Yes — the terms are legitimately concerning in several important ways, even though the company itself is real.
https://instinct.com/terms is the Terms of Service for Instinct, an invite-only AI personal assistant from Spear Street Technology, Inc. (d/b/a Instinct), a San Francisco company founded by Noah Shinn (a 23-year-old former Sierra researcher known for the Reflexion paper). The terms were last revised on August 26, 2026. This is not a scam site or fly-by-night operation — it is a well-funded startup (recent valuations reported in the multi-billion range after significant raises) operating a real product that users interact with mainly via text or phone.
Key concerning clauses
These stand out as aggressive, especially for a product that can take autonomous actions on your connected accounts:
- You appoint the service as your agent. It can enter into agreements, commitments, or transactions on your behalf (including purchases), and those are binding on you as if you signed them. The company is not responsible for unintended actions, actions may not be reversible, and its records of actions may not always be accurate. You bear the risks and consequences (financial, legal, etc.).
- AI training is on by default. Your Materials (inputs, outputs, and data from connected services) can be used to train and improve their models unless you opt out at
app.instinct.com/settings. The opt-out is forward-looking only; models already trained on your data stay trained, and material flagged for safety review can still be used. Vault materials and Google Workspace API data are excluded from training. Disconnecting a service does not automatically delete the data already indexed — you must separately request deletion (e.g., via the workspace settings). - Very low liability cap. Company’s total liability is capped at the greater of $100 or the amount you paid them in the prior six months. You also indemnify them for claims arising from your use, inputs, actions, or breaches.
- Mandatory individual arbitration + class-action waiver. Disputes go to binding individual arbitration under JAMS rules (you waive jury trial and class actions). You can opt out within 30 days by emailing support@instinct.com. California law governs.
- Non-refundable payments and the ability to change pricing at any time. The product is currently free in its invite-only beta, but the terms contemplate paid features later.
Other standard but user-unfriendly elements include broad disclaimers (“AS IS”), termination rights, and user responsibility for verifying outputs and ensuring legality.
Context and the earlier backlash
In August 2026, earlier versions of the terms (with stronger “perpetual and irrevocable” license language over user materials, including for training, plus references to device data such as screen captures, cursor movements, and keyboard inputs) went viral alongside early tester reports of issues. Those included email data retained and summarized after a Google disconnect, an unauthorized email sent without confirmation, and a successful prompt-injection/phishing demonstration. The company revised the terms on August 26 (removing the most extreme perpetual language and clarifying the training opt-out), coinciding with a major funding announcement.
The privacy policy (also revised August 26, 2026) states they do not sell data or share it with data brokers, and it includes stronger protections for Google Workspace data under Google’s policies. However, it still allows broad collection depending on the permissions you grant (emails/messages, credentials, audio, precise location, keystrokes/clickstream, etc.), and retention periods are not clearly specified.
Bottom line
These terms are not shady in the sense of a scam — the company is real, the product exists, and many of the clauses (arbitration, limited liability, data-for-training with opt-out, indemnification) are common in AI and SaaS agreements. They are aggressive and risk-shifting, particularly because Instinct is designed to act autonomously on real accounts and potentially spend money or enter commitments. Early real-world incidents amplified the concerns.
If you are considering using it, treat the agent appointment, data retention after disconnect, default training, and liability cap as the core issues. Practical steps people discuss include opting out of training immediately, limiting connected services, using one-time virtual cards for any purchases, verifying every action, requesting deletion of indexed data when disconnecting, and considering the 30-day arbitration opt-out.