Privacy policy.
What Raphael keeps, where, who else receives it, and your choices.
In effect from November 3, 2026.
Who we are
Raphael is made by Zhich Labs, the business of Zhi Cheng Ma. This policy says what Raphael keeps about you, where it keeps it, who else receives it, and what you can do about it.
It covers the Raphael apps for your computer and your iPhone, the browser extension, your Raphael hub, your account at account.zhichlabs.com, and this website.
Person responsible for privacy
Under Quebec’s Act respecting the protection of personal information in the private sector, Zhich Labs names a person responsible for the protection of personal information:
Zhi Cheng Ma, Founder
zhichlabs@gmail.com
Write to them to ask what we keep about you, to correct or delete it, or with any question about this policy.
Where your information lives
Most of what Raphael keeps is in your hub: one database for one person. On the Free plan the hub runs on your own Mac, and we never receive what is in it. On Essentials or Complete it runs on our servers, in a container of its own, and your devices reach it over an encrypted connection.
Each of your devices keeps a copy of what it needs to work offline. Your account holds only what it needs to sign you in and find your hub. What is in your hub never passes through the account.
What Raphael keeps
Your account
Your email address, how you sign in (Apple, Google or a code sent by email), your plan and its status, the address of your hub, and a random analytics id, described under Counting.
Your calendar
When you connect Google Calendar, your hub keeps a copy of your events, with their titles, times, descriptions, places and guests, so Raphael can plan with you and keep working offline. When an event is deleted, the copy keeps a record that it was.
Your conversations
What you and Raphael’s agents say, the steps they take, the tools they use, and the files you attach. A password or key that shows up in a conversation is masked before it is kept.
Your plans and your days
Your tasks, the blocks you plan, and what really happened in each block: on task, resting or distracted, with a short label such as an app’s name or a phrase you said.
Your screen during a block
Which app is in front, your open windows and your browser’s tabs, so Raphael can tell whether you are on task. It reads window titles only if you give it Screen Recording permission, uses them to decide, and does not keep them in your hub. For a website it keeps only the domain, never the full address. The minutes spent in each app and on each site in a block are kept in detail for 35 days, which you can change in Settings.
Screenshots
When you send one, with Control-Option-Space or the iPhone’s Action button, it goes to your AI provider with your message and is kept with that conversation’s files. When you ask an agent to do something on your Mac, it looks at the screen it works on, and what it sees, such as a screenshot or the text of a page it opened, is kept with that conversation. Raphael takes no screenshots to watch you.
Your voice
When you hold the key to talk, your Mac turns your voice into text itself, and the text becomes your message.
Your phone
During a block the iPhone app shields the apps you chose with Screen Time. It asks for location only to read the name of the Wi-Fi network it is on, so it can tell when you are home, and it forgets this when you disconnect the phone. A crash report from the phone goes to your own hub.
Your devices
Each device’s name, its app version, and the token Apple uses to send it notifications.
What Raphael never keeps
Outside what an agent does when you ask it to, Raphael never keeps what you type, what is on a page or a page’s full address. It never keeps a password or key in plain text. Tests in Raphael’s code check that none of these reach storage.
How we use it
To run Raphael for you: to plan with you, start and protect your blocks, look back on your day, sign you in, keep your devices in step, and fix a problem you report.
We don’t sell your information, show you ads, or use it to train AI models. Raphael has no advertising trackers. We count a few steps, from a first visit to a working Raphael, as Counting says.
Google user data
Raphael asks Google for access to see and change your calendars, and for your email address. It uses them only to plan with you, as you see in the app.
Raphael’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Your Google data goes to your AI provider only to answer you. We don’t sell it, use it for ads, or use it to develop or train AI models, and no person at Zhich Labs reads it unless you ask us to, to keep Raphael secure, or when the law requires it.
How long we keep it
- Conversations, tasks, planned blocks and what happened in them: until you delete them or your account.
- The raw record of what changed in your hub: 90 days. After that, only its summaries are kept, such as time per app and per site.
- Minutes per app and per site in each block, in detail: 35 days, or what you set.
