garth.fm

Privacy Notice

Effective Date: 5 May 2026

Version: 1.3

This Privacy Notice explains what personal data we collect when you use garth.fm, how we use it, and what your rights are.

Please read this alongside our Terms of Service.

1. Who We Are

garth.fm is operated by Burleywhag Limited, a company registered in England and Wales under company number 17077813, with its registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ.

Burleywhag Limited is the data controller for the personal data we process about you.

We are registered with the UK Information Commissioner's Office (ICO) under registration number ZC125602.

Privacy queries: privacy@garth.fm

General queries: garth@garth.fm

2. How You Can Provide Data to garth.fm

You can contribute your AI chat history to garth.fm in two ways:

  • Manual upload. You request a data export from your AI service (for example, ChatGPT's "Export data" feature in account settings), download the resulting file, and upload it to garth.fm.
  • Browser extension. You install our official garth.fm Chrome extension, which acts as a data portability tool. While you are signed in to ChatGPT in your browser as normal, you can click "Sync" in the extension to fetch your conversations directly from ChatGPT and share them with garth.fm. This achieves the same outcome as ChatGPT's manual data export, but quickly and on demand.

Both methods feed into the same processing pipeline and are subject to the same protections in this Notice. You can use one or both. The browser extension is optional.

garth.fm is independent. We have no partnership, affiliation, or endorsement relationship with OpenAI or any other AI service provider. When you share data with us, you are exercising your own right to access your own data. You are responsible for making sure that doing so does not breach your agreement with the AI service provider.

3. The Data We Collect

  • Account data: your email address, your username, a hashed password (or your authentication via Google), the country and region you tell us you live in, and your date of birth (month and year).
  • Chat data (manual upload or extension): the conversations you share with us through either method described in Section 2. This is processed in accordance with Section 4 below and most of it is deleted shortly after processing.
  • Derived data: classification labels, message timestamps, model identifiers, and counts that we generate by running automated classifiers over your conversations. From these we calculate your persona, stats, and footprint.
  • Technical data: IP address (used during your session and to derive your country), device and browser information, and basic usage analytics.
  • Communications: any emails you send us.

4. What We Don't Store

We are designed around the principle of "classify, then delete". We do not keep:

  • the raw text of your messages;
  • conversation titles;
  • URLs from your conversations;
  • the responses generated by the AI service;
  • your login credentials for any AI service;
  • account data from inside your chat data (such as your AI service email or phone number).

These items are processed in memory or held briefly during classification (typically up to 72 hours) and then permanently deleted. The same retention applies whether you contribute data through manual upload or the extension.

If your chat data includes incidental mentions of other people (for example, the names of colleagues or family members), those identifiers are automatically removed during PII scrubbing and are not retained.

5. The garth.fm Browser Extension

This section explains exactly what the extension does, what it can access, and what it stores on your computer. If you do not use the extension, this section does not apply to you.

5.1 What the extension does

When you click "Sync", the extension uses your existing logged-in ChatGPT session in your browser to fetch your conversation history from ChatGPT and send it to garth.fm for processing. It does this by making three types of request to ChatGPT:

  • a request to read your current ChatGPT session token (so it can authenticate the next two requests on your behalf);
  • a request to list your conversations;
  • a request to fetch the contents of each conversation you have not already shared.

The extension then sends each conversation to garth.fm, where it goes through the same "classify, then delete" pipeline described in Section 4.

In effect, the extension is a data portability tool: it lets you exercise your right to access your own data faster than waiting for ChatGPT's manual export. The data the extension reads is the same data you would receive if you used that manual export.

5.2 What the extension does not do

To be clear, the extension does not:

  • read or transmit anything from ChatGPT pages other than your conversation history (it does not read your custom instructions, ChatGPT "Memory" contents, account email or name, plan or billing information, settings, or anything shown on screen);
  • modify the ChatGPT site or change how it works for you;
  • monitor what you type, log keystrokes, or watch your activity on other tabs or websites;
  • collect telemetry, error reports, browser fingerprints, or installation identifiers;
  • send your data anywhere other than garth.fm.

