Shoulder can watch you pay bills, log into portals, and handle personal information — so its privacy posture isn’t a footnote, it’s the reason it’s safe to use for that in the first place.

The short version

Only the video extraction step touches the cloud. Project storage, search, and chat are all designed to run on-device. That’s what makes the “erase everything” option total — there’s no server copy of your projects to chase down.

What touches the cloud

When you stop a recording, it’s sent to the Shoulder relay so a cloud model (Gemini Flash) can extract information from it against your project’s goal. The relay discards the raw recording once extraction is complete — it isn’t retained.

Current build note: in the shipped TestFlight build, project chat also runs through the relay rather than fully on-device — the on-device chat pipeline is in progress. This page will update as that changes.

What stays on your device

• Your project list, goals, and extractions are stored locally, not synced to a Shoulder server.
• Search across your projects runs on-device.
• The on-device knowledge base (RAG) that answers your questions is built and queried locally, per project.

Erasing everything

Because extractions and chat history live on your device rather than a server, deleting a project — or using the app-wide “erase everything” option in Settings — actually removes it. There’s no cloud copy to separately request deletion of.

What Shoulder will never do

Shoulder thinks like an agent — it actively watches, analyzes, and reasons about what matters toward your goal — but it doesn’t act like one. It never takes actions on your behalf: no logging into a site for you, no submitting forms, no moving money. That’s the precise distinction that makes it safe to point at things that matter — it can’t break anything, because it never acts for you. It’s doing real work the whole time; it just never clicks, types, or submits anything on your behalf. You stay the one driving; Shoulder rides along, analyzes, and remembers.