Rist Assist
Join the beta

Privacy policy

Last updated: October 13, 2026 · Version 2026-10-13

1. Who we are

Rist Assist is a voice assistant for a Google Pixel 10a running RistOS. It is operated by Rist Mobile, LLC (“we”, “us”). This policy covers the Rist Assist service, the website at ristassist.com, and your account. It explains what we collect, why, how long we keep it, who else handles it, and what you can do about it.

Most privacy requests can be made from your account page (Section 8). For anything else, including privacy questions, use our contact page.

2. The short version

  • We make money from your subscription and nothing else. We don’t run ads, we don’t sell your personal information, and we don’t share it for advertising.
  • The assistant records only when you press the button. There is no wake word and no background listening.
  • To answer you, your words go to the speech-to-text and AI model providers we use. Section 5 lists who they are.
  • Most of what we keep is on a clock. Section 4 gives each period. Some things, like your conversation with the assistant, notes, contacts and voicemail, stay until you delete them.
  • You can delete your conversation history, contacts, voicemail, all your data, or your whole account from your account page.

3. What we collect

Your account. Your email address, a password (we store only a hash of it), which phones are paired to your account, and which version of these terms and this policy you accepted and when. To protect sign-in and sign-up, we keep records of attempts, some of which include the IP address the attempt came from, and we use them only to slow down repeated attempts. When you sign up or pair a phone, we also pass your IP address to the assistant service to help stop fraudulent sign-ups.

Billing. Payments are handled by Stripe. We never see or store your card number. We keep the Stripe customer and subscription IDs, your subscription status, and the end date of the current period.

What you say, and what the assistant says back. Recording starts when you press the button, and each press records up to a minute. The recording goes to our servers and is turned into text by a speech-to-text provider. We don’t store the recording of your request. We keep the text of what you said and what the assistant replied (Section 4).

Your conversation. Rist Assist keeps your conversation with the assistant: what you say, what the assistant answers, and what its tools found for you, so it can remember earlier parts of the conversation, including after a restart. Your account has one conversation, shared by all your paired phones. Older parts are kept as a summary written by the assistant’s AI model; the earlier words are kept too, and the assistant can look back at them. The words and summaries are encrypted on our servers with a key that we hold. When each part was said and how long it is are not encrypted. Your conversation has no time limit and we do not delete it automatically. It is kept until you delete it: on your account page under Settings, Privacy and data, by deleting all your data, or by deleting your account. Asking the assistant to start a new conversation ends the current one but does not delete it, and the assistant can’t delete it for you when you ask by voice.

What each AI model call was shown. To work out what went wrong when the assistant makes a mistake, we keep a record of what each model call was given and what it answered. Depending on the request, that can include your city and the time, results from a web search, your contact list, messages in your inbox, and the recent part of your conversation. The full text is kept for 7 days (Section 4).

Photos. When you ask about a photo, the AI model looks at it and the picture is then dropped. We don’t store it. Your question and the assistant’s answer are kept like any other request.

Sound clips. If you ask what song is playing, about 12 seconds of the recording go to a song-recognition service. That happens only when your own words ask about the song. If you ask what animal you’re hearing, up to 20 seconds go to a species-identification service that we run ourselves on Amazon Web Services and that keeps nothing.

Location. Each request carries your phone’s current location, so that “near me” and “is it going to rain” mean where you are. We keep only the last location your phone sent: one place, not a history. We also keep your phone’s time zone. Precise location is “sensitive personal information” under California law. We use it only to answer you. You can turn location off in Settings, under Privacy and data. That stops all use of your location and deletes the last place we kept.

Things you create. Notes, lists, alarms, timers, calendar events, standing instructions (for example “remind me to water the plants every Sunday”), watches you set up, and items on your home screen.

Contacts. The assistant keeps your contacts (names, phone numbers, email addresses and any descriptions you add) and syncs them with your phone’s address book, so it can work out who you mean.

Texts, calls, email and voicemail.

