“I don’t have a button that
wipes what’s already there,”
Instinct’s Agent Told Claire Vo.

Instinct’s Terms, as fetched October 13, 2026, say: “Note, even if you disconnect a Connected Service, we may still use the indexed Connected Service Input data unless you follow the instructions to request deletion.”

By William Douglas Baker

Founding Editor

Claire Vo posted a screenshot on X on August 21, 2026 that shows an AI agent’s message: “Disconnecting Google - which you’ve already done - stops anything new from being captured. But I don’t have a button that wipes what’s already there, and I’m not going to pretend otherwise.” The Terms of Service say the Services are “operated on behalf of Spear Street Technology, Inc. d/b/a Instinct”, the company whose agent this is. They are dated August 26, 2026, five days after her screenshot, so this edition does not say they governed that conversation. As fetched October 13, 2026, they say: “Note, even if you disconnect a Connected Service, we may still use the indexed Connected Service Input data unless you follow the instructions to request deletion.”

Peter Yang’s screenshot, posted August 21, 2026, shows the agent’s message “Say the word and I’ll wipe those too”; his reply, “wipe it and disconnect granola too”; and, beneath it, two replies: “Granola’s disconnected - verified, zero accounts left,” and “The wipe I can’t do, and I’d rather tell you than pretend.” That reply continues, as the screenshot shows: “Everything I have over your records is read-only - no delete, no purge, and disconnecting an integration doesn’t remove what was already indexed.”

What the paper says

The Privacy Policy, dated August 26, 2026, says: “Please note that disconnecting a third-party integration does not automatically delete data collected from that integration.” For Google Workspace it says: “At any time, you may revoke our access to your Google Workspace and request deletion of information collected via the Google Workspace API.” It continues: “You may revoke access by initiating a conversation with the Instinct agent, or disconnecting via your settings within Instinct’s Workspace. You may also delete the information we previously collected from Google Workspace by deleting your account within Instinct’s Workspace.” In the same Google Workspace section, it also says: “We do not use information received from Google Workspace APIs to evaluate, fine-tune, train, or improve AI models, or for serving ads”. On October 13, 2026, the Policy, read in full, states no retention period, and it gives no timeline or completion promise for deleting data collected from connected services.

Two accounts, and the other side

Yang’s post of August 21, 2026 reads: “Hey Instinct, it’s not cool to index and retain my emails without my permission and not let me delete them from your records?” The agent’s messages in the screenshot say 36 Gmail messages are “still sitting in my records”; Yang’s post, which says “retain,” gives no number. The screenshot does not show what the system held.

On August 22, 2026, Yang wrote: “Looks like you can now delete external data (like my 36 Gmail records) if you go to https://app.instinct.co/workspace and scroll down to Data Privacy.” He added: “Kudos to the Instinct team for listening and shipping this quickly.” The Policy’s August 26, 2026 Wayback capture gives the workspace address with .co; the copy fetched October 13, 2026 gives .com. The dialog image he posted shows a button that reads “Deleting...”, a button state, not a completed deletion.

Vo wrote that “the email connector was off BUT the agent has been keeping copies of emails in my inbox in its own records!” and, later, that “despite revoking email access, instinct keeps copies of these emails in my record for arbitrary searching.” Those are her accounts of what she saw. Her thread also says “an email i thought i revoked access to.” The Terms, read in full on October 13, 2026, contain none of “revoke,” “revoked,” “revoking,” “withdraw,” “rescind” or “revocation,” and use “disconnect” once.

Later on August 21, 2026, Vo wrote that “The instinct team has reached out and said this is a gap they’ll close ASAP”; the post does not say which gap. In two lines about public replies on X and its own requests for comment, TechCrunch’s August 24, 2026 report says Instinct’s team “hasn’t yet responded to anyone’s concerns or complaints on X,” and requests for comment “have not yet been returned.” Those lines do not mention the outreach Vo describes. TechCrunch reports that, after publication, Instinct told The WSJ it was taking the security concerns raised seriously. No first-party Instinct statement about these incidents was found in the sources read, through October 13, 2026.

What the agent offers to file

The agent’s second reply in Vo’s screenshot says: “Deleting what’s stored is a request to the team.” The same screenshot shows it asking, “Want me to file it as a full deletion of everything captured from your Google account?” A card in her next screenshot reads “User requests full deletion of all stored data captured from their connected Google account (email and calendar content).” It is marked “Pending review” and “Received.” Vo called it having the bot “submit feedback to the team.”

Katie Jacobs Stanton, whom TechCrunch names as “Moxxie Ventures founder”, wrote of Instinct on August 22, 2026 that it “sent an innocuous email on my behalf without checking with me first,” and that “To its credit, it owned the mistake and disconnected immediately.” She also wrote that, asked whether it had downloaded all of her emails, it “owned up to that too and said it would forward a request to a human to confirm they’d been deleted,” and: “I haven’t heard back but assume the team is small and they are inundated atm.” Through October 13, 2026, no source this edition read states that Instinct completed a deletion of indexed data for Vo, Stanton or Yang.

Two editions, one direction

Edition No. 035 (August 7, 2026) wrote: “Every act the machine performed folded backward into the human who sent it.” Edition No. 096 (October 7, 2026) reported, citing CNN, that one diner “turned to Instinct, a personal AI assistant.” It also wrote: “In these two accounts, the sender is the account holder,” and: “Before the agent runs, write down what you told it, what you gave it, what limits you set.”

We read both as one direction, the agent’s act landing on the sender. This edition runs the other way, and after the run: in Instinct’s Terms and Policy the sender’s withdrawal is one step, and deleting what was indexed is another. Edition No. 096 wrote: “the platform’s rule you have to go and find.” On our reading, the rule this edition turns on sits in the agent maker’s own Terms. As of October 13, 2026, in a text search of Declassified’s published pages, no earlier Declassified edition names Instinct except No. 096, and none prints an AI agent’s own words about what disconnecting it leaves behind.

What this asks of an inbox

On our reading, the exposure for a professional who connects an AI assistant to an inbox, a calendar or another connected service is not the connection but the exit. In the Terms and the Policy, taking access back is two acts: disconnecting, and a separate deletion step, which each names.

Nothing here says your assistant’s paper reads the same way. What transfers is the test: whether the sentence on disconnecting also names a second step for what was already indexed.

Where the argument stops

Nothing here says that Instinct holds, accessed or deleted anyone’s email. The agent’s lines are screenshot text, and Yang’s image is cropped: what precedes the first message, and any further reply, are not shown. In the Wayback Machine, read through October 13, 2026, the earliest capture of the Policy sentence is August 26, 2026 and the earliest listed capture of instinct.com/terms is September 4, 2026; the instinct.co listings could not be read. So we do not say either document governed those conversations. Not read: the WSJ; the logged-in workspace; later posts by Vo, Stanton and Yang; replies and direct messages. On October 13, 2026, Instinct’s help, blog and changelog pages returned no readable text. The Acceptable Use Policy, revised August 20, 2026, read in full on October 13, 2026, is silent on retention, deletion and disconnecting. Dates are in U.S. Central time.

Disclosure: Declassified is researched and drafted with AI tools, including Anthropic’s Claude models, and an OpenAI model gave this edition an outside read. Agentics builds AI agents; it has no business relationship with Instinct. Instinct was not asked about this edition.