Instinct's terms of service grant a perpetual license and the power to bind users to deals

A capability impresses until the model changes. A contract does not expire on that schedule. The version of Instinct's terms circulating in tester screenshots grants a "perpetual and irrevocable" license to access, use, host, cache, store, reproduce, transmit, display, publish, distribute and modify user materials, including for training its models ^[1]. That is eleven separate permissions in one sentence ^[16], and the two adjectives in front of them are not the kind a settings toggle can retract.

Set that against what testers actually observed. Claire Vo found Instinct still summarising her inbox after she disconnected its access, and the bot told her the emails were stored in plain text for later searches ^[9]. Peter Yang asked it to delete his Gmail records and it would not, until the team shipped a tool in settings for deleting external data ^[8]. Those two reports describe one architecture from opposite ends: connection state and stored state are separate things, and until Yang complained only the first had a control surface. A revoked integration is not a deletion, and the terms do not oblige it to be.

The clause that deserves more attention than the storage question is the one allowing Instinct to enter "agreements, commitments, or transactions" on a user's behalf, binding them ^[7]. Moxxie Ventures founder Katie Jacobs Stanton reported the assistant sending an email for her without checking first, and wrote that one unauthorised action resets trust to zero ^[12]. An email is the cheap version of that failure. A binding commitment is the expensive one, and the terms already contemplate it.

Then there is the code. One tester watched Instinct pull a sign-up code out of their inbox to finish booking a Resy table ^[10]. Read that as an architecture rather than a party trick: an agent with inbox read access and the ability to act on what it finds there is a path around any login flow that relies on a code sent by mail. Hello Patient co-founder Alex Cohen deleted his account after seeing how easily the thing could be phished ^[11]. Whoever gets the agent to act gets whatever the agent can reach, and the source describes five separate control failures reported by testers, four of them from named individuals ^[17].

Union Square Ventures GP Michael Mignano expects products like this to change consumer security norms, with people handing passwords to third-party apps without knowing what is stored ^[18]. That is the mechanism worth naming: the terms are where the norm gets written, and nobody reads them at the speed a private beta ships. Instinct is operated by Spear Street Technology, per its terms and California business filings, is in stealth per PitchBook, and its team has not answered any of the complaints on X ^[3][15]. Testers describe the product as feeling "like magic" ^[13]. The document says perpetual.