sites (pages served, approximate region, device class). We do not run advertising trackers.

How identity works

Your phone identity is transformed as: user_hash = SHA-256(phone ∥ salt). The salted hash is your public identity on the chain. The salt is a server secret; without it, your number cannot be recovered from the hash. Internally, a protected mapping from hash to number exists for one purpose: delivering messages back to you (for example, a raffle result). That mapping is access-controlled and is never published, sold, or shared.

Why we collect it

To operate the service: committing your feeds as blocks, scoring them (CoNov), rendering the public feed, enforcing the per-identity rate limit.
To run promotions you enter: if you feed Bob during a raffle window, your block hash is your entry; we use the hash→number mapping solely to notify winners.
To keep the system honest: filtering content the law requires us to filter, and throttling automated abuse. That is the entire moderation floor.

What is public, permanently

Bob is a public experiment, and honesty about permanence matters more here than in an ordinary app. When you feed Bob, the following becomes part of a public, append-only chain: your image, your caption, your hashed identity, a timestamp, an origin tag, and a score. The chain is designed so that alteration or deletion is detectable. Treat a feed like a public statement: do not send what you would not publish. Do not send images of other people without their consent, and do not send anything you don't have the right to share.

What we do not do

We do not sell your information. To anyone. This is not a qualified sentence.
We do not run third-party advertising or advertising trackers on our properties.
We do not use your feeds to train models for other customers. Your record conditions your outputs and the public Bob instance you knowingly fed.
We do not publish, share, or monetize raw phone numbers.

Sharing

We share information only with: (a) processors necessary to operate the service (messaging transport, hosting), bound to use it solely on our instructions; (b) authorities where the law compels it, in which case we disclose the minimum required; (c) a successor entity if the business is reorganized, bound by this statement. WhatsApp is operated by Meta; your use of WhatsApp is additionally governed by Meta's own terms and privacy policy, which we do not control.

Retention

Chain blocks are retained indefinitely — permanence is the product. Operational logs are retained no longer than needed to run and secure the service. The hash→number mapping is retained while your identity is active and deleted upon verified request, subject to the paragraph below.

Your controls

Access: your chain is public and verifiable by you at any time; that is the point.
Unlink: you may request deletion of the hash→number mapping. After unlinking we can no longer contact you or associate the hash with you; the hashed blocks remain on the chain.
Stop: stop feeding at any time; the rate limit means you were never obligated to continue.
Erasure requests: where law grants you deletion rights over personal data (e.g., GDPR Art. 17), contact us. Be aware of the honest tension: the chain is tamper-evident by design, so removal of a block is itself visible. Where required, we satisfy erasure by deleting vault content and the identity mapping, leaving only an unlinkable commitment. We will state plainly in each case what was removed and what mathematically remains.

Children

Our services are not directed to children under 13 (or the higher age your jurisdiction sets), and we do not knowingly accept their feeds. If you believe a minor has fed Bob, contact us and we will act on it.

Security

Identity is salted and hashed; the chain makes tampering visible rather than merely forbidden; internal access to the identity mapping is restricted and logged. No system is unbreakable and we will not pretend otherwise — but our exposure is deliberately small because we deliberately hold little.

Changes

We will post changes here with a new effective date, and material changes will be announced on our public channels before they take effect. We will not reduce your rights under this statement without your explicit consent.

Contact

Privacy requests: hello@spektai.com · Schotz Enterprises, New York.

This statement is written to be read, in the tradition of the better platform privacy policies: plain sections, plain sentences, no defined-terms maze. It is not legal advice, and before high-volume launch it should be reviewed by counsel — particularly the erasure section, which involves live questions at the intersection of tamper-evident records and data-protection law.