Privacy Policy

Account. Your email address, and if you sign in with Google, the identifier and email Google gives us. We never see your Google password. Your time zone and your settings.

What you capture. Text you type or paste, photos and screenshots, PDFs, voice notes, emails you forward to your Sidefolk address, and messages you send to Sidefolk on WhatsApp or WeChat, together with the draft Sidefolk makes from each one.

Scanned messages, only if you switch scanning on. New emails in your Gmail inbox, text messages on an Android phone, and on Android the notifications of messaging apps. See “Email and text message scanning” below.

Calendars. Events you create, and events read from a Google, Outlook or iCloud calendar or a calendar link you connect.

Household. Members’ names, roles (for example parent, teen, child, carer), colours and labels, and what is shared with whom. Household members can include children; see “Children” below.

Business. If you use the client and job features: client names, contact details, addresses, quotes, jobs, invoices, and bookings people make through your booking link.

Payments. Your plan and subscription status. Card details are handled by Stripe, Apple or Google; we never see or store them.

Technical. Push notification tokens, usage records inside our own database (for example, when you first confirm a draft, and how many AI requests you used this month, to apply plan limits), and crash and error reports.

To run the service you asked for: drafting items from what you give us, showing and sharing your calendar, detecting clashes, reminders and daily summaries, syncing calendars you connect, applying plan limits, taking payment, keeping the service secure, and fixing errors.

We do not sell your information, we do not show ads, and we do not use your information, or anything about your children, for advertising or profiling. We use no third-party analytics or advertising trackers in the apps or on the website.

Legal bases (GDPR). Performance of our contract with you for the core service; your consent for Gmail scanning, text-message scanning, reading message notifications, WhatsApp, WeChat and calendar connections, which you can withdraw at any time by switching them off; our legitimate interests in security and error reporting; and legal obligations such as tax records. Under India’s Digital Personal Data Protection Act 2023, we process your data on the basis of your consent, given when you sign up and when you switch on each connection, and for the legitimate uses the Act allows. You can withdraw consent at any time by switching a connection off or deleting your account, as described below.

Gmail. If you connect Gmail and switch scanning on, we ask Google for read-only access to your Gmail (the gmail.readonly permission). About every 15 minutes, and when you tap “Scan now”, our server reads new messages in your inbox. A simple filter on our server first skips messages that cannot contain a plan (for example newsletters, one-time codes, senders you muted, and by default your own emails). Only messages that pass the filter are sent to our AI providers (Groq first, then Google Gemini if needed) to draft an event or task. Sidefolk never sends, deletes, labels or changes your email.

Text messages (Android only). The version of Sidefolk for Android that includes text scanning asks for permission to read your SMS. If you switch it on, the app checks new messages on your phone with the same kind of filter, and only messages that might contain a plan leave your phone, to be drafted by our AI providers (Groq, then Google Gemini if needed). The iPhone app, the web app and the