Privacy Policy

Account. Your email address, and if you sign in with Google, the identifier and email Google gives us. We never see your Google password. Your time zone and your settings.

What you capture. Text you type or paste, photos and screenshots, PDFs, voice notes, emails you forward to your Sidefolk address, and messages you send to Sidefolk on WhatsApp, together with the draft Sidefolk makes from each one.

Scanned messages, only if you switch scanning on. New emails in your Gmail inbox, and text messages on an Android phone. See “Email and text message scanning” below.

Calendars. Events you create, and events read from a Google, Outlook or iCloud calendar or a calendar link you connect.

Household. Members’ names, roles (for example parent, teen, child, carer), colours and labels, and what is shared with whom. Household members can include children; see “Children” below.

Business. If you use the client and job features: client names, contact details, addresses, quotes, jobs, invoices, and bookings people make through your booking link.

Payments. Your plan and subscription status. Card details are handled by Stripe, Apple or Google; we never see or store them.

Technical. Push notification tokens, usage records inside our own database (for example, when you first confirm a draft, and how many AI requests you used this month, to apply plan limits), and crash and error reports.

To run the service you asked for: drafting items from what you give us, showing and sharing your calendar, detecting clashes, reminders and daily summaries, syncing calendars you connect, applying plan limits, taking payment, keeping the service secure, and fixing errors.

We do not sell your information, we do not show ads, and we do not use your information, or anything about your children, for advertising or profiling. We use no third-party analytics or advertising trackers in the apps or on the website.

Legal bases (GDPR). Performance of our contract with you for the core service; your consent for Gmail scanning, text-message scanning, WhatsApp and calendar connections, which you can withdraw at any time by switching them off; our legitimate interests in security and error reporting; and legal obligations such as tax records. Under India’s Digital Personal Data Protection Act 2023, we process your data on the basis of your consent, given when you sign up and when you switch on each connection, and for the legitimate uses the Act allows. [[LAWYER: CONFIRM LAWFUL BASES AND DPDP CONSENT NOTICE WORDING]]

Gmail. If you connect Gmail and switch scanning on, we ask Google for read-only access to your Gmail (the gmail.readonly permission). About every 15 minutes, and when you tap “Scan now”, our server reads new messages in your inbox. A simple filter on our server first skips messages that cannot contain a plan (for example newsletters, one-time codes, senders you muted, and by default your own emails). Only messages that pass the filter are sent to Google Gemini to draft an event or task. Sidefolk never sends, deletes, labels or changes your email.

Text messages (Android only). The version of Sidefolk for Android that includes text scanning asks for permission to read your SMS. If you switch it on, the app checks new messages on your phone with the same kind of filter, and only messages that might contain a plan leave your phone, to be drafted by Gemini. The iPhone app, the web app and the Android version without text scanning cannot read text messages.

Drafts wait for you. Anything found by scanning, forwarding or WhatsApp is always saved as a draft in your Inbox and never added to your calendar until you confirm it. In the mobile app, when you capture something yourself and the event is complete and clear, it may be added straight away with an Undo shown for at least 30 seconds; turn on “always ask me” to review every one.

What we keep. For a drafted message: its text (removed after 30 days, see “Retention”), the sender, subject line and date, and the draft. For a message the filter skipped: only its message ID, so we do not read it twice. You can switch scanning off, mute senders, or disconnect Gmail at any time in Sidefolk, or remove access in your Google Account.

Sidefolk’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, data from Gmail and Google Calendar is used only to provide the features you switch on (drafting items from your messages and showing your calendar events in Sidefolk). It is not used for advertising, not sold, not used to train or improve general AI models, and not read by people, except with your permission, for security or abuse investigations, or where the law requires it. It is shared only with the service providers listed below that are needed to provide those features. [[CONFIRM GEMINI IS ON A PAID TIER THAT DOES NOT USE PROMPTS FOR TRAINING]]

If you link WhatsApp, we store your WhatsApp phone number against your account. Text messages you send to Sidefolk’s WhatsApp number reach us through Meta’s WhatsApp Business Platform, are drafted by Gemini, and appear in your Inbox. We may reply to confirm we got them. We cannot see your other WhatsApp chats.

