This page explains in plain language what we do with your information, what we never do, and how you stay in control. We have designed this platform to meet or exceed the requirements of major AI and privacy laws. Here is what that means for you.
When you speak with Raphael, your conversations are stored securely so he can remember them when you return. That is the only reason they are kept. Your conversations are never read by us, never shared with anyone, and never used to train AI.
Every time you send a message, we record that an exchange happened — but not what was said. Think of it like a receipt that proves a letter was delivered, without keeping a copy of the letter. We store a cryptographic fingerprint of each message. The fingerprint proves the record has not been tampered with, but it cannot be reversed to reveal your words.
The Ledger records that a conversation happened. It never records what was said.
You can permanently delete all your data at any time from the My Ledger panel inside the app. When you do, your conversations, memories, and journal entries are gone. The Ledger audit trail — which contains no personal content, only mathematical fingerprints — is preserved as an immutable record, but it cannot be used to reconstruct anything you said.
This approach is called cryptographic erasure. Your data is gone in the only way that matters: it can never be read again.
You can download everything we hold about you at any time — also from the My Ledger panel. You will receive a complete file of your conversations, memories, and journal entries in a format you can open and read.
Before every message reaches Raphael, it passes through a two-layer safety system. Here is exactly how it works.
Layer 1 — The content filter: Every message is first reviewed by a separate AI safety model. This model checks specifically for: sexual content, graphic violence, explicit drug references, profanity, and anything not appropriate for children. It reads your message and returns a single verdict — safe or not safe. This happens in under a second, before Raphael ever sees your words.
If a message is flagged: Raphael does not see it. Instead, he responds with a gentle redirection: "This is a space of prayer, faith, and accompaniment. I'm here for what truly matters — what's on your heart today?" The flagged message is not stored, not logged, and not forwarded anywhere. Only the fact that a filter event occurred is recorded in the audit Ledger — not what triggered it.
Layer 2 — Raphael's own values: Even if a message passes the filter, Raphael himself is guided by a clear set of values built into how he responds. He is instructed never to produce content that is sexual, graphically violent, profane, or unsuitable for a minor — regardless of how a message is framed. Both layers must hold.
We built this platform for people of all ages, including children in crisis. The filter is not optional and cannot be turned off.
You may choose to connect your Google account to Raphael. This is entirely optional. If you do, Raphael requests two specific read-only permissions:
Gmail (read-only): Raphael can read your recent emails so he can understand what you are carrying into your day — an appointment, a difficult message, something weighing on you. He never sends email, never modifies anything, and never stores your email content beyond the current conversation. Your Gmail data is used in the moment and not retained.
Google Calendar (read-only): Raphael can see your upcoming events so he can greet you in context. If you have a medical appointment this afternoon, he knows. If it is a quiet day, he knows that too. He can create calendar events and send emails on your behalf when you ask him to. He reads your inbox to help you respond. He never deletes email or calendar data without your explicit instruction.
Write access means Raphael acts when you ask him to. He does not act on his own.
The Raphael Project includes a private Catholic Messenger for direct conversations between members of the community. If you use the Messenger:
Messages you send are stored securely so the other person can receive and read them. Messages are visible only to the participants in a conversation — never to us, never to anyone else. You may delete your data at any time from the My Ledger panel, which will remove your messages from the system.
The Messenger does not use AI to read or analyse your messages. It is a private channel between two people, nothing more.
Raphael is powered by Anthropic's Claude AI. Your messages are sent to Anthropic's API to generate responses. Anthropic does not use API data to train their models. No other third parties receive your conversation content. Our database is hosted by Supabase, operating under SOC 2 Type II compliance. Google integration uses Google's official OAuth 2.0 system — we never see your Google password.
If we ever change how we handle your data in a meaningful way, we will notify you when you next sign in — not bury it in an email you might miss.
If you have any questions about your privacy or your data, reach us at hello@theraphaelproject.com.
Your privacy is not an afterthought. It is built into the foundation.
Return to Raphael →