  • Texts. The assistant stores the texts you send and receive through it, so it can read them to you and reply.
  • Calls. The assistant keeps the number, time and outcome of calls it places or screens for you.
  • Email. If you connect your own email accounts, the assistant copies the mail in their inboxes (the last 30 days when you connect, then new mail as it arrives) so it can read it to you, and sends the mail you ask for through that account’s own mail server. It keeps the sender, subject, text and attachment names, not the attachments.
  • Voicemail. If you have a Rist Assist phone number, voicemail left on it is held by our phone provider, and we keep the caller’s number, name, time and length. We don’t transcribe voicemail.

Records of what the assistant sent for you. For each text it sends, and each email sent by a standing instruction: who it went to, when, how it worked out the recipient, and the words you used to ask for it.

Phone numbers and texting consent. We keep your Rist Assist phone number if you have one, the phone number used to verify your account at sign-up, and, for each person the assistant texts from a Rist Assist number, whether they have been sent the first-message notice, whether they have replied, and whether they have opted out (Section 7).

Linked accounts. If you link a Google Calendar, we keep the access token Google issues and copy events between that calendar and the assistant. Unlinking cancels the token with Google.

Connected email accounts. If you connect an email account, we keep its address, its mail server settings and user name, and its app password, or for Outlook, Hotmail, Live and Microsoft 365 the sign-in token Microsoft issues. The password or token is encrypted on our servers. We use it only to fetch that account’s mail and to send the mail you ask for, and we never show it back to you. Disconnecting the account, on the Email page of your account, deletes right away the stored settings, the password or token, and every email copied from or sent through that account. We keep a record that you disconnected it (with no address) and the records of emails already sent (Section 4). Notifications about that mail that were already sent to your phone, and anything the assistant said about it in your conversation or model-call records, stay until those are deleted or expire. Disconnecting doesn’t cancel our access at your provider, so also delete the app password at Google, Apple or Yahoo, or remove our app under “Apps and services” in your Microsoft account.

To find a mail provider’s server settings, we may look up your email’s domain in Mozilla’s public mail-settings database (autoconfig.thunderbird.net) and ask the domain’s own settings service, which receives your address.

Usage counts. How much assistant use your account ran up each day, as an estimated cost with no words, and the texts, calls and emails it sent (recipient and time, never the content), so the limits in our Terms of Service can be applied. We also keep email bounce and complaint notices.

Device information. For each paired phone: a device ID, a label, and a hash of its sign-in token (never the token itself). We also keep which features the phone says it supports.

The website. The website sets a sign-in cookie. It doesn’t use advertising or analytics trackers.

4. How long we keep it

The service deletes data on these schedules automatically. The job runs every six hours, so each period can run a few hours over. Backups are covered at the end of this section.

  • Your conversation with the assistant, including its summary of older parts: until you delete it. It is not deleted automatically, and starting a new conversation does not delete the old one.
  • Recording of your request: not stored. It is turned into text and dropped.
  • Text of what you said and what the assistant replied: 90 days. After that the words are deleted and an entry with no words is kept for about 13 months (400 days) from the request. Your words are stored up to 200 characters per request.
  • What each model call was shown and answered: 7 days. A record with no content (which step ran, how long it took) is kept for 30 days.
  • Photos you ask about: not stored.
  • Records of texts and emails the assistant sent for you: 4 years. You are the sender, and disputes about a message can come up long after it was sent.
  • Texts (in and out): 1 year.
  • Email (in and out): 1 year, including mail copied from a connected account.
  • Texts scheduled for your phone to send: 1 year after they finish.
  • Voicemail (record and recording): until you delete it, heard or unheard.
  • Notes and lists: until you delete them. A deleted note is erased after 1 day, which allows an undo.
  • Files and attachments you receive: until you delete them. A deleted file is erased after 30 days.
  • Contacts: until you delete them.
  • Calendar events, alarms, timers, standing instructions, watches and notifications: until you delete all your data or your account. Cancelling one stops it, but its details are still kept.
  • Home-screen items: until you remove them, then 24 hours (for undo).
  • Last known location: 30 days from when your phone last sent it.
  • Phone’s time zone: until it changes, or until you delete all your data or your account.
  • Place in an audiobook or podcast: 6 months after you last played it.
  • Daily usage estimates: about 13 months (400 days).
  • Counts of texts, calls and emails sent, and email bounce notices: 35 days.
  • Questions the assistant asked before acting (“Send it?”): the details are deleted once you answer. A bare record of the outcome is deleted after 7 days.
  • The phone number used to verify your account: 7 days.
  • Sign-ups that were never paid for: 90 days.
  • Linked Google Calendar access: until you unlink it or delete your account.
  • Texting consent and opt-out records: kept, including after you delete your account (Section 8).
  • Your account, phones and subscription records: until you delete your account.

