EreoBuild 60 service information · October 2026
Ereo stores your sign-in account, profile settings, saved text conversations and their branches, feedback, request and usage metadata, credit records and billing identifiers. Conversation drafts and pending-save recovery data are kept in the browser you use. Uploaded images, PDFs, Office documents, spreadsheets, text/source files and ZIP archives, returned generated images and videos, immutable file versions, image thumbnails and video posters are stored in private file storage. File records track ownership, type, size, checksum and message references. Completed draft attachment references are saved in this browser. A file used in more than one chat remains one private Library item. Private preview and download links expire after 60 seconds; anyone holding such a link may use it until it expires.
Saved instructions include preferences such as name, language, tone and background. Memory starts off. You can review and save facts manually. A separate, off-by-default automatic-learning control can save clear answer preferences from new saved user messages while memory is enabled. It supports concise/brief/detailed answers, British/American spelling, metric/imperial units and professional/friendly/direct tone. It does not learn from uploads, quoted text, temporary chats or team conversations. Conflicting automatically learned preferences require manual review. Source identities and processing receipts prevent replay of a deleted source. You can inspect, edit, delete, clear or disable saved facts. Saving while memory is off retains the fact without using it until enabled.
Remember this uses permanent user messages and records exact origin provenance. You may paraphrase the fact. Project-origin facts stay in that project. Current requests take precedence over saved preferences. Temporary chats load no saved instructions, memories or project context.
Changes and forgetting exclude affected source-linked and derived working context from future answers and retire affected summaries. Visible original chats and completed files remain until separately deleted. Deleting a manual memory cannot erase independent copies previously typed elsewhere. Known personal-output project pins are disabled after revocation; their downloads remain and you can deliberately select them again. These controls do not promise erasure from all history or providers' retained records.
Project bindings reference exact file versions and enter automatic knowledge only after you enable a supported image or processed document. Moving a chat preserves its transcript while withholding old project context. Deleting a personal project removes its instructions, memories and bindings while retaining owned chats/files; active work must stop first. A scrubbed origin record may preserve file ownership. Exports include current instructions, memories, projects and bindings. Account deletion removes private state through existing cleanup. Minimal operation hashes/identities prevent stale retries recreating data; they do not retain old saved fact text.
For long saved chats, Ereo stores a compact working summary separately from your original messages, with references to the covered history and processing metadata. Older originals and currently available attachments can be retrieved to help answer later questions. Summaries can miss details and are separate from personal memory across chats. The AI provider processes selected conversation content to make these summaries. Working context follows the conversation's access and deletion controls and is included in account exports. Temporary-chat context is processed for the current request and is not stored as a saved conversation summary.
When you start a saved-workspace check, Ereo stores its progress, permissions, actions and result so it can continue after you close the browser. This diagnostic reads account and history metadata; it does not send your conversations to an AI provider. Finished task reports and their progress are normally removed after 30 days by the worker cleanup. Failed cleanup can delay removal. Uncertain action outcomes remain held for review and are not automatically repeated.
Account export includes your task records. Account deletion stops your tasks and removes private reports and checkpoints. Minimal action/outcome records may remain for the disclosed account-record retention period, and unresolved outcomes remain held for review. Operator control changes are audited; operator audit records are normally retained for 365 days.
Workflows and schedules are saved to your account separately from temporary chats. They retain your instructions, pinned reference-file versions, selected connected-source identifiers, permitted read tools, output preferences, timezone and timing rule. Saving or duplicating a workflow does not grant new app permissions or change your subscription. Scheduled reports use current access checks and the existing allowance and task-spending limits. Each execution has its own saved result and history. Pausing or cancelling a schedule prevents new work and stops publication from revoked work; it cannot recall a provider request already sent.
Deleting a workflow clears its saved instruction versions and cancels schedules that use it. Finished execution details and notification content are normally cleared after 30 days by cleanup, which can be delayed by a failure. The resulting saved conversations and files remain subject to their own deletion rules. Deleting a result chat removes access to that result; unrelated future schedules remain active. Deleting a project pauses schedules associated with that project. Account deletion stops schedules and removes readable workflow, execution, notification and delivery-preference data. Minimal unresolved cost receipts remain governed by the account-record policy.
