On this page
A subscription cancellation sounds like the perfect job for an assistant. Find the account, identify the recurring charge, ask the company to stop it, and check that another payment will not arrive next month. The person requesting it should not have to spend an afternoon finding a password and waiting for a support representative.
But an assistant that does the task must cross boundaries that a chatbot answering a question never reaches. It may need to search an inbox for a receipt, open the subscription website, supply an account identifier, speak for the customer, and retain enough of the result to follow up. Each step is useful. Each step also answers a different question about permission.
That is the territory Instinct has entered. On September 28, 2026, the San Francisco personal-agent company announced a $1 billion Series C, with Sequoia Capital, Benchmark and Coatue participating, at a $10 billion valuation. Reuters reported that its valuation had quadrupled from the previous $2.5 billion round. The founder, Noah Shinn, previously worked at Sierra. The company is legally Spear Street Technology, Inc., doing business as Instinct.
Those numbers matter less for the capital itself than for what the capital is pursuing. Instinct does not ask people to learn a new prompt interface. Its homepage offers an assistant you text or call. It can use a phone and computer, arrange appointments, order groceries, dispute bills and manage other errands. The September announcement also described a concierge that calls businesses and a network in which assistants coordinate with one another. Instinct says it uses isolated sandboxes, short-lived credentials and identity-signed execution to protect these interactions. Those are meaningful technical choices, but they answer the security of execution rather than the entire question of what happens to personal information.
We read Instinct's Privacy Policy and Terms of Service directly on October 9, 2026. Both say they were last revised August 26, 2026. What follows distinguishes what the company promises, what the documents permit and what users can actually choose in those documents.
The first permission is to read
A text or phone call may be the visible interface. The important interface sits behind it: the services and accounts a person connects.
The privacy policy, under information collected through use, describes access to messages, emails, private communications, documents and connected applications according to permissions granted. It separately includes voice data when voice features are enabled, payment details when a user supplies them, account usernames and passwords needed to sign in, and health-related information when a medical appointment or health-provider email is involved. Automatic usage information can include keystrokes, clicks, cursor positions, device and network details, and precise location if shared.
The policy does not say every user supplies all this data. Access depends on permissions granted. But a trip booking can involve a calendar, inbox, location, merchant and payment method, pulling several categories into a single task.
The terms, in the section on connected services, authorize Instinct to “access, copy, collect, and index data” from linked services. Reading is necessary for many tasks. Copying and indexing create an additional object: information stored in the assistant's environment, potentially usable after the original interaction has ended.
For a person deciding whether to connect their primary mailbox, that is the first practical separation to understand. Permission to read a message for today's task and permission to maintain a searchable copy of past messages are not identical operations, even when a product puts both behind the same account connection.
A disconnected account can leave an index behind
In August, TechCrunch reported that testers questioned why an agent could still summarize information from Gmail after access had been disconnected. The company subsequently exposed an external-data deletion control. Those reports concerned the product and terms as they stood at the time; the governing documents were revised on August 26.
The current policy says “disconnecting a third-party integration does not automatically delete data”. The terms separately explain that an indexed copy may still be used after a connected service is disconnected unless deletion is requested. These statements make the distinction unusually clear.
Disconnecting stops a route into an account. It does not by itself remove the information the route previously delivered. Think of changing a door lock after someone has already made a copy of a document. The new lock prevents new entry; the copy requires a separate decision. This is an analogy about data flow, not a claim about an undisclosed storage system.
The policy points users to app.instinct.com/workspace to delete data indexed from external sources. For Google Workspace, it also describes revocation through settings or a conversation with the agent and says previously collected Google data can be deleted by deleting the Instinct account within the workspace interface. Readers should distinguish these routes from merely turning off an integration.
This is also where retention becomes a real question. The privacy policy specifies categories and purposes but does not supply a universal number of days after which copied email, messages or interaction history are purged. The terms' account-termination provision says the company “may, but is not obligated to” delete Materials when an account is deleted. A user has deletion controls, but no guarantee that every copy disappears on disconnect or termination. The policy also permits using deidentified or anonymized information for any purpose, without naming a separate expiry for that category.
The difference between processing and learning
Most of the information an assistant uses must be processed somewhere to complete a task. Processing an email to answer a question is not the same as incorporating information into future model training.
Instinct's policy explicitly permits some collected information to “evaluate, fine-tune, and train” the models powering its products. It provides a training opt-out in account settings. It also says the opt-out works “on a go-forward basis”. A model already trained using earlier information may continue to be used; the policy does not offer a mechanism for removing that earlier contribution from a model.
There is a further exception: even after a training opt-out, material flagged for safety review may still be used for model training to improve harmful-content detection, policy enforcement or safety research. The policy also differentiates training from other service improvements, which may continue after a user opts out. A person who chooses the switch should therefore understand exactly which use it controls.
Two important protections sit alongside this permission. First, the policy excludes information obtained directly through Google Workspace APIs from model evaluation, fine-tuning, training or improvement. That includes linked Gmail, Calendar, Drive, Docs, Sheets, Slides and Tasks data covered by the stated Google API policy. Instinct also says third-party model providers may process this Google data only to deliver the service, not to train on it or use it for independent purposes.
Second, the terms' Materials section describes a Vault feature whose contents are used to provide the service to that person, not to train AI models. These exclusions matter. They also require the reader to separate Google API data, Vault contents, other connected-service material and usage signals rather than treating everything the agent encounters as governed by one rule.
For tasks that mix an email, typed instructions and another service, training eligibility depends on provenance. The documents do not describe a public, record-level audit of that classification. The question is which records the opt-out covers.