Server logs. Our application logs don’t record what you said, what the assistant replied, or the content of your messages. They do record IDs, tool names, counts and partly hidden phone numbers.

Backups. Backups hold whatever the live system held when they were taken. Something deleted from the service stays in backups until those backups expire. Database backups are kept for up to about 120 days.

Providers. The providers in Section 5 keep data under their own terms. For example, voicemail recordings are held by our phone provider until we delete them.

5. Who else handles your data

We use service providers to run Rist Assist. They handle your data to provide their service to us, and not for their own advertising.

  • Speech-to-text and AI models. To understand and answer you, your words, and what each step needs to see (such as your city, the time, your contacts or a message you asked about), go to AI model providers: Groq (speech-to-text and some models) and Amazon Web Services’ Bedrock service (the main assistant models). A photo you ask about goes to the AI model that reads it.
  • Web search. Web searches are made by our servers and sent to Brave Search, so the search provider sees a query from us, not a profile of you. When the assistant opens a web page to answer you, that website sees a request from our servers. Image searches go to Wikimedia Commons.
  • Maps, places and weather. Your location, or the place you name, goes to the services that answer location questions: a place-search service (Geoapify) and a weather service (Open-Meteo). Maps and directions are built from OpenStreetMap data on our own servers.
  • Song recognition. AudD, only when you ask what song is playing (Section 3).
  • Species identification. Our own service on Amazon Web Services. It keeps nothing.
  • Phone calls, texts and voicemail. Twilio carries calls and texts through your Rist Assist number and holds voicemail recordings.
  • Email. Amazon Simple Email Service (SES) sends our account emails, such as sign-up and password links.
  • Your email provider. Mail from an account you connect is fetched from, and sent through, that provider (for example Google, Apple, Yahoo or Microsoft) under its own privacy policy.
  • Payments. Stripe processes payments and manages your subscription.
  • Hosting and storage. Amazon Web Services stores files, received email and backups.
  • Video calls. If you start a video call, the audio and video are carried using LiveKit. We don’t record calls.
  • Google, only if you link a Google Calendar.

We may also disclose information if the law requires it, to protect the safety of a person, to protect our rights, or as part of a merger or sale of the business. If that happens, this policy keeps applying to the information.

Our staff. When you report a problem, or when we look into a failure, people at Rist Mobile may read the logs in Section 4 to find out what went wrong. Access is limited to that purpose.

No sale, no ads, no training. We don’t sell your personal information, and we don’t “share” it for cross-context behavioral advertising, as California law defines those terms. We don’t use your conversations to build advertising profiles. We do not use your data to train models.

6. How we use your data

We use your data to answer your requests and do what you ask, run the features you have switched on, bill you, apply usage and sending limits, prevent fraud and abuse, keep the service secure, fix mistakes, contact you about your account (receipts, payment problems, changes to these terms), and meet legal obligations. We don’t use it for anything else.

7. Mobile information and text messaging

When you use Rist Assist to call or text, we process the phone numbers involved: your own number or Rist Assist number, and the numbers of the people you ask the assistant to reach. We use them only to place your calls and deliver your messages, to show you your own message and call history, and to record and honor opt-out requests.

For each person the assistant texts from a Rist Assist number, we keep a consent record: whether we have sent the one-time notice that identifies the service, whether they have replied, and whether they have opted out. That record is how we make sure nobody who has asked us to stop gets another message from us.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text-messaging originator opt-in data and consent are never shared with any third parties, and are excluded from every other category of data sharing described in this policy.

Texts usually go out from your phone’s own mobile line. The consent records above apply to texts sent from a Rist Assist phone number.

