Shoulder Help CenterShoulder can watch you pay bills, log into portals, and handle personal information — so its privacy posture isn’t a footnote, it’s the reason it’s safe to use for that in the first place.
The short version
Only the video extraction step touches the cloud. Project storage, search, and chat are all designed to run on-device. That’s what makes the “erase everything” option total — there’s no server copy of your projects to chase down.
What touches the cloud
When you stop a recording, it’s sent to the Shoulder relay so a cloud model (Gemini Flash) can extract information from it against your project’s goal. The relay discards the raw recording once extraction is complete — it isn’t retained.
Current build note: in the shipped TestFlight build, project chat also runs through the relay rather than fully on-device — the on-device chat pipeline is in progress. This page will update as that changes.
What stays on your device
- Your project list, goals, and extractions are stored locally, not synced to a Shoulder server.
- Search across your projects runs on-device.
- The on-device knowledge base (RAG) that answers your questions is built and queried locally, per project.
How your data is protected on your phone
Everything Shoulder stores on your device is encrypted using your phone’s own security — the same protection that covers your photos and messages. While your phone is locked, that data can’t be read, even with physical access to the device. There’s no separate Shoulder password to set up; it rides on your existing passcode or Face ID.
Viewing a raw recording (not just what Shoulder extracted from it) asks for an extra check — Face ID or your passcode again, even if your phone is already unlocked. That confirmation covers the rest of your session; leave the app and come back, and it asks again. There isn’t yet a setting to lock the whole app behind Face ID the moment you open it — that’s planned, not shipped.
Erasing everything
Because extractions and chat history live on your device rather than a server, deleting a project — or using the app-wide “erase everything” option in Settings — actually removes it. There’s no cloud copy to separately request deletion of.
What Shoulder will never do
Shoulder thinks like an agent — it actively watches, analyzes, and reasons about what matters toward your goal — but it doesn’t act like one. It never takes actions on your behalf: no logging into a site for you, no submitting forms, no moving money. That’s the precise distinction that makes it safe to point at things that matter — it can’t break anything, because it never acts for you. It’s doing real work the whole time; it just never clicks, types, or submits anything on your behalf. You stay the one driving; Shoulder rides along, analyzes, and remembers.