In-app notifications are private account records. Email and browser push require separate opt-in and configured delivery support. External notifications contain a generic task-update message and an Ereo link, not your task text, report, file contents or connected-source content. Email goes only to the currently verified account address. Push uses an encrypted browser subscription held for that account and device. Quiet hours delay external delivery while in-app updates remain available. Delivery-service acceptance does not prove that you read or received a notification; an uncertain send is not blindly repeated. Turning a channel off cannot recall a notification already sent. Export includes workflows, retained versions, schedules, execution history, notifications and preferences, but excludes push endpoint credentials and private delivery records.
Agent work is saved to your account. A responsibility records versioned goals and success criteria, project scope, selected file versions and connected sources, permitted tools, triggers and budgets. Each run records progress, concise working notes, action decisions, costs and saved results. It can continue after you close the browser. Temporary chats do not create persistent responsibilities automatically; moving a task into saved Agent work is an explicit choice.
Agent work rechecks current source access, project scope and optional-memory settings when it resumes. A connected account alone does not authorize sending email or changing another service. A new consequential action requires a concrete reviewed proposal or a valid bounded standing permission. Changing material instructions invalidates affected pending decisions. Stop applies to one run and its descendants; responsibility pause and global Agent pause prevent new work within their scope, and ordinary chat stays available. Cancelling a responsibility disables future triggers. These controls cannot recall accepted external actions, and uncertain outcomes are held for review without automatic replay.
Agent source references, retained instruction versions, run history, execution steps and receipts, activity, decisions, scoped authorities and settings are included in account export. Service credentials and worker leases are excluded. Deleting a responsibility removes its readable instructions and working state; separately saved conversations and files follow their own deletion controls. Account deletion stops Agent work and removes readable Agent content. Minimal financial and anti-replay records follow the account-record retention policy. Agent notifications use the preferences and quiet hours described above. Computer execution requires a separately configured and verified executor; deploying this release alone does not activate it.
Image requests store their prompt, selected reference version, generation settings, progress and result so work can continue after the browser closes. OpenAI receives the prompt and selected reference image bytes. An edit or variation preserves earlier versions and downloads. Cancelling a dispatched request stops Ereo from publishing its result, but cannot guarantee that the provider stops processing or charging. Uncertain provider outcomes are not automatically generated again. Permanent image prompts and version relationships follow the saved file and conversation lifecycle and are included in account exports.
Ereo retains the original file and stores extracted text, page/sheet/line references, archive inventories and processing status as private derivatives tied to that version. A bounded local processor reads files without executing uploaded code, macros or spreadsheet formulas. Scanned pages can use the bundled English OCR model; recognition may be incomplete or inaccurate, and processing limits are shown. Selected extracted content and permitted reference images are sent to Anthropic when you ask a question about them. Repeated questions reuse available derivatives. Requested file edits preserve the original and create a new downloadable version with a change report. Excluded or unsupported archive entries remain explicit and are not described as reviewed.
When enabled, you choose which Google or Microsoft accounts and services to connect. Ereo reads only through the permissions actually granted. Google Drive supplies selected files, Gmail supplies selected messages, and Google Calendar supplies selected calendars and events. Microsoft supplies selected files from your own OneDrive, Outlook messages, and Microsoft calendars and events. Reading a source does not authorize sending email or changing a file or event. External changes require review and approval of the concrete action, account and content.
When you use selected Google or Microsoft content in chat, Ereo sends that content to Anthropic to answer your question. The selected source text is held in request and browser memory; Ereo does not create a separate stored copy of the source or bulk-copy your mailbox or cloud drive. Each new selected-source chat request checks current access and fetches the source again. Generated answers saved in normal conversations remain in that history and its working context until you delete them; disconnecting does not erase those already saved answers.
Google and Microsoft access and refresh credentials are encrypted and bound to your Ereo account and connection. Disconnecting removes local credentials and stops future access; Ereo also attempts to revoke the Google grant. If Google revocation is unconfirmed, you can remove access in your Google account settings. Microsoft disconnect removes the credentials Ereo holds; to revoke the Microsoft consent grant itself, use your Microsoft account permissions or ask your organisation administrator. Ereo does not sign you out of other Microsoft applications. Already accepted emails or calendar/file changes cannot be undone by disconnecting. An uncertain external result is held for checking and never automatically sent again.
