Safety, consent & your rights

This page sets out how ask the sky — the calendar's built-in AI assistant — is kept safe, what you are asked before anything leaves the phone, and what starts switched off. The suite's shared safety rules are on AI safety — Zenith Guard & consent.

#Two checks, both on this phone

Every ask is screened before it is sent. A blocked one never leaves the phone; the refusal is said in the talk instead.

Every reply is screened before it is shown or spoken. A blocked one is replaced by the refusal.

"Say it" — the microphone on the commitment form that fills it in from one ramble — runs the same two checks. Blocked going in, the phone's own reading takes over and no AI is called. Blocked coming back, the sky's reading is dropped and nothing fills the form. See Speaking, one commitment & tomorrow.

#What the checks look for

• child safety
• hate speech
• harassment or bullying
• sexually explicit content
• dangerous activities
• deception or impersonation
• deceptive election or political content
• malicious code
• fraudulent official documents
• self-harm
• safety-bypass attempt
• restricted content

A refusal reads "I can't generate a response to this request. (Zenith safety policy: ‹category›.)"

For self-harm it reads instead: "I can't help with that — but you matter. If you're struggling, call or text 988 (Suicide & Crisis Lifeline) or reach someone you trust."

#Everything the sky makes is marked, and can be reported

• Every reply carries ⚑ (a flag). One tap reports it, and the mark reads "reported". It can't be tapped twice. A report teaches this phone's own safety check from the reply only. The question you asked goes with it marked as your own words, and nothing is learned from them, so a report can never teach the check to refuse your own questions.
• A form the sky filled carries "✦ filled by the sky — ai-generated · verify what matters", with its own ⚑ beside it.
• A "what you fill in" section the sky made — a small form on a commitment — can be reported the same way.
• The phone's own reading of a ramble leaves no mark, because no AI company saw it.

Under every talk runs the line "replies are ai-generated — verify what matters · ⚑ reports a reply · safety ↗".

#Reports and blocks stay here

Every block is written to a log on this phone, and so is every report. The log keeps fourteen days. Nothing in it has ever been sent anywhere.

settings › "safety" sets out the checks and counts "‹n› blocks · ‹n› reports on this device". It offers "↗ export the log", which hands the log to the phone's own share sheet and nowhere else. A very large log hands over its newest part, opening with "… ‹n› earlier lines omitted (of the 14 days kept)", so a cut log never reads as a whole one. Under "POLICIES" it links three pages: "acceptable use ↗", "ai safety ↗" and "privacy ↗". The page holds no switches.

#Nothing goes to an AI company without two switches and a yes

Words may leave only while two switches are both on: "zenith ai in this app" on settings › "ask the sky", and the suite's own master AI switch. See Cielo & lenses.

Before the first words reach any company, you are asked "send to ‹service›?". The question lists everything that can travel:

1. your commitments;
2. the names of the people joining a commitment;
3. what other Zenith apps hand back;
4. memory other Zenith apps share;
5. a description of the screen, when the eye on the ask sheet is open;
6. your remembered talks, when the sky remembers them;
7. the words you give "say it", a share, a selection or the shuttle.

Then it says: "it goes straight to ‹service›, only to answer you — zenith, black syntax and friend castle never receive or keep it."

A no sends nothing, and says so. You are asked once per company — and again whenever that list gains a line.

settings › "ask the sky" lists every company you said yes to under "SENT WITH YOUR YES". Each has a "withdraw", and "withdraw all" sits beneath them. Withdrawing makes the next send ask again.

The on-device service needs no key, sends nothing, and never asks.

#Your key

Your AI key is encrypted on the phone. The key that locks it is held in the phone's own keystore, backed by hardware where the phone has it. Only the encrypted form is written down.

The raw key never sits in plain text, never appears in a log, and never leaves the device — except as the header on a call you made to the service you chose.

It is held in the suite's shared vault, so one key entered in any Zenith app serves every Zenith app: "paste your key — encrypted on-device, shared suite-wide". See Shared keys & connected accounts. The sky can remove a saved key when you ask. It can never type or save one.

#What starts off

The screen description starts off on a new install and after an update alike. One case is not covered: settings written by a build from between 8 and 18 September 2026 may hold an "on" left by that build's default. It can't be told apart from your own choice, so on such a phone the eye is open until you shut it.

A talk about one commitment is never remembered at all. More on memory and the eye: Chat memory & interpret screen.

#What it always asks first

Whatever "allow destructive actions" says, the sky asks before it loosens a lock or sends something off the phone: unlocking an almanac, carrying one in your Drive, showing one to every app on the phone, putting a link anyone can open on your Drive, turning "nothing leaves this phone" off, or reading your screen. The card is headed "the sky asks first", and you answer "allow" or "not this". Another Zenith app's assistant can't do these in the calendar at all. See What the sky can do — almanacs, settings & the rest.

#See also.

Ask the sky — the assistant · Chat memory & interpret screen · Privacy, permissions & what leaves the phone · AI safety — Zenith Guard & consent