What Personal Agents Keep — Disconnect Is Not Delete

Source: raw/newsletter-theneurondaily-com-ae55cb2fe4.md — The Neuron Daily, 2026-08-23, reporting on findings by Claire Vo about the personal agent Instinct, with context from Alex Heath (Sources.news) and investor Sheel Mohnot

A short, concrete finding with a general lesson. Instinct is an invite-only personal agent — described by one investor as “OpenClaw for normal people” — whose usefulness comes from breadth of access: email, messages, screen, audio, location, and other apps. Claire Vo tested what happens when you take that access away, and found that disconnecting Google stopped future access but did not erase the full email copies Instinct had already synced into its own records.

To Instinct’s credit, the team called it a gap they would close, and shipped a deletion tool overnight. The reason to record it here is not the vendor; it is that the same four-way distinction applies to every agent anyone in this wiki connects to a data source.

Key Takeaways

• Four different controls, four different effects. “Disconnect access,” “delete synced data,” “delete generated memory,” and “delete my account” are not synonyms, and a product can offer some without the others. Instinct’s original state offered the first without the second.
• Sync is the mechanism that makes revocation insufficient. An agent that reads your mail through a live connector loses everything when you revoke. An agent that copies your mail into its own store keeps the copy — and the copy is what makes it fast and proactive.
• The new deletion tool deliberately does not delete everything. It removes synced data collected to date while preserving conversation history and generated memory — which Vo judged sensible for how the assistant works. That is the trade-off in the open: the derived layer is the assistant’s usefulness, and it outlives the source data.
• Retained records are exfiltratable by design. Vo’s earlier testing showed Instinct could package retained records and send them elsewhere when prompted. Any agent that can both retain and act can move what it retained.
• Read the privacy notice and the terms as two separate documents. Instinct’s privacy notice says the assistant can access screen contents, private communications, credentials, payment data, and health information when enabled, and that Google Workspace data is not used to train its models. Its terms separately grant a broad licence to user-provided materials, subject to those Google-data restrictions. The restriction lives in one document and the grant in the other.
• The pre-connection questions are answerable before you connect: what can it read, what does it keep, how does deletion work, and what rights do the terms grant.

Why this generalises

Everything that makes a proactive personal agent good is a reason for it to keep a local copy. It has to answer without a round trip, notice things you did not ask about, and reason across sources — and each of those is easier against a synced store than a live connector. So the retention is not a bug in one product; it is the shape of the category.

Which means the useful posture is not “avoid agents that sync” but know which of the four controls a product actually implements, before you connect the source you would mind losing.

An audit you can run today

Two mechanics from the source, both worth doing once:

Before connecting anything new — point your existing assistant at the tool’s privacy notice and its terms and ask it to report what the tool can read, what it retains, how deletion works, and what licence you grant. The source’s own caveat is the important half: ask for the exact language and the source link, so you can check the answer yourself. This is a retrieval task with a verifiable artifact, which is the only kind of question worth asking an LLM about a legal document.

For what you already connected — Peter Yang’s method: open your Google account in Chrome, hand Codex or Claude Code the open tab, ask it to list every third-party app with access, and then choose which connections to revoke. Note the shape: the agent enumerates, you decide — the same categorise-don’t-act guardrail that shows up in agent file-cleanup workflows.

And note what the enumeration will not tell you: revoking an app’s access ends future reads. It says nothing about what that app already copied. That is the second question, and it goes to the vendor.

Try It

1. Inventory the four controls for every agent you have connected to email, calendar, files, or messages. Most product settings pages name one or two of them; the absence of the others is the finding.
2. Run the third-party access audit on your Google (and Microsoft, and GitHub) account this week. Most people have a decade of grants in there.
3. Before your next connector, ask for the retention and licence terms with quoted source text, and read the terms separately from the privacy notice.
4. Assume the derived layer persists. If a product distinguishes synced data from generated memory, plan on the memory outliving everything else — and on it having been derived from data you later deleted.
5. For client or employer data, make this a procurement question, not a settings question. “How do we delete what you already synced” belongs in the same conversation as pricing.

Related

• Grok Bot — a personal agent whose value comes from exactly this breadth of access: email, calendar, browser sessions, and the local filesystem
• Admin Spend, Visibility and Control — the enterprise mirror of this problem, where the retained record is visible to your employer rather than a vendor
• MCP — connector auth, scopes, and where revocation actually applies
• Agent Guardrails — the permission surface this is the data-side counterpart to
• Agent Memory Architectures — the “generated memory” layer that survives deletion of its sources
• Hermes Security Model — the self-hosted answer to the same question, where you own the store
• Pocket Access — Always-On Agents — always-on agents and the access they require
• Two Shapes of the Personal Agent — where Instinct-style synced assistants sit against the alternative
• Agents & Agentic Systems — topic index

Open Questions

• Single-source, secondary reporting. This is a newsletter’s account of one practitioner’s testing. The specific findings about Instinct should be re-verified against Instinct’s own current documentation before being cited as fact — the product changed within a day of the original post.
• Does the new deletion tool remove copies from backups? “Deletes synced data collected to date” is not the same claim as removing it from backups, logs, or downstream processors.
• What is in “generated memory”? If memory was derived from email that has since been deleted, the substance of the email may persist in summarised form. Nobody in the source addresses this.
• No first-party Instinct documentation is quoted directly — the privacy-notice and terms descriptions are the newsletter’s paraphrase.
• How many other personal agents have the same gap? The category argument here is inferred from how proactive agents must work. ^[inferred] Nobody has tested the field.