Privacy & data

What data Lodgey processes

When you use Lodgey, the following data is processed:

Data type	How it’s used
Chat messages	Sent to Anthropic’s API for agent reasoning. Not stored by Anthropic beyond the session.
Uploaded documents	Stored in your project’s database. Content is extracted and filed as evidence.
Evidence items	Structured tax facts stored in the project database. Drive the Live Report.
Tax situation	Structured data (properties, employers, income, deductions) stored per-project.
Gmail access	Read-only search via OAuth. Lodgey searches for documents — it cannot send, delete, or modify emails.
API key	Encrypted at rest using AES-256. Never logged, never sent anywhere except Anthropic’s API endpoint.

Where data is stored

Component	Location
Database	Neon Postgres (serverless) — hosted in AWS, data encrypted at rest
File uploads	Stored in the project database as binary data
Chat history	Managed by Anthropic’s Managed Agents platform during active sessions. Not persisted by Anthropic after the session ends.
Workbook state	Stored in the project database as structured JSON

Session isolation

Each agent session runs in its own isolated container on Anthropic’s infrastructure. Sessions cannot access each other’s data, filesystem, or memory. When a session ends, the container is destroyed.

Within your Lodgey account, projects are strictly isolated — the agent operating in one project has zero access to data in another project.

Data retention

Data	Retention
Projects, documents, evidence, workbooks	Retained until you delete them
Chat messages	Retained within the session. Session data is retained until you delete the project.
Project memory	Retained until you delete the project
Anthropic API processing	Anthropic does not store inputs or outputs from API calls. See Anthropic’s data policy.
Gmail OAuth token	Stored encrypted. Revocable at any time via the Gmail connector panel.

Your controls

Delete all tax data

Click your avatar → Delete all tax data. This permanently deletes:

All projects
All chat sessions
All uploaded documents
All evidence items
All workbook data
All project memory

Your account remains active. This action is irreversible.

Delete your account

Click your avatar → Delete account. This permanently deletes:

Your user account
All associated data (same as “Delete all tax data”)
Your stored API key
Your settings and preferences

This action is irreversible. You cannot recover your account after deletion.

Disconnect Gmail

In the side panel, click the Gmail connection indicator → Disconnect. This revokes Lodgey’s OAuth access to your inbox. Previously searched results remain as evidence items, but no new searches can be performed.

You can also revoke access directly from Google’s security settings.

Remove your API key

Click your avatar → Settings → Remove next to your API key preview. This deletes the encrypted key from the database. Lodgey will stop working until you add a new key.

Third-party services

Service	Purpose	Data shared
Anthropic	AI reasoning and agent execution	Chat messages, document content (for extraction), tool inputs/outputs
Neon	Database hosting	All structured data (encrypted at rest)
Composio	Gmail integration	OAuth tokens, search queries
Resend	System emails (password reset, feedback confirmation)	Email address only
Vercel	Frontend and API hosting	Request metadata (standard web hosting)
Langfuse	Observability and tracing	Agent turn metadata (no PII, no document content)

What Lodgey cannot see

Your bank login credentials
Your myGov or ATO Online portal
Your email content beyond search results (Gmail access is search-only, not full inbox access)
Other users’ data
Other projects’ data (even within your own account)