Unexecuted action proposals expire after 24 hours. Content for dispatched, completed or uncertain actions may be retained for up to 30 days for review and reconciliation, then cleared by cleanup; failed cleanup can delay physical removal. Minimal operation identities, hashes and outcome records may remain under the account-record retention policy. Temporary chats can read selected sources but cannot prepare external changes. Account export includes connection/action metadata and any retained reviewed content, excluding credentials, OAuth state and transient read text. Account deletion revokes access, removes credentials and private action content, and retains only the disclosed minimal outcome records.
Google API data is used to provide the requested Ereo features, not to train Ereo general-purpose AI models. Google API data use and transfers are subject to the Google API Services User Data Policy, including its Limited Use requirements. Google account activation and the applicable service-provider settings must meet those requirements. Ereo does not claim Google verification or a completed security assessment through this page.
Supabase provides sign-in and application storage; Netlify provides hosting and functions; Anthropic processes chat requests; OpenAI processes image generation and paid speech requests; Google supplies requested Drive, Gmail and Calendar content and processes reviewed connected actions; Microsoft supplies requested OneDrive, Outlook and Calendar content and processes reviewed connected actions; it also processes video-generation requests when configured and requested; Stripe provides subscription and payment services. Requests sent to these providers are subject to their separate processing and retention policies. Provider logs, fraud records and backups may remain after deletion of Ereo's active application records. Ereo does not promise immediate deletion of records it cannot control.
When you request file creation, revision, data analysis or code testing, Ereo stores the instructions, authorised input versions, a concise record of execution and privately saved outputs. JavaScript tasks run in a bounded environment with no access to application credentials, files or the network. Managed Python and document tasks send your selected files and instructions to Anthropic's isolated execution service. Ereo keeps earlier file versions when saving revisions. A generated code snippet is not recorded as a successful test unless execution evidence supports that result.
Ereo queues deletion of known provider files after saving results or cancelling/deleting work. Provider execution containers can retain their contents for up to 30 days, and provider retention is separate from Ereo's 24-hour temporary-file expiry. If a provider response is lost, Ereo may not receive every generated file identifier and cannot guarantee immediate removal of those unknown remote files. Cancelling or deleting a task prevents later publication in Ereo but does not prove that remote processing or charges stopped. Uncertain paid work is not automatically repeated.
Temporary chats stay out of normal saved history and do not load saved account instructions, personal memories or project context. Their conversation content is held in the current browser tab and sent to the selected AI provider to answer you. Closing the chat clears its local conversation state. Temporary image/video-job prompts, document processing content and extracted sections are held only for processing and recovery, expire after 24 hours, and are scrubbed by scheduled cleanup; minimal request and usage metadata may remain. Temporary uploads are excluded from the normal file library and account export. They expire after 24 hours, become unavailable to normal file access then, and are physically removed by the scheduled cleanup. Leaving a temporary chat attempts earlier deletion; an offline browser or failed cleanup can delay physical removal. Request identifiers, usage and billing metadata are still retained; providers may retain their own copies under their policies. Read-aloud for temporary chats uses the browser's speech service, whose behaviour depends on your device and browser.
Account & privacy provides an account export, permanent deletion of all chats, and account deletion. The export includes all current saved text branches and answer versions and relevant account/usage/billing records, plus saved account instructions, memories, projects and exact file bindings, durable task records, document processing records, extracted sections and archive inventories, file-generation and execution records, permanent video requests and version relationships, and local drafts and pending saves from this browser when available. When saved files exist, the export is a ZIP containing account metadata, available original files and thumbnails, with a filename mapping. Files lost before Build 05 cannot be reconstructed. A file removed or changed during export causes an explicit failure instead of a silently incomplete download. Export pages are collected over the displayed export period; avoid edits while an export is running.