8. Your choices and rights

From your account settings you can:

  • Delete conversation history. This deletes, right away, your conversation with the assistant, including every earlier part and its summary, and the assistant starts a new conversation with you. Starting a new conversation doesn’t delete the old one, so use this to remove it. It doesn’t remove the request records or model-call records in Section 4, which still hold recent words: their text is deleted after 90 days and 7 days. To remove those now, use Delete full history.
  • Delete full history. This removes your conversation, your past requests and the assistant’s answers, the questions you asked about photos, and the records of what each request was shown. It doesn’t remove the records of texts and emails the assistant sent for you (Section 4).
  • Delete stored contacts. This also clears the address book on your paired phones.
  • Delete voicemail, one message or all of them. Recordings are deleted from our phone provider first.
  • Delete all my data. This removes everything above, including your conversation, plus notes, lists, alarms, timers, calendar events, standing instructions, watches, files, texts, email, your last known location, your phone’s time zone and your settings. It also disconnects your email accounts and deletes their mail. Your account, phones, subscription and feature switches stay. Usage counts and texting-consent records are kept, so that a delete doesn’t reset a limit or an opt-out.
  • Delete your account. This cancels your subscription right away, deletes your data, including your conversation, signs out every paired phone, and deletes your website account. A few records are kept on purpose, and we list them when the deletion finishes: texting-consent and opt-out records, a receipt showing that the account was deleted, and, if you had a Rist Assist phone number, the number itself, held for 60 days before it can go to someone else.
  • Disconnect an email account on the Email page. This deletes its stored app password or sign-in token, and the mail copied from it, right away.
  • Turn location off under Privacy and data. This stops all use of your location and deletes the last place we kept.
  • Switch features off on the Features page.

Deleting can’t be undone. Our servers may keep a short copy of your last few exchanges in memory for up to 30 minutes after a delete. Deleted data stays in our database backups until they expire, up to about 120 days (Section 4).

Through our contact page. Write to us, giving the email address on your account, to:

  • ask for a copy of the personal information we hold about you. There is no self-serve download yet, so we prepare it by hand;
  • correct inaccurate information;
  • delete your data or your account if you can’t use the account page; or
  • ask anything about this policy.

We may need to verify that a request comes from you. We answer within 30 days, or within the time the law allows if that is shorter, and we won’t treat you differently for using these rights. Requests made through the contact page are handled by a person.

People who aren’t customers. If someone used Rist Assist to text, call or email you, you can reply STOP to a text from a Rist Assist number, or write to us through our contact page to ask about information we hold that involves you, or to have it corrected or deleted.

9. California residents

If you live in California, the California Consumer Privacy Act, as amended by the CPRA, gives you rights to:

  • know what personal information we collect, use and disclose;
  • get a copy of it;
  • have it corrected or deleted; and
  • not be treated differently for using these rights.

To use them, use your account page or our contact page (Section 8). You may use an authorized agent; we may ask them for proof of authorization. In the last 12 months we have collected the categories described in Section 3:

  • identifiers (email, phone numbers, device IDs);
  • customer records and commercial information (subscription and payments);
  • internet and electronic activity (requests, usage counts);
  • precise geolocation;
  • audio (your request, briefly, for speech-to-text and sound identification);
  • the contents of messages, email and voicemail you choose to route through the assistant; and
  • inferences limited to understanding your requests.

We disclose these to the service providers in Section 5 for the business purposes in Section 6. We do not sell or share personal information. We use sensitive personal information (precise location, and the contents of your messages and email) only to provide the service you asked for, so the right to limit its use doesn’t come into play.

10. Children

Rist Assist isn’t for children. You must be at least 18 to have an account. We don’t knowingly collect personal information from children under 13. If you believe a child under 13 has given us personal information, contact us and we will delete it.

11. Security

We protect your data with encrypted connections, hashed passwords and device tokens, access limited to the people who need it, and automatic deletion on the schedules above. No system is perfectly secure, and we won’t tell you yours is untouchable. If a breach affects your personal information, we will tell you as the law requires.

12. Where your data is processed

Rist Assist is run from the United States, and we process your data in the United States. Some of our service providers may also process it in other countries. It is offered only in the United States. It isn’t available in Canada yet, although calls and texts you ask the assistant to make can reach Canadian numbers.

13. Changes to this policy

When we change this policy, we post the new version here with a new date. If a change is material, we tell you by email or on this website before it takes effect, and we ask you to accept the new version where the law requires it.

14. Contact

Rist Mobile, LLC · contact page