You can connect Google Calendar (read-only), Outlook (read-only, through Microsoft), iCloud (using an app-specific password you create at Apple), or a calendar link. We read events from them to show them in Sidefolk and check for clashes. We do not write to or change those calendars. The access tokens and app-specific passwords are stored on our servers only, never sent to your devices, and are removed when you disconnect or delete your account. You can also revoke access at Google, Microsoft or Apple at any time.

Text, images, PDFs, voice notes and messages you ask Sidefolk to read are sent to Google’s Gemini API, which returns a draft. The mobile voice assistant turns your speech into text on your phone and sends only the text. Voice notes you record as a capture are uploaded and sent to Gemini. AI can make mistakes, so please check drafts before you rely on them.

You must be [[MINIMUM AGE]] or older to create a Sidefolk account yourself. A parent or guardian can add children and teenagers to their household, either as a name on the family calendar or by inviting them to their own account with a limited role. By doing so, the parent or guardian consents on the child’s behalf to the processing described here. [[PARENTAL CONSENT PROCESS AND ANY FEATURES DISABLED FOR CHILD/TEEN ACCOUNTS (see FEAT-23)]]

Each member sees only what their role and the household owner allow. We never use children’s information for advertising, profiling or tracking. Booking links and other business features never show your family calendar’s contents. If you believe we hold a child’s information without the right consent, contact us and we will delete it.

We use these service providers. Each processes data only to provide its part of Sidefolk, under its own data processing terms. [[CONFIRM DPA ACCEPTED WITH EACH]]

We share information with members of your household only as you choose, and with authorities only where the law requires it. We do not otherwise share or sell it.

Our database is in South Korea, and some providers above process data in other countries, including the United States. When your information leaves New Zealand, India or the European Economic Area, we rely on the provider’s contractual safeguards. The European Commission has recognised South Korea as providing adequate protection. We remain responsible for your information wherever it is processed. [[LAWYER: CONFIRM TRANSFER MECHANISMS]]

• Original text of captures and scanned messages (the email or message body, a pasted text, text read from a screenshot) is removed automatically 30 days after you confirm or discard the draft, or 30 days after it arrived if you never do. The draft, and the sender, subject and date of a scanned message, stay until you delete them.
• Items you delete go to the Bin and are permanently deleted after 30 days.
• Uploaded files (photos, PDFs, voice notes): [[UPLOADED FILE RETENTION. Today they are not deleted automatically, including when an account is purged (see 0037). Fix before launch, or state the period here.]]
• Everything else is kept while your account is open.
• Deleting your account. You can delete your account yourself in the app or on the website under Account. You are signed out straight away, and you can restore the account within 30 days. After 30 days, your account and its data are permanently deleted. If you own a household, the household and what is in it are deleted with your account unless you hand ownership to another member first. Backups and logs held by our providers expire on their own schedules [[BACKUP RETENTION PERIOD]]. We keep payment records where tax law requires.

Access to your data is limited by database rules tied to your account and your role in each household. Connection credentials stay on our servers. Error reports are set up to exclude names, email addresses, cookies and request contents, and carry only a technical account ID. No system is perfectly secure; if a breach puts you at risk, we will tell you and the regulators as the law requires.

You can ask us to:

• tell you what information we hold about you and give you a copy (access);
• give you your data in a portable format (export);
• correct information that is wrong (you can also edit most of it in the app);
• delete your information (you can delete your account yourself, see above);
• stop a particular use, or withdraw a consent (for example, switch off scanning).

Email support@sidefolk.app to make a request. We will reply within [[RESPONSE TIME, e.g. 20 working days]]. We do not charge for requests.

New Zealand. We follow the Privacy Act 2020. You can complain to the Office of the Privacy Commissioner (privacy.org.nz).

India. Under the Digital Personal Data Protection Act 2023, you can also nominate someone to exercise your rights if you die or become unable to. Our Grievance Officer is [[GRIEVANCE OFFICER NAME]], [[GRIEVANCE OFFICER EMAIL]]. If you are not satisfied with our response, you can complain to the Data Protection Board of India.

European Economic Area and UK. You also have the rights to restrict and to object to processing, and you can complain to your local data protection authority. [[EU/UK REPRESENTATIVE, IF REQUIRED]]

If we make a material change, we will update the effective date above and tell you in the app or by email before it applies.

[[LEGAL ENTITY NAME]], [[REGISTERED ADDRESS]]. Privacy questions and requests: support@sidefolk.app.