# Security and privacy

> Who sees your chats, where your connections' passwords and tokens go, what reaches the model, and what share links expose.

Source: https://www.dearjune.ai/docs/security-and-privacy

This page answers what you would ask before letting June into your mail,
files and code: who can see what, where your sign-ins are kept, and what
leaves June. The [privacy policy](/privacy) is the legal text and names every
service provider.

## Your account

You sign in on June's sign-in page; June never stores your password. There
is no button to delete your account yet: see
[your data](#your-data) below.

## Who sees your chats

- **Your own chats** are yours. Other people, including your
  organizations' members, do not see them.
- **An organization's chats and projects** are visible to every member of
  that organization. The exception is Slack: a direct message with June,
  and a thread in a private Slack channel, are seen only by the people in
  them. Leave the organization and you stop seeing its chats.
- **A share link** makes one conversation readable by anyone who has the
  link (see below).

Images attached to a chat load directly from June's file storage in your
browser. The preview keeps the file's existing access permissions.

## Your connections

When you connect a tool on the **Integrations** page, its password or token
is stored encrypted on June's servers.

- The code June runs never sees it. For GitHub and ownCloud,
  [June's sandbox](/docs/how-june-works/sandbox) holds no password or token at all: your sign-in is added to its requests
  to that service on the way out.
- The one exception is Tailscale. June's sandbox joins your tailnet as one
  of your devices, so it holds that device's key while it runs
  ([Tailscale](/docs/integrations/tailscale)).
- June reaches only what the account you connected reaches, within the
  permissions you granted. Each [integration's page](/docs/integrations)
  says what June may read and change.
- Changes through a connection or in June’s sandbox ask by default on a
  card in the chat, on the web, in the app or in Slack. Review what will
  change and which account it uses. Approval runs that exact change once;
  reads never ask. Only the person whose account the change would use can
  approve it, on the card or on its own approval page, which no other site
  can embed. You may allow changes for one chat or permanently, so later
  changes covered by that permission run without another card. Review and
  revoke permanent permissions in **Settings → Approvals**
  ([Approvals](/docs/settings/approvals)); chat permissions live in the
  chat’s menu. An organization can still require approval or block changes
  on its own connections.
- A connection from your **Integrations** page works in your private chats
  and every organization you're in unless you mark it **Personal only**;
  one made inside an organization stays there
  ([personal or organization](/docs/integrations#personal-or-organization)).
  In a shared thread, June uses the connections of the person it is
  answering ([whose sign-in June uses](/docs/how-june-works/connections)).
- **Disconnect** on a connection's row removes it, and June stops using it
  at once. Some providers also list June as an app with access to your
  account; remove it there too if you want the provider to forget the grant.

## What reaches the model

To answer, June sends the conversation and the context it needs (memories,
files you attached, results from your tools) to the model that runs the
reply, only to produce that reply:

- your ChatGPT plan, if you connected it: OpenAI;
- your Claude plan, if you connected it: Anthropic;
- an API key you or your organization added: that key's provider;
- otherwise June's default model, currently an OpenAI model.

An organization can set one
[funding source](/docs/organizations/funding) that pays for every turn in it;
then that source's provider gets the organization's conversations.
[Models and who pays](/docs/models) says which model runs a reply.

## Share links

A share link is a public, read-only copy of one conversation: anyone with the
link can read it, and the files and images in it unless you switch them off.
June's tool steps and reasoning are left out, shared pages are kept out of
search engines, and deleting the link ends access at once.
[Share a conversation](/docs/chat/sharing) covers frozen and live links,
attachments and deleting a link.

## Memory

June remembers facts, preferences and decisions from your conversations so
you do not repeat yourself. The **Memory** page lists what it saved. Forget
a memory there and June stops recalling it; the memory's history is kept,
but it does not come back on its own. In an organization's chats and in Slack
channels June uses that chat's own memory, never your personal one, and keeps
personal facts out of it. Your personal memory and Soul are yours alone; a
memory saved in an organization's project shows to everyone in the
organization. See [Memory](/docs/memory) and
[shared chats](/docs/memory/how-memory-works#shared-chats).

## Analytics

June uses product analytics and error reports to find what breaks, hosted in
the EU. Native session recording is disabled in the mobile app. On the web,
session recordings mask everything you type and leave out chat content and
attachments.

## Your data

Your account, conversations, attachments and the encrypted sign-ins of your
connections are stored with the hosting providers the
[privacy policy](/privacy) names. June uses them to run the service, answer
your support requests, keep the service secure and make it more reliable.

June keeps your data as long as it needs it to run your account, unless the
law requires it to keep some longer. To have your account and its data
deleted, use the contact in the [privacy policy](/privacy).