Privacy policy

Effective October 18, 2026 · Companion · Matthew Stovall

Information Companion uses

Account creation uses your email address, authentication identifiers and timezone. Basic Google sign-in uses your Google account identifier, verified email and profile information to authenticate you. It does not connect your mailbox.

If you separately connect Gmail, Companion requests read-only email permission. It caches email identifiers, conversation identifiers, sender, subject, message text, timestamps and limited mailbox classification signals. Access credentials are stored separately and encrypted. Companion uses email context to suggest personal reminders and answer your inbox questions. It does not send email or modify messages in Gmail.

We also store your chat questions and answers, source citations, reminder decisions, notification preferences, device or browser push registration and delivery status. We store source-backed care context, reflections you choose to save, your optional reflection focus, care-rhythm preferences and weekly participation records. Journal notes are private to your account and are not automatically sent to care providers.

AI processing and service providers

The initial care-journal feature uses reviewed reflection templates selected from explicit email context and your optional focus. During chat, relevant saved journal entries and confirmed memories may be sent to the configured AI provider to answer your request. A prescription email does not establish medication use or a diagnosis.

Connected email text and the context needed for your requested features are sent to OpenRouter and the configured model provider for reminder generation and answers. Companion requests provider routes that prohibit training/data collection and require zero data retention. If such a route is unavailable, processing fails rather than relaxing those restrictions. These routing controls do not imply that all infrastructure metadata or billing records are deleted.

Authentication and application data are hosted using our managed Supabase deployment on Coolify infrastructure. Browser push services and Apple Push Notification service receive notification delivery information, including a generic reminder alert, an opaque reminder identifier and a device/browser destination. New alerts omit email subjects, reminder titles, senders and excerpts; open the signed-in app for details. Previously delivered alerts and local reminders scheduled by older iOS builds may retain their earlier content until cleared or rescheduled. Infrastructure providers may process operational connection and security metadata to deliver these services.

Limited use of Google data

Companion's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Google data is used only for the user-facing inbox assistance you authorize. We do not sell email data, use it for advertising, build generalized AI training datasets from it, or use it to train generalized models. Human access is limited to circumstances permitted by that policy, such as support or debugging with your consent, security, or legal obligations.

Storage, security and retention

We use HTTPS, encrypted provider credentials and account-scoped database access. Choose how long Companion keeps cached email in Settings: 30, 90, 180, or 365 days from receipt, or until you disconnect. The default keeps cached email until disconnect or deletion. A background task removes expired cached messages within an hour; older email is excluded from later imports. Reminder titles, source details and supporting excerpts remain available after source-email expiry. Chat history and citations also remain until you delete Companion data. Saved care reflections survive source-email expiry and mailbox disconnection. You can delete individual reflections from the journal, or delete all care context, journal entries, preferences and weekly progress through Delete my Companion data. Technical safeguards reduce risk but do not guarantee that a service can never be compromised.

Disconnecting a mailbox stops its sync and removes its cached messages and source-linked reminders from the active database. It does not erase saved journal entries or past chat questions and answers, which may contain email excerpts. Use Settings → Delete my Companion data to remove all remaining Companion content, or contact us for help. A minimal account identifier and deletion timestamp remain to prevent older in-progress requests from restoring deleted data. Shared authentication records used by other services are preserved. Infrastructure backup copies, if present, follow the host's recovery lifecycle and are not immediately changed by an application deletion; contact us for confirmation about remaining recovery copies.

Security metadata follows a separate lifecycle from inbox content. Companion-attributed login audit records are removed after 90 days in bounded daily cleanup runs. Shared sign-in audit records that cannot safely be attributed to Companion are preserved so another service's authentication history is not changed. Operational runtime logs have a 30-day journal retention policy, with file rotation and storage limits. These controls do not establish deletion of historical or provider-held copies.

Chat tools and memories

Chat stores tasks, tool activity, email and web citations, memory suggestions and your approval decisions. Background processing can propose memories from medical emails. Useful memories are saved automatically, with their source identified. Email-derived memories remain source observations; they do not establish a diagnosis, medication use or adherence. You can edit or delete them at any time. Source-linked suggestions are removed when their source changes or is deleted. Confirming a suggestion creates an independent user-stated memory, retained until you delete it. Rejected source suggestions are suppressed for the same source version.

When enabled, public web research sends a search query through OpenRouter and its Exa web-search integration. Public browsing runs in a fresh isolated browser context without your signed-in accounts. Search and browser providers may process those requests under their own policies. A prepared form submission shows its destination and exact fields and requires your individual approval before sending them. Cancelled tasks cannot undo submissions already started. Unsupported forms and sites requiring sign-in cannot be submitted through this feature.

Your choices and deletion

You can disconnect a mailbox, revoke access in your Google account's third-party app permissions, disable notifications, or request deletion of Companion data. See data deletion for the exact controls and contact method. Deleting Companion content does not delete your Gmail messages or accounts with other services.

Contact and updates

For access, correction, deletion or privacy questions, email [email protected]. We update this page when our data practices change and show the effective date above.

Automatic memories and public research

Companion automatically saves helpful details from your messages and eligible care emails. You can edit or delete them in Memories. An email mention is an observation, not confirmation of a diagnosis or current medicine use. Background research uses recognized medicine names and care specialties to find public educational sources. It does not send your name or email excerpts in those research searches. General explanations are kept separate from your confirmed care details, include source links and expire for refresh after 30 days. Source-linked memories and research are removed when their source is changed or deleted; independent notes you edited and past conversations remain until you delete them or remove all Companion data.