Privacy Policy

Last updated October 10, 2026

Who runs Holdfast

Holdfast is a Telegram bot that turns a short voice note about someone you care about into reminders at the moments that matter. It is run by Joshua Marcos, as an individual (“we”, “us”).

This policy covers the Holdfast bot, the website at useholdfast.co, and the emails we send. If anything here is unclear, email hello@useholdfast.co.

What we collect

If you join the waitlist: your email address, the date you signed up, which link brought you (for example a TikTok link), and the date we send you an invite.

If you use the bot:

• Your Telegram chat ID, which is how we know which notes are yours and where to send reminders. We don’t store your Telegram name, username or phone number.
• Your voice notes, only while they are being turned into text (see below).
• The text of each note.
• What Holdfast picks out of each note: the name of the person you talked about, what’s happening in their life and when, the things you said you’d do and by when, and the overall mood of the note.
• The reminders we send you and whether you acted on them. When you reply to a reminder with something like “done” or “later”, we update the reminder. We don’t keep the reply itself, and it isn’t sent to any AI service.
• Your plan and the dates of your free trial.

If you email us: your email address and what you write.

When you visit the website: Vercel, which hosts the site, keeps standard request logs, such as IP address and browser type, for a short time to keep the site running and secure. The website doesn’t use cookies, analytics or ad trackers.

We never ask for your address book, your location, or access to your other Telegram chats.

What happens to a voice note

1. Telegram passes your voice note to Holdfast.
2. We check that it’s under 2 minutes and that you haven’t reached the daily limit. If it’s over, we tell you, and nothing is downloaded or stored.
3. We save the recording in our storage and send it to Groq, which turns it into text.
4. As soon as the text is saved, we delete the recording. Your own copy stays in your Telegram chat.
5. We send the text to Groq, which picks out the people, dates and promises. We save what it finds and reply to tell you what was saved.

If a recording can’t be turned into text after two tries, we tell you. Later, we try once more, unless you’ve sent another voice note since. If that works, we save the text and tell you what was saved. Either way, the recording is deleted within 2 days of when you sent it.

Groq says it doesn't train models on data sent through its API, and doesn't keep it by default. It may keep it for up to 30 days to fix problems or check for abuse. Read Groq’s data policy.

How we use it

• To run Holdfast: turn your notes into text, remember what you told it, and send reminders.
• To keep it working and fair: apply the usage limits, fix problems, and prevent abuse.
• To email you about the waitlist and your invite. We only ever email you about Holdfast.

We don’t sell your information, share it for advertising, or use it to train AI models. We don’t read through your notes. We may look at a specific note when we need to fix a problem with it, or when the law requires it.

Who else handles it

A few companies help us run Holdfast. Each one only gets what it needs to do its job.

• Telegram carries your messages and voice notes between you and Holdfast. Privacy policy
• InstantDB is our database and file storage, where your notes and the temporary recordings are kept. Privacy policy
• Groq turns recordings into text and picks out the people, dates and promises. Privacy policy
• Vercel hosts the website and the bot, and keeps short-lived logs. Privacy policy
• Resend sends our emails. Privacy policy
• ImprovMX forwards email sent to hello@useholdfast.co to our inbox. Privacy policy

These companies are mostly based in the United States, so your information is stored and processed there.

We may also share information if the law requires it, or if it’s needed to protect someone’s safety. If Holdfast is ever moved to a company or taken over, your information would move with it, and this policy would still apply to it.

How long we keep it

• Recordings: deleted as soon as the text is saved. A recording that can’t be turned into text is deleted within 2 days.
• Notes, people and reminders: for as long as you use Holdfast. If you ask us to delete them, we do it within 30 days.
• Waitlist emails: until you start using Holdfast or ask to be taken off the list.
• Emails you send us: as long as we need them to answer you and keep a record.
• Logs: Vercel keeps them for a short time. When something goes wrong, an error log can include part of a note.

The people you talk about

Your notes are about other people, who haven’t signed up for Holdfast. We use what you say about them only to remind you. We never message them, look them up, or combine what you said with information from anywhere else.

Please be thoughtful about what you record. Say what you need to remember, and leave out anything someone told you in confidence that you wouldn’t want written down.

If you think Holdfast holds information about you because someone mentioned you, email us. Notes are stored under the person who recorded them, usually with just a first name, so we may not be able to find them. We’ll do what we reasonably can.

Your rights

Wherever you live, you can ask us to:

• send you a copy of your data
• correct something that’s wrong
• delete your data, or just part of it
• take you off the waitlist or stop emailing you

Email hello@useholdfast.co. We’ll answer within 30 days, and we may ask you to confirm it’s you first. Blocking the bot in Telegram stops the reminders, but it doesn’t delete your data. To delete it, email us.

If you live in California: the California Consumer Privacy Act gives you the right to know what we collect, to delete it, to correct it, and to opt out of its sale or sharing. We don’t sell or share personal information as that law defines it, and we won’t treat you differently for using any of these rights.

If you live in the EU or UK: we use your information to run Holdfast for you (performing our agreement with you), to keep it secure and working (our legitimate interests), and to email you about the waitlist (your consent, which you can withdraw at any time). Your information is transferred to the United States, where our providers are. You can also complain to your local data protection authority.

Children

Holdfast isn’t for anyone under 16. If we learn that someone under 16 is using it, we’ll delete their data.

Security

Our database can only be reached by Holdfast’s own server, data travels over encrypted connections, and only Joshua has admin access. No system is perfectly secure. If a breach affects your data, we’ll tell you as soon as we can.

Changes to this policy

If we change this policy, we’ll update the date at the top. If the change matters, like collecting a new kind of information or a new company handling your notes, we’ll tell you in the bot or by email before it takes effect.

Questions

Email hello@useholdfast.co. A real person reads every message.