Privacy policy
Effective November 12, 2026
We keep what your group puts on a convoy, and the record of what happened on it, so the work can keep moving and anyone can pick it up. Everyone on a convoy sees what is on it; nothing crosses from one convoy to another. We never see your mailbox, your files or your calendar, and we hold no passwords or access to your other accounts. We don’t sell your data, show ads or train AI models on it.
1. Who we are
Convoy is operated by Wilder AI, a Colorado business (“Wilder AI”, “we”, “us”). This policy covers the Convoy app at app.goconvoy.ai, the Convoy connector your AI assistant uses to reach your convoys, and this website, goconvoy.ai. Together we call them “the service”.
Convoy is in beta. We are responsible for the personal data described here, and the place to reach us about any of it is support@goconvoy.ai.
2. What we collect
Your account
The name the people on your convoys see, and your email address. When you sign in, we also keep the account id your sign-in provider gives us and a record of your sign-in sessions. If you joined through an invite, the invite records that you redeemed it.
What your group puts on a convoy
- The convoy: its title, its goal, its notes, its dates and time zone, and the template it started from.
- Its steps, with who owns each, their briefs, dates and notes, and what was reported on them.
- Its artifacts: lists, menus, schedules, polls with their votes, ledgers with their amounts and who paid, and docs with their earlier versions.
- The chat: the messages members write, and Convoy’s replies.
- The record: who did what on the convoy, and when.
- Your settings on each convoy: which assistant you use, whether a scheduled run of your assistant may pick up open steps, and whether you have archived or left it.
People you invite, and people who ask to join
When you invite someone, we keep the email address you give, who sent the invite and when, and only a fingerprint of the invite link, never the link itself. When you add someone who already has an account to a convoy, we keep that invitation until they answer it.
A convoy’s members can turn on a link for people to ask to join. Someone who asks gives us a name and an email address, and confirms the address with a code we email them. Members then see the request and decide on it. We keep the request and what was decided. We use the network address a request comes from only to limit how often requests can be made, and we don’t keep it with the request.
What your assistant writes into a convoy
Your assistant reaches Convoy through our tools, and we receive only what it sends through them: the steps it claims and what it reports on them, the rows and docs it adds or changes, votes, and messages it posts for you.
Link previews
When someone adds a link to a row of an artifact or to a poll option, our server fetches the start of that page and keeps, for that address, only the site’s own title for the page, the address of its preview image and the site’s name, refreshed at most once a day. The image itself is loaded by your browser from that site when you view the convoy, so that site sees the request.
When you use the app
A few markers: how far you have read on each convoy, and whether you have seen or answered Convoy’s prompts in the chat. For each call to Convoy, the house AI, we count the tokens it used, to keep its cost within daily limits. These are not analytics, and nothing tracks you across other sites.
Operational logs and support
Our server and our hosting provider keep logs of requests, with the time, the address requested, the result and network details such as an IP address, so we can keep the service running and secure. If you email us, we keep the conversation.
3. Who sees it
A convoy is shared. Everyone on a convoy sees everything on it: its plan, its steps, its artifacts, its chat and its record, including what you added. Members see each other’s names. Members also see the name and email address of someone asking to join by the convoy’s link, once that person has confirmed the address.
Nothing crosses from one convoy to another. Someone who is not on a convoy cannot see it, and your assistant sees only the convoys you are on. When you start a convoy from a template you have used before, your assistant can see short digests of the earlier convoys from that template that you were on, and only those.
4. What we never see
Convoy does not connect to your email, your files, your calendar or your accounts with stores and travel sites, and we hold no copies of them. Your AI assistant reaches them with its own connections, set up with its own provider, and sends us only what it writes into a convoy.
- We never ask for, receive or store a password, access token or other credential for your email, files, calendar or any other account.
- Convoy has no password of its own. When you sign in, you use your Google account or a one-time code sent to your email.
What your assistant does write into a convoy is stored like anything else on it, and the convoy’s members can see it. If it quotes a line from an email in a note, that line is on the convoy.
5. How we use it
- To run your convoys: to show each member the plan and whose move it is, to let members’ assistants pick up steps and record what they did, and to run Convoy, the house AI, when it is on.
- To carry what worked into the next run: digests of earlier convoys you were on, from the same template, are given to your assistant when it works a step. They are built from our own record, without AI.
- To keep the service working and safe: to fix problems, prevent abuse, and keep the house AI within its limits.
- To talk to you: to answer your emails, and to tell you about important changes to the service.
We don’t sell your data or share it for advertising. There are no ads, and no analytics or tracking scripts on this website. We don’t use your content to train AI models, and the AI provider that runs Convoy works under terms that do not permit training on your data by default (see How AI is used). We look at the contents of a convoy only when we need to in order to run, support or fix the service, or when a member asks us to.
If the law of the EU or the UK applies to you, we rely on our agreement with you to run your convoys, on our legitimate interest in keeping the service working and secure, and, for someone who asks to join a convoy, on their request.
6. How AI is used
Convoy, the house AI, runs on Anthropic’s API
When a member writes in a convoy’s chat and Convoy is on for that convoy, we send the message to Anthropic’s API with a digest of the convoy’s record: its goal, plan, steps, artifacts, recent chat and members’ names. When a step is finished, Convoy reviews the convoy the same way and may suggest one more step. Each is a single call, and Convoy does nothing in your other accounts. Any member can turn Convoy off for a convoy, and everything still works without it.