- Files attached to conversations: 30 days.
- How much each agent turn used: one year.
- Backups of a Cloud hub: the last 24 hourly copies and the last 14 daily copies.
- When a paid plan ends: the hub’s server is deleted, and one last copy of its data is kept in Cloudflare storage, so starting a paid plan again brings it back. That copy is deleted when you close your account, or sooner if you ask.
- Your account: until you close it.
- A waitlist email address: until you join or ask us to remove it.
Your choices and rights
You can ask to see what we keep about you, to correct it, to delete it, or to get a copy in a format another service can read. You can withdraw your consent at any time. Write to the person responsible for privacy, and we answer within 30 days.
In the app you can disconnect Google, which deletes Raphael’s sign-in to your calendar, and remove a device. If you are not satisfied with our answer, you can complain to the Commission d’accès à l’information du Québec.
Security
Every connection between your devices and a hub is encrypted. A device’s key is stored only as a hash. Secrets, such as your calendar sign-in, are kept encrypted: in the Keychain on your Mac, and with a key of their own on our servers. Each Cloud hub is kept apart from every other.
Raphael’s agents ask you before they send a message, buy anything, sign in anywhere or delete anything. If a breach of your information risks serious harm, we tell you and the Commission d’accès à l’information.
Children
Raphael is not for children under 14. Someone under 14 can use it only with a parent’s or guardian’s consent.
Counting
To see how people find Raphael and get it working, we count a few steps with PostHog, an analytics service, in its European Union cloud. The counts go to PostHog through our own address, e.zhichlabs.com. Nothing records your screen or replays your visit, and we never send PostHog your email address, your name, an invite code or a payment detail.
On this website
Each page you open, the links and buttons you click, that the landing page was opened, and that a waitlist form was sent, without the address you typed. The website sets no cookies and stores nothing in your browser to do this. PostHog tells visits apart by a code it makes on its servers from your IP address, your browser’s name and version, and our domain, mixed with a random value it replaces and deletes every day. So the same visitor counts as someone new each day, and PostHog does not keep your IP address with the counts.
In your account
Opening an invite and starting to sign up are counted the same way, without cookies. When you sign up, your account gets a random analytics id, made only for counting and not derived from your email. Under that id your account counts that you signed up, the plan you chose (and for Essentials, whether at the founding or the standard price), that you went to checkout, that a payment went through, each download of the app with the computer it is for and its version, and whether setting up your hub failed, with the step, or finished. At sign-up, the visits counted that same day from the same browser and network join your analytics id. Visits on other days, or from another browser or network, stay apart.
In the app
Your hub has an analytics id of its own. When your hub tells your account its id, your account links the two, so your hub’s counts join your account’s under the same person.
Your hub sends PostHog counts and choices: for example, that a block started and what type it was, how it ended, how many minutes it was planned for and how many it ran, how a drift notice was answered, which model ran a turn and how many tokens it used, which setup steps were skipped, which version you run, and the 1 to 5 rating you give a day in Wind-down. They never include what you write or say, what is on your screen, window or page titles, web addresses, app or site names, calendar, task or goal names, or file names. The only text sent is a note you write and send with Send feedback. If you choose to attach recent logs, they stay on your hub and are not sent to PostHog. Events are sent only from your hub, never from the app’s windows, and PostHog is told not to look up a location from the connection. You can turn this off at any time under Settings, General, Your data, Share usage data. Sending stops at once, and anything not yet sent is deleted.
Your choice
To object to this counting, or to have the counts under your analytics id deleted, write to zhichlabs@gmail.com. PostHog keeps the counts for one year, then deletes them. We use them only to improve Raphael, and we never sell them or use them for advertising.
This website
This website sets no cookies and stores nothing in your browser. It counts visits as Counting says. The waitlist form sends us the email address you type. The Download and Release notes pages read the latest version from downloads.zhichlabs.com, and a download asks you to sign in to your account first. Cloudflare, which serves the site, sees your IP address, as any web host does.
Changes
When this policy changes, we post the new version here with its date. Before a change that affects what we keep or share takes effect, we tell you in the app.