5.3 What the extension is permitted to access

To work, the extension needs Chrome's permission to operate on two websites:

  • garth.fm — narrowed to the specific URLs the extension uses to send data to your account, and nothing more.
  • chatgpt.com — granted broadly. This is so the extension can detect when you are on chatgpt.com and show the "You have new conversations to sync" badge on its icon. Without this broader access, the badge would not work.

The extension's code only uses its chatgpt.com access to perform the three types of request described in Section 5.1. We commit, through this Notice, not to expand what the extension reads, sends, or stores without first updating this Notice and notifying you.

5.4 What the extension stores on your computer

The extension uses Chrome's extension storage to keep a small amount of data locally on your device:

  • an authentication token that links your browser to your garth.fm account, and the token's expiry date;
  • the date and time your last sync completed;
  • the progress and status of your current or most recent sync (for example, "50 of 200 conversations done");
  • a count of any errors during the most recent sync;
  • a list of conversation IDs queued for syncing, so an interrupted sync can resume without starting over.

The extension never stores conversation content on your computer. Conversations are fetched from ChatGPT and sent to garth.fm in a single step, then discarded from local memory.

Clicking "Disconnect" in the extension popup, or removing the extension from Chrome, deletes all of this local data.

5.5 Your right to use the extension

Most jurisdictions, including the UK and EU under Article 20 of the GDPR, give you a right to access your own personal data and move it to another service. The extension is designed to help you exercise that right efficiently. By installing and using the extension, you confirm that you have the right to access your own ChatGPT data this way and that doing so does not breach your agreement with OpenAI or anyone else.

6. Sensitive Information in Your Chats

People often discuss sensitive topics with AI services, including health, religion, political views, sex life, and similar matters. This kind of information is "special category data" under UK and EU data protection law and needs special handling.

When you share chat data with us — whether through manual upload or the extension — we may temporarily process special category data while we classify it. This data is:

  • never read by a human;
  • never stored in its raw form;
  • deleted shortly after classification.

We rely on your explicit consent (Article 9(2)(a) UK GDPR / EU GDPR) to do this. You give that consent when you tick the relevant box at signup. That consent covers any way you share chat data with us, including through the extension. You can withdraw your consent at any time by deleting your account, after which we will not process any new uploads or syncs from you.

If you do not want us to process special category data, you should not use garth.fm.

7. How We Use Your Data

  • To create and run your account.
  • To analyse your chat data and produce your persona, stats, footprint, and shareable cards.
  • To create anonymised aggregate datasets (see Section 8).
  • To send you essential service emails (such as confirming your account or notifying you that your results are ready).
  • To improve and secure the Service.
  • To detect fraud, abuse, and misuse.
  • To comply with our legal obligations.

8. Anonymised and Aggregated Data

We combine the classification labels from many users to produce anonymised aggregate datasets — for example, statistics about how different demographic groups use AI. These datasets do not contain anything that identifies you, alone or in combination with other available information. Once data is anonymised in this way, it is no longer considered personal data under UK or EU data protection law.

We may share these anonymised aggregate datasets with commercial and research partners. This is part of how we fund garth.fm. We never share your raw messages, your account information, or anything that identifies you.

This is a core part of the Service and is not something you can opt out of while continuing to use garth.fm.

9. Legal Bases (UK/EU GDPR)

  • Your consent (Article 6(1)(a) UK GDPR / EU GDPR) for processing your chat data and producing your persona, stats, and footprint, and for creating anonymised aggregate datasets from your contribution. You can withdraw consent at any time by deleting your account.
  • Your explicit consent (Article 9(2)(a)) for processing any special category data contained in your chats, as described in Section 6.
  • Performance of a contract (Article 6(1)(b)) for running your account and providing the Service to you.
  • Our legitimate interests (Article 6(1)(f)) for keeping the Service secure, preventing fraud and abuse, and improving the Service. We have considered whether these interests are overridden by your interests and rights, and we believe the processing is proportionate and expected.
  • Legal obligation (Article 6(1)(c)) where we have to process data to comply with UK or EU law.

