← Back to home

Privacy Policy 🔒

Last updated: September 2026

What I collect

• WhatsApp messages — from groups you choose. I read, summarize, and delete. Messages aren't stored after processing.
• Telegram chat ID — so I know where to send your briefs.
• Google Calendar — read/write access to sync events I find in your groups.
• Google Tasks — read/write access to your task list, to add, update and complete tasks you asked for.
• Google email address — for account verification only.

Penny's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Calendar and Tasks data is used only to provide the service to you. It is never sold, never used for advertising, and never used to train AI models.

Google user data

This section describes exactly how Penny accesses, uses, stores, shares and deletes data obtained through Google APIs.

What Google data Penny accesses

• Google Calendar (scope calendar): the list of your calendars, and for each event its title, date and time, location, description, attendees and recurrence. Penny reads events from today minus 2 days to about 60 days ahead.
• Google Tasks (scope tasks): your task lists and each task's title, notes, due date and completion status.
• Google account email (scope userinfo.email): the address of the connected account.

How Penny uses it

• Calendar events are used to build your daily brief, to answer questions you ask Penny, and to detect conflicts with events found in your WhatsApp groups.
• Penny creates, updates or deletes calendar events and tasks only for items you asked for or approved, for example a school event that Penny found in a group chat.
• Your email address is shown to you in the connection status so you know which account is connected. It is not used for marketing.
• Google data is never used for advertising, never sold, never given to data brokers, and never used to train general machine-learning or AI models.

How Penny shares it

Penny does not sell or share Google user data with third parties. Google data is transmitted only to service providers that act on Penny's behalf to run the service, and only for that purpose:

• AI model providers (Google Gemini API, OpenAI API): relevant calendar events and tasks are included in the prompt so the assistant can answer you and build your brief. These are API calls under terms that prohibit training on your data.
• Hetzner: the hosting provider of Penny's servers.
• Telegram, WhatsApp and Apple push notifications: used only to deliver Penny's messages to you. The content of a message may mention an event or task.

No human at Penny reads your Google data as part of normal operation. Access is limited to debugging a problem you reported, or where required by law.

How Penny protects it

• All connections to Google, to AI providers and to your device use TLS encryption in transit.
• Your Google OAuth token is stored in an encrypted credential store that belongs to your user only. Penny never sees or stores your Google password.
• Each user's data lives in a separate, isolated storage area on the server. One user's data is never visible to another.
• Server access is restricted to the operator, over authenticated SSH, on a private network.

How long Penny keeps it and how to delete it

• Calendar events and tasks are fetched fresh from Google when needed. Penny keeps only short-lived copies for the current run, plus the summaries and memory notes it writes for you, for as long as your account is active.
• Your Google token is kept until you disconnect. To disconnect, ask Penny to disconnect your calendar, or remove Penny AI under Google Account, Third-party apps. Either way Penny stops accessing Google immediately.
• To delete everything, use "Delete account" in the Penny app or email [email protected]. All your data, including stored Google credentials, is removed from Penny's servers within 30 days. Nothing is retained after that except records the law requires us to keep.

How I process your data

Everything I do is aimed at one thing: helping you manage the information, tasks, and events from the groups you authorized. Messages are sent to an AI model via API for summarization. This is API-only usage — your data is never used for model training.

Data retention

WhatsApp messages from your groups are deleted immediately after processing. I keep summaries and memory for a short period to give you continuity and context — and you can ask me to delete everything at any time.

What I don't do

• I don't sell or share your data with anyone
• I don't show ads
• I don't use tracking cookies or analytics
• I don't send messages on your behalf to WhatsApp groups

Third-party services

• AI model — message processing and summarization (API only, no model training)
• Google Calendar API — event sync to your calendar
• Google Tasks API — task sync
• Telegram Bot API — sending briefs to you

Complete isolation

Every user's data is stored in complete isolation. There is zero overlap between users — nobody can see anyone else's data.

You're in control

At any time you can:

• Choose which groups I monitor
• Disconnect your calendar
• Request to see your data
• Request data correction
• Delete all your data and close your account

Contact

Privacy questions? Talk to me: [email protected]