Privacy Policy

1. Introduction

Welcome to Buddy AI Note. We respect your privacy and are committed to protecting your personal data. This privacy policy explains how we collect, use, and safeguard your information when you use our calendar application and AI-powered recommendation services.

2. Information We Collect

2.1 Authentication Information

• Email address (obtained through Google or Microsoft OAuth)
• Account profile information (name and profile picture)
• OAuth access and refresh tokens for the accounts you connect. Unlike session-only credentials, these are stored encrypted so Buddy can keep working — for example, preparing email drafts — while you are away. See Section 5 for how they are protected, and Section 6 to disconnect.

2.2 Connected Account Data (Email, Calendar, Drive)

Connecting an account is optional, and each service is separate. When you connect one, we access:

• Email (Gmail / Outlook): your messages, so Buddy can find what needs a reply, prepare drafts, and apply Buddy's labels. Buddy prepares drafts but never sends an email without your explicit approval.
• Calendar (Google / Outlook): your events, so Buddy can show your agenda and create or change the events you approve.
• Google Drive (optional): read-only access, used only for files you explicitly bring into Buddy.

Note: The exact OAuth scopes we request for each provider, and the reason for each, are listed on our Security page.

2.3 Images and Photos

You can optionally upload or capture photos to share with Buddy AI for enhanced event planning assistance. This includes:

• Photos uploaded through the web app file picker
• Photos captured using the mobile app camera
• Images selected from your device's photo library (mobile)
• Image metadata (dimensions, format, timestamps)

Note: Image uploads are completely optional. On mobile, camera and photo permissions are requested only when you choose to use these features. You can revoke these permissions at any time through your device settings.

3. How We Use Your Information

• Authenticate your identity through Google OAuth
• Display your calendar events from Google Calendar in our interface
• Synchronize events you create or delete in Buddy AI Note with your Google Calendar
• Maintain your session and provide access to your calendar data
• Ensure security and prevent unauthorized access
• Process images you upload to provide AI-powered event planning suggestions
• Share images with Buddy AI to analyze context and recommend calendar enhancements

Important:We use your connected-account data only to provide the Service's features — showing your agenda, surfacing email that needs a reply, preparing drafts, and organizing your notes. It is not used for marketing, advertising, or sold to anyone. Because Buddy AI Noteuses restricted Google scopes, it has completed Google's required independent security assessment (with TAC Security) and is verified by Google for restricted-scope use.

Image Usage: Images you upload are processed by Buddy AI solely to help you plan and organize your calendar events better. Images are not used for training AI models, sold to third parties, or used for any purpose other than providing event planning assistance during your active sessions.

4. Data Sharing and Third Parties

4.1 Third-Party Services

We use the following third-party services to operate Buddy AI Note:

• Google & Microsoft OAuth / APIs: Authentication and access to the email and calendar accounts you connect
• Clerk: Authentication and session management
• AI provider: To generate your drafts, tasks, and summaries. Content is sent per request to produce your result and is not used to train models. Text embeddings for search are generated by our own self-hosted model, not a third-party service.
• Cloud hosting and database providers: Application infrastructure and data storage

4.2 We DO NOT

• Sell your personal data to third parties, advertisers, or marketers
• Share your calendar data with other users or external parties
• Use your calendar data for AI training, analytics, or any purpose beyond synchronization
• Sell, share, or license images you upload to third parties
• Use images for AI model training or development without explicit consent
• Use your email, calendar, or note content to train AI models
• Send email, or create or change calendar events, without your explicit approval

5. Data Security

• Encryption in transit: all connections use TLS
• Tokens encrypted at rest: the OAuth tokens for your connected accounts are encrypted with AES-256-GCM before they are written to our database
• Per-user isolation: row-level security ties every record to your account and is enforced by the database, so no other user can read your data
• OAuth 2.0 for third-party integrations
• Limited employee access on a need-to-know basis

For a fuller technical explanation — including the exact permissions we request and the rule that Buddy drafts but never sends without your approval — see our Security page.

6. Your Rights and Choices

• Revoke Google Calendar access at any time through your Google Account settings
• Create and delete events in your calendar
• Delete your Buddy AI Note account and all associated data
• Log out to end your session and clear access tokens

To revoke access: Visit your Google Account Permissions page and remove Buddy AI Note from the list of apps with access to your account.

7. Data Retention

• Connected-account tokens: Stored encrypted for as long as the account stays connected, so Buddy can keep syncing and preparing drafts. Deleted when you disconnect the account (Section 6) or delete your account
• Email and calendar data: Buddy stores the threads, drafts, and events it works on so it can show them to you and act on your approval. This data is removed when you delete your account
• Account information: Basic profile information (email, name) is retained while your account is active
• AI Agent Proposals: Conflict resolution and AI suggestions are stored temporarily:
  • PENDING proposals: Retained for 30 days (awaiting your action)
  • REJECTED/EXECUTED/FAILED proposals: Retained for 7 days (after you've made a decision)
• Chat conversations: Conversation history is retained for 1 year for reference and service improvement
• Chat messages and images: Individual messages and images associated with conversations are retained for 1 year; older messages and their images are automatically deleted. Deleting a conversation immediately removes all associated images
• Completed events: Events that have ended are retained for up to 2 years for historical reference, then automatically deleted
• Deleted accounts: All personal data including images and conversations is permanently removed within 30 days of account deletion

Automatic Cleanup: We use automated processes to periodically delete old data according to the retention schedule above. This helps maintain database performance while preserving your recent history for reference.

8. Cookies and Session Management

We use cookies and browser storage to:

• Maintain your login session (via Clerk authentication)
• Cache data locally for improved performance

These are essential cookies required for the application to function. If cookies are disabled, you will not be able to use Buddy AI Note.

9. Children's Privacy

Our service is not intended for users under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, please contact us immediately.

10. International Users

Our services are hosted and operated from various locations. By using our service, you consent to the transfer of your data to countries where we operate, which may have different data protection laws than your country.

11. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of any significant changes by email or through the application. Your continued use of our service after changes become effective constitutes acceptance of the updated policy.