For users in California, please see Section 14.

10. Who We Share Data With

We share personal data with the following service providers, who act as our processors and are bound by contracts that require them to protect your data:

  • Anthropic — AI classifier API. Receives de-identified, PII-scrubbed text only.
  • Vercel — hosting.
  • Supabase — database and authentication.
  • Resend — transactional email.
  • Google — authentication, if you choose to sign in with Google.

We may also share data:

  • with authorities, where we are legally required to disclose it (for example, in response to a valid court order);
  • with a successor entity, if we sell or restructure our business. We will let you know if this happens.

We share anonymised aggregate datasets with commercial and research partners, as described in Section 8. These are not personal data and they cannot be used to identify you.

We do not sell your personal data.

If we add, remove, or replace any of the service providers listed above, or change the categories of partner we share anonymised data with, we will update this Notice. If the change is material, we will also notify you by email or through the Service before it takes effect.

11. International Transfers

Some of our service providers are based outside the UK and the European Economic Area (EEA), including in the United States. Where we transfer your personal data outside the UK or EEA, we use legally recognised safeguards — typically the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or equivalent mechanisms.

12. How Long We Keep Your Data

  • Raw chat data (manual upload or extension): processed and deleted within 72 hours of being received.
  • Account data and derived data (labels, persona, stats, footprint): kept while your account is active. Deleted within 30 days after you delete your account.
  • Anonymised aggregate data: kept indefinitely. This is not personal data and cannot be linked back to you.
  • Communications and service records: kept for up to 6 years to allow us to respond to disputes and meet legal obligations.
  • Extension local data: kept on your device until you click Disconnect or remove the extension. Not held on our servers.

13. Your Rights

Under UK and EU data protection law you have the right to:

  • access the personal data we hold about you;
  • ask us to correct inaccurate data;
  • ask us to delete your personal data;
  • ask us to restrict or object to certain processing;
  • ask for a copy of your data in a portable format;
  • withdraw your consent at any time (this does not affect the lawfulness of processing before withdrawal).

You can exercise most of these rights from your account settings. For anything else, email privacy@garth.fm. We will respond within one month.

If you withdraw your consent, we will stop processing your data going forward and delete your account-linked data within 30 days. We cannot remove your contribution from anonymised aggregate datasets that have already been produced, because they cannot be linked back to you.

You can stop the extension from sending any further data to garth.fm at any time by clicking Disconnect in the extension popup or by removing the extension from Chrome. This is independent of your garth.fm account — your account remains active unless you also delete it.

You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk, or to your local data protection authority if you are in the EEA.

14. Notice for California Residents

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), including the right to know, delete, correct, and limit the use of certain information.

We do not sell your personal information for money. We only share anonymised aggregate data with commercial partners, which is not "personal information" under California law because it cannot be linked back to you.

To exercise your California rights, email privacy@garth.fm.

15. Cookies and Analytics

We use a small number of cookies to keep you signed in and to measure how the Service is used. We use privacy-respecting analytics that do not use cookies for tracking and do not collect personal data beyond aggregate usage statistics.

16. Children

The Service is not for anyone under 18. We confirm your age by self-attestation when you create your account: you must confirm you are 18 or over before you can sign up. We do not collect documentary proof of age. If we are made aware, or otherwise discover, that we have collected data from someone under 18, we will delete it promptly and close the account.

17. Changes to This Notice

We may update this Notice from time to time. If we make material changes, we will tell you by email or through the Service before they take effect. The "Effective Date" at the top shows when the current version was published.