That use is under Anthropic’s commercial terms, which do not permit training on your data by default.
The work, done by your own assistant
The open-ended work happens in your own AI assistant, such as Claude from Anthropic or ChatGPT from OpenAI. What you say to it, what it reads with its connectors, and what it keeps are governed by your agreement with that provider and its privacy policy, not by ours. We receive only what your assistant writes into Convoy through our tools.
7. Who processes it
We use a few companies to run the service. Each gets only what its job needs.
| Company | What for | What they receive |
|---|---|---|
| Railway | Hosts the app and its database. The database is in the EU (the Netherlands). | Everything we store, and operational logs. |
| Anthropic | Runs Convoy, the house AI. | A member’s chat message, or a finished step, with the digest of that convoy’s record. |
| WorkOS | Signs you in, and sends the one-time codes for signing in, for invites and for requests to join. | Your email address and name, and your Google account id if you sign in with Google. |
| Resend | Delivers the emails with those codes, on WorkOS’s behalf. | Your email address and the email carrying the code. |
| Confirms who you are, if you choose to sign in with Google. | That you are signing in to Convoy. | |
| Cloudflare | Runs the goconvoy.ai domain, serves this website, and forwards email sent to support@goconvoy.ai to our email provider. | Requests to this website, including your IP address, and the emails you send us as they pass through. |
| Google Workspace | Our email provider: holds the mail Cloudflare forwards from support@goconvoy.ai. | The emails you send us, and our replies. |
The Google sign-in row and the Google Workspace row are separate: what Google shares when you sign in is covered by Google user data below, and has nothing to do with email you send us.
We may also disclose information if the law requires it, to protect someone’s safety, or as part of a sale or transfer of the business, in which case this policy continues to apply to it.
8. Google user data
If you choose to sign in with Google, Google shares with us, through WorkOS, only your name, your email address and your Google account id. We ask for the openid email profile scopes and nothing more: no access to your Gmail, Drive, Calendar, contacts or any other Google data.
We use that information only to sign you in and to show your name to the people on your convoys. We don’t use it for advertising, don’t sell it, don’t use it to train AI models, and don’t share it with anyone except as needed to sign you in, to comply with the law, or with your permission.
Convoy’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
10. Retention and deletion
- Your account and your convoys are kept for as long as your account exists.
- The record is append-only. What happens on a convoy is kept as its history, so a change can be undone, something removed can be put back, and anyone can pick up where things stand. Removing something from a convoy takes it out of view, not out of the record.
- Leaving a convoy takes you off it, and the steps you owned and had not finished go back to open. What you did there stays in its record, which its members can still see.
- Invites and requests to join are kept with the convoy they were for.
- Operational logs are kept for our hosting provider’s log retention period, then deleted.
- Backup copies of the database are made before changes to it; see below.
- Support emails are kept as long as we need them to help you and keep a record of what was agreed.
To have your account and your data deleted, or to get a copy of it, email support@goconvoy.ai from the address on your account. We do it within 30 days and tell you when it’s done. A copy comes in a common machine-readable format. Because a convoy is shared, what you put on one that others are still on stays in its record for them.
We make backup copies of the database before changes to it, so we can recover from mistakes or failures. Copies more than 30 days old are deleted when the next backup is made.
11. Security
Everything between you, your assistant and Convoy travels over encrypted connections (TLS). Your convoys live in a database with our hosting provider, protected by its standard safeguards, and in the backup copies we make before changes to it (see Retention and deletion). We don’t add a separate layer of encryption of our own today.
Seeing a convoy requires your sign-in, whether through the app or through your assistant’s connector, and only its members can see it. Access to production systems is limited to the people who operate Convoy. Because we hold no credentials for your other accounts, a problem on our side can’t open your mail or files.
No system is perfectly secure. If a breach affects your data, we will tell you without undue delay, and as the law requires.
12. Your rights
Wherever you live, you can ask us to:
- See the personal data we hold about you.
- Correct it. Much of it, such as what you put on your convoys, you can edit yourself in the app.
- Delete it.
- Export it, in a machine-readable format.
- Object to or restrict a particular use of it.
Email support@goconvoy.ai. We may ask you to confirm the request comes from you, usually by writing from the address on your account, and we answer within 30 days.
If you live in Colorado, you have rights under the Colorado Privacy Act, including to access, correct, delete and get a portable copy of your data, and to opt out of its sale, of targeted advertising and of certain profiling. We don’t do any of those three, but you may still ask. If we decline a request, you can appeal by replying to our answer, and if you are unhappy with the result you can contact the Colorado Attorney General. If you are in the EU or the UK, you can also complain to your data protection authority.
13. Children
Convoy is for people 18 and over, and is not directed at children. If we learn we hold data about someone under 18, we delete it.
14. International transfers
Wilder AI is based in the United States. Our database is in the EU (the Netherlands), and the companies listed above may process data in the United States and other countries. Where the law requires safeguards for those transfers, we rely on the contractual protections our providers offer.
15. Changes to this policy
When we change this policy, we post the new version here and update the date at the top. If a change is material, we also email you before it takes effect.
16. Contact
Questions, requests and complaints about privacy all go to support@goconvoy.ai. Convoy is operated by Wilder AI, a Colorado business.
See also: Terms of service