Commander Ash
Ash is built on not overstating what it knows. This page holds itself to the same rule: it describes what actually happens to your information, including the parts that are less comfortable to say.
Last updated 9 September 2026. Ash is in private beta.
The data controller is Juanjo García Gómez, Norway, operating as Commander Ash. Contact: hello@commanderash.com.
Ash is a personal project in private beta with a small number of invited users. It is not a company product and there is no support desk. The person who reads that mailbox is the person who built it.
| What | Why |
|---|---|
| Your email address and display name | To identify your account and to write to you. |
| Your password, two-factor secret and recovery phrase | To let you in and keep everyone else out. The password is stored only as an irreversible hash; the two-factor secret and recovery phrase are stored encrypted. |
| Health and fitness data from Apple Health and Garmin: workouts, distances, durations, heart rate, resting heart rate, heart rate variability, sleep, steps, energy, and body measurements you have recorded | This is what Ash coaches from. Without it, Ash has nothing to work with and says so. |
| Everything you tell Ash in conversation | To understand you, and to remember it next time. This includes anything you choose to say about your health, your life, your work or how you feel. |
| What Ash concludes about you, held as a profile | So Ash does not start from zero every time you talk. You can see it, correct it, or remove any part of it. |
| Your goals and target dates | To coach toward something specific and to be honest about progress. |
| Your Garmin sign-in and calendar authorisation, if you connect them | To fetch your data. Stored encrypted. |
| Approximate location: city and country only | To show the correct emergency and support numbers for where you actually are, to put your activity on the correct calendar day, and to understand travel. Derived from your phone's time zone, your connection, and your device location if you allow it. Precise coordinates are never stored and never leave your phone. |
| Device information: a notification token, a device identifier, the app version and your iOS version | To send notifications and to diagnose faults. |
| A record that a safety check was triggered, without the message that triggered it | Ash screens every message for signs of crisis so it can respond appropriately. The record is kept so the mechanism can be audited. It never contains what you wrote. |
| Running costs: how much processing your conversations used | To keep the service affordable. Counts and costs only, never content. |
| Technical logs: which requests were made, when, and whether they succeeded | To keep the service working and to investigate faults. |
Ash asks for permission before reading Apple Health, before sending notifications, and before using your location. Each of those is optional, each can be refused, and Ash keeps working without them. It will simply tell you what it cannot see.
Your data is encrypted, but it is not end-to-end encrypted, and you should understand the difference.
Everything sensitive is encrypted at rest with a key specific to your account. That key is wrapped three separate ways: by your password, by your recovery phrase, and by a key held by the service. That third wrapping is what allows Ash to read your history and build your profile while you are not there, and it means the service is technically able to decrypt your data.
So the honest statement is this: nobody browses your data, it is never sold, it is never used to train models, and it is not readable by anyone who steals the database alone. But it is not mathematically impossible for us to read, and we will not pretend otherwise.
Your recovery phrase exists for a different reason: it is how you get back in if you forget your password. Write it down. If you lose both, the service can restore your access, because of that third wrapping. That is done by hand, only when you ask for it, it is recorded, and Ash tells you in the app when it has happened.
Other protections: the app is locked behind a PIN or Face ID on your phone, two-factor authentication is required on every account, the database is not reachable from the internet, and connections are encrypted in transit.
| Who | What reaches them |
|---|---|
| Anthropic Generates Ash's replies | Your message, recent messages from the conversation, and a summary of what Ash knows about you, including health information. Anthropic processes it to produce a reply. It is not used to train models. |
| Garmin If you connect it | Your Garmin sign-in details, in order to sign in to your own Garmin account and fetch your data. |
| Apple Notifications | A device token and the text of any notification sent to you. Apple Health data flows only one way: from your phone to Ash. Nothing is written back. |
| Cloudflare Network and domain | All traffic between your phone and Ash passes through Cloudflare's network, where it is briefly readable before reaching our server. Standard for internet services, and stated here because it is true. |
| Hetzner Hosting, Germany | Stores the encrypted database and runs the service. |
| Google | Handles the invitation and support email sent from hello@commanderash.com. |
There are no advertisers, no data brokers, no analytics companies, and no tracking of any kind. Ash contains no advertising SDK and no third-party analytics.
Ash is operated from Norway and follows the GDPR.
Health data is a special category under Article 9. Ash processes it on the basis of your explicit consent, given when you connect a health source and when you tell Ash about your body. Everything else is processed on the basis of consent under Article 6(1)(a). You can withdraw consent at any time, and withdrawing it means Ash stops.
You have the right to:
To exercise any of these, write to hello@commanderash.com. Requests are answered within 30 days, and in practice much sooner.
How deletion works today, in plain terms. Ash is in private beta and deletion is carried out by hand when you ask, not by a button in the app. It removes your account and everything attached to it: your conversation, your profile, your goals, your health data and your connector credentials. A button is being built. Until it exists, the email address above is the mechanism, and it is honoured.
Your data is kept while your account exists, because Ash coaching you depends on remembering you. There is no automatic expiry, and coaching gets better with a longer history.
When you ask for deletion, everything goes. Technical logs, which contain no health data and no conversation content, are kept for up to 90 days and then discarded.
Ash is not for anyone under 18. It is invitation-only and not offered to children.
If what Ash does with your data changes, this page changes with it, and the date at the top changes too. If a change is significant, you will be told directly rather than left to notice.
hello@commanderash.com. A real person reads it.