Following the information downstream
A personal assistant can operate only by interacting with other systems. Instinct's privacy policy, under disclosure, lists corporate affiliates, hosting and analytics vendors, payment processors, third-party AI model providers, business partners, recipients of user-directed actions, professional advisers and parties involved in business transactions. It also reserves disclosures for legal and security purposes.
For business partners using information for their own purposes, the policy describes aggregate or anonymized information, or disclosure otherwise permitted by applicable law, including consent where required. It expressly excludes Google Workspace data from that category of partner disclosure. Instinct also says it does not sell information or disclose it to registered data brokers or resellers. Those promises should be read alongside, rather than substituted for, the enumerated forms of sharing.
The diagram maps the data routes described in the policies. The route taken depends on the account, enabled features and permissions.
YOUR ACCOUNTS AND INSTRUCTIONS
Text / voice · Gmail / Calendar / Drive · other apps · payments
|
permission to access
v
INSTINCT SERVICE AND AGENT
task context · copies · indexed data
| | |
v v v
AI model hosting merchants,
providers and ops recipients
|
eligible data may be used for model training
(opt-out; safety exception; Google/Vault exclusions)
Diagram: source access, stored copies, model providers, external actions and training rules described in Instinct's published policies.
The arrow to a merchant is necessary for some tasks: a ride provider needs the destination. The question is whether only the required details move, with the user's approval.
When the assistant signs, who has agreed?
An assistant can read extensively without committing anyone to anything. Instinct is built to go further. Its terms' Actions section appoints the service as the user's agent to enter agreements and commitments with third parties. Such commitments are described as “binding on you as if entered into directly by you”.
That sentence changes how to think about a failed action. A mistaken restaurant reservation or a subscription cancellation is not merely an inaccurate answer on a screen. The action may create a real relationship with another business, under that business's policies. Instinct's terms place responsibility for actions and their consequences on the user, and warn that some cannot be reversed. The privacy policy mentions unintended payments and misleading instructions from third parties. The terms also limit the company's damages exposure to the greater of $100 or fees paid over the preceding six months, subject to applicable law. Disputes generally go to individual arbitration; users can opt out within 30 days by contacting support@instinct.com. Opting out of arbitration alone does not remove the class-action waiver.
Any software that can buy, send, cancel or accept terms needs rules for authority. Instinct's terms allow confirmation controls without guaranteeing they prevent unwanted actions. Users should know which operations require final approval and which follow earlier instructions.
Instinct's isolation, short-lived credentials and signed execution address tool security; they do not decide who bears an agent's mistaken commitment or how long its indexed copies remain.
Six decisions before connecting an account
The most useful comparison is between the permissions Instinct documents and the design decisions a privacy-first personal-context system can make. The right column sets out the privacy-first standard used for comparison.
| Decision | Instinct's published position | Privacy-first design choice |
|---|---|---|
| Where context lives | Agent can copy and index data from connected services | Keep durable context in a user-controlled local store; send only task-specific context |
| Model training | Allowed for eligible data; prospective opt-out and safety exception; Google Workspace and Vault excluded | No training on personal context as a default product rule |
| Disconnecting | Revocation does not itself erase previously indexed data | Separate revoke, inspect, export and delete controls, with visible outcomes |
| Sharing | Operational vendors, model providers, action recipients and limited business-partner uses | Disclose by purpose and recipient, rather than treating one connection as general consent |
| Authority to act | Agent can enter binding transactions or agreements on the user's behalf | Distinct approval thresholds for reading, messaging, spending and accepting terms |
| Leaving the service | No universal retention period stated; deletion is not automatic under the termination clause | Defined retention windows, deletion of cached copies and a portable context export |
The comparison also identifies what local-first does not solve automatically. A local assistant that sends an email still hands information to an email provider and a recipient. An on-device index can still contain sensitive records. A person can still authorize the wrong payment. Keeping a durable model on-device is a strong starting boundary, not a substitute for limited permissions or confirmation at the point of action.
What a privacy-first assistant keeps with the person
The immediate commercial story is remarkable: a company built around a textable assistant attracted $1 billion in new capital weeks after its previous major financing. Its popularity follows a genuine frustration. Many everyday tasks require an inconvenient chain of accounts, pages, calls, decisions and follow-ups. Giving a capable agent the whole chain can make those tasks disappear from the user's day.
The fine print shows why that convenience needs a more precise vocabulary. Reading, indexing, processing, training, sharing, acting and deleting are seven different operations. A single connection screen should not be mistaken for a complete explanation of them. The fact that Google Workspace data is treated differently from other eligible information is evidence that these distinctions can be made in product design.
A privacy-first system begins by keeping the enduring map of a person's work in their control. The AI used today receives the narrow context needed for today's request; tomorrow's AI need not inherit a new copy of the whole history. Sensitive information has a documented lifetime. Disconnecting and deleting have different, intelligible effects. Actions that speak for someone receive approval proportionate to their consequences.
That is also the logic of a local-first world model such as Zortex's approach: context organized around the person, with deliberate disclosure to whichever AI they use, rather than a fresh transfer of their history to each assistant.
Instinct's current policies are useful reading precisely because they state many of the permissions plainly. The decisions are not hidden in a technical architecture diagram. They are in the authorization to index a connected account, the training exceptions, the separate deletion route and the power to make a commitment that binds the user. Those are the choices a person is making when they send the assistant a seemingly simple request to cancel a subscription.
Sources and document dates: Instinct Privacy Policy (last revised August 26, 2026; read October 9, 2026); Instinct Terms of Service (last revised August 26, 2026; read October 9, 2026); Instinct's funding announcement (September 28, 2026); Reuters (September 28, 2026); TechCrunch's reporting on early privacy concerns (August 24, 2026).
