Security and data

Updated 1 October 2026. Goodfellaz is run by Distortion Labs SAS. The detail of what we read and keep is on the Privacy page.

Built to hold as little as possible

From Gmail we read only who wrote to whom and when, never the subject and never the text. From Calendar, when a meeting took place and who came, never its title or notes. Google access is read-only and ends when you disconnect it. We read the allow-listed facts and nothing else, and we never infer health, religion, politics, sexuality, finances or private life.

Kept apart

Each person's data is walled off from everyone else's in the database itself, so no query can cross from one account to another. Message text you choose to keep is sealed with a key of your own, held in Scaleway's key manager. Nobody browses anybody's network: an answer to someone else's ask is a yes, a not now or a no, never your contacts.

In transit and in the logs

Everything is served over HTTPS only. The service's logs are scrubbed of addresses, phone numbers and tokens before they are written. We keep a log of what left the service (which action, when, how many people), chained so that it cannot be altered afterwards, and never the content.

Nothing is sent for you

A draft opens in your own mail or WhatsApp. You press send, or you don't. No part of the service can approve, share or change a privacy rule for you.

Erasing

Delete my account in Settings erases your map, your links, your door page, your answers on other people's links, your Google access and your key, at once. Database backups roll over within 7 days. Someone who is not a user can leave every map with Remove me.

Sub-processors

• Scaleway SAS, Paris, France: the servers, the database and its backups, and the key manager.
• Cloudflare, Inc., United States: serves the public page at goodfellaz.ai; it sees the address and browser of whoever loads it, and holds nothing else.
• Anthropic (Claude): answers the assistant that talks a brief through with you. What you type there is sent to it, and is not used to train its models.
• Google: where your own data is read from, when you connect it.

Report a problem

Found a weakness, or something that looks wrong? Write to letho@distortion.gg. We answer, and we thank you.