Individual deleted chats can be recovered for the period selected in account settings: 0, 7 or 30 days. The default is 30 days. Reducing this period also shortens recovery for chats already in Deleted. Increasing it does not extend an existing deletion deadline. Expired chats become inaccessible and are physically removed by the scheduled daily cleanup. A busy account or failed cleanup may delay physical removal; the expired content remains unavailable through normal history. Deleting a chat, including Delete all chats, removes its file references but keeps independently saved files in the file library. Deleting a file from the library removes access from every chat that uses it; those messages retain a deleted-file marker. File deletion and account deletion revoke related execution work, scrub private execution content, and remove document derivatives and inventories and remove original/versioned objects and thumbnails through a retried storage cleanup queue. Previously issued private links may remain usable for up to 60 seconds. Permanent delete-all and account deletion do not offer recovery. Backups may remain under the hosting provider's retention policy.
Account deletion requires explicit approval to cancel remaining Ereo subscriptions immediately and cancel pending payments where possible. Payments already processing must reach a known outcome before account removal. Unused message credits are removed with the account. Ereo confirms subscription closure and preserves minimal financial records before removing the sign-in account. It does not issue a refund as part of this process. The current financial-record retention period is shown in Account & privacy; the default deployment setting is 2,555 days. This is an operational setting, not a statement that one legal retention period applies in every country. The operator must configure the policy for the service's actual obligations before public customer onboarding.
The financial archive excludes saved chats, prompts, speech text, names and email addresses. Minimal account UUID and Stripe customer identifiers are retained as deletion markers so delayed work and billing events cannot recreate an account. Expired speech text is scrubbed by the daily cleanup while its usage records remain.
Workspace drafts, editing records and saved file versions are private account data. Confirmed drafts can reopen on another device. Published edits and restored copies create new versions so earlier downloads remain available. Workspace content follows its file, conversation, project and temporary-scope access and deletion rules, and permanent records are included in account export.
Unconfirmed changes may remain only in the open browser until saving succeeds. Static previews block scripts and external resources. Code runs only when you explicitly request execution; local JavaScript uses the isolated engine described above, and managed revisions follow the provider rules already described.
Original recordings, processing metadata, timestamped transcripts and sampled frames are private file data. Ereo shows the interval and samples inspected; sampled frames do not represent every moment. Supported original playback uses short-lived private URLs. A URL already issued may remain usable for up to 60 seconds after access is revoked.
When speech transcription is configured and you request it, the selected audio interval is sent to OpenAI. Claude receives the authorized transcript and selected image frames for your questions. Local media inspection does not send audio to a provider. Provider retention depends on the applicable account settings and policy; deleting Ereo data does not claim immediate provider erasure. Confirmed derivatives are reused where source permissions allow, and follow file, conversation, project, account-deletion and temporary-expiry rules. Permanent media records are included in account export.
When video generation is configured and you confirm a request, Google receives your prompt and, for image-to-video, normalized bytes from the exact selected private image version. Ereo stores generation settings, source references, progress and provider-operation identifiers so work can continue after the browser closes. Completed MP4 clips and poster images are copied into private Ereo storage. Deliberate variations preserve earlier versions. The provider model includes generated audio.
Before generation, Ereo shows one existing Deep allowance and an estimate of provider spending. That estimate is not an additional cash charge to you. Actual provider charges are separate and may remain unknown. Stopping prevents publication in Ereo but does not guarantee remote cancellation or a refund; an uncertain paid request is not automatically generated again.
Video content follows its exact source, parent version, conversation, branch, project, temporary-scope and account controls. Permanent video records are included in account export; temporary video is excluded and follows the existing 24-hour expiry and cleanup policy. Existing account controls require pending paid work to finish or be explicitly stopped before account removal. Revoked or expired content cannot obtain new private playback links, though an already-issued link may work for up to 60 seconds. Failed physical deletion remains queued for retry.
Ereo requests deletion of exact recorded provider files where Google's API supports it. Some generated-video and operation resources have no supported deletion or cancellation method in the chosen interface; those remain marked as awaiting provider retention rather than erased. Google states that generated videos are retained for two days, but Ereo cannot verify deletion merely because that period has elapsed. Provider logs and other retained records follow the provider's policy. A lost response may leave Ereo without the remote identifier. Minimal operation, outcome and cleanup identifiers may remain after account removal to handle late receipts and cleanup, without retaining the video prompt or reference image bytes.
When a verified executor is configured, approved browser destinations, fixed desktop operations, exact selected file versions and computer limits form part of a saved Agent responsibility. Public website reads and isolated UTF-8 text or CSV editing are the supported operations. Authenticated website automation, arbitrary desktop applications, terminal commands and consequential browser actions are unavailable. Browser or desktop content does not grant permission to access other accounts, sites or files.
Computer session metadata, command outcomes, costs, signed receipt metadata, bounded observations, private screenshots and saved outputs may be retained so you can inspect the work. Browser state retention is off by default. If you explicitly select retention, encrypted state may be restored only within its current authorized scope for the selected period, up to one day. Disconnecting revokes restoration and pauses the current run. Stopping the run and computer cancels the current run; it does not undo accepted actions or resolve uncertain charges.
Private public-page inspection is available only when the executor confirms that automation and capture have stopped and user control is exclusive. It opens a separate trusted surface using a short-lived one-use link. Viewer changes are discarded and are not fed back to Agent; returning control reloads the page from before inspection after fresh permission and session-generation checks. Authenticated website login, password or one-time-code entry, CAPTCHA flows and manual desktop control are unsupported in this release. Do not put credentials in Ereo chat. Idle and hard expiry terminate compute under the configured limits.
Safe session, command, artifact and bounded observation data are included in account export. Available screenshots and outputs use the ordinary private file controls. Takeover tickets, grants, transport credentials and encrypted session contents are excluded from export and model context. Encrypted transient outputs may remain available for recovery for up to fifteen minutes. Session deletion requests removal of retained observations, screenshots and restorable state; separately saved output files and conversations follow their own deletion controls. Account deletion and affected scope revocations prevent future access and queue executor cleanup. An unavailable executor can delay physical cleanup; minimal unresolved financial and anti-replay records may remain. A queued cleanup request is not proof that remote deletion has finished.
Personal chats, files and account memory remain private unless you deliberately select content for a team project or a reviewed share. A share is a fixed snapshot of the selected saved messages and exact file versions, not a live conversation. Unselected attachments, account memory, tool state and credentials are excluded. Recipients must sign in; a team-only link also requires current membership. Later source edits do not change the snapshot.
Revocation, expiry, account or source deletion stop new snapshot reads and download ranges. The authenticated share gateway checks again after reading each bounded range and does not redirect recipients to storage URLs. Copies already received cannot be recalled. Ordinary private and team file links may remain usable for up to 60 seconds after revocation; current access is required before a new link is issued.
The team creator owns the shared records and is the fixed payer. Chargeable team work starts disabled and requires that owner to enable bounded daily and monthly spending. Existing account allowances and service limits still apply; creating a team does not create a paid subscription. Owner, admin, member and viewer roles control administration, editing, reading and chargeable work. Work uses the selected team project context, not the payer’s personal memory. Connected accounts remain private except for sources and operations explicitly granted by their owner; consequential actions still require the recorded approval.
Removing a member or changing authority invalidates affected execution scopes while preserving files already saved for the team. Deleting a shared project or team removes its readable content and queues private file cleanup. Later actions and result publication are blocked; accepted external actions cannot be recalled, and incurred or uncertain costs remain recorded. Computer session restoration and human control remain bound to the initiating actor. Invitation links are created for a verified email address and are delivered by the inviting user; creation does not automatically send a message.
Account export includes current memberships, accessible shared records, permitted team activity and usage, and safe invitation and share metadata. Shared files owned by another team owner are represented by metadata; download their contents from the shared project while you have access. Secret links, invitation tokens, connector credentials, computer state and private execution grants are excluded. Delete all chats removes personal conversations and leaves shared team conversations in their projects. Deleting a member account removes membership and private data, while shared records owned by another team owner remain. Deleting the team owner account removes its owned teams and shared content. Links created by the deleted account are revoked. Minimal financial and anti-replay records follow the disclosed account-retention policy.
Use Account & privacy for supported export and deletion controls. The service operator must publish its verified legal identity, privacy contact and any jurisdiction-specific notices before public customer onboarding. This page describes the implemented behaviour; it does not invent an operator identity, contractual assurance or regulatory certification.