Privacy Policy

Effective date: 2025-01-15

This Privacy Policy explains how Personal Assistant ("we", "us", "our") collects, uses, stores, and protects information when you use the system.

What we collect

• **Account data**: name, email address, phone number, password hash, and workspace membership.
• **Workspace content**: tasks, reminders, notes, documents, messages, calendar events, automations, and related metadata.
• **Connected services**: OAuth tokens or app passwords for email, calendar, SMS, and other integrations (stored encrypted).
• **Usage and security data**: login events, IP address, user agent, audit logs, and system actions.

How we use data

• Provide core features (tasks, reminders, notes, docs, inbox, search, automations).
• Deliver notifications and emails you request.
• Secure your account and detect abuse.
• Maintain backups and recover data when needed.

Storage and security

• Data is stored in the primary database and file storage (S3 when configured).
• Sensitive credentials are encrypted at rest using SECRET_KEY.
• Backups may be created periodically and stored in the same S3 account or backup location.

Sharing and third parties

We only share data with service providers you enable or that are required to run the system:

• **Infrastructure and storage**: hosting and object storage (e.g., Render, AWS S3).
• **Email/SMS providers**: used to deliver messages you send or schedule.
• **Connected apps**: Google, Meta, Twilio, and others you authorize.

We do not sell your personal data.

Retention

We retain data for as long as your account is active or as needed for legal and operational reasons. You may request deletion; backups may persist for a limited period before expiring.

Your choices

• Export your data upon request.
• Revoke access to connected services at any time.
• Request deletion of your account and workspace data.

Contact

If you have questions or requests about this Privacy Policy, contact the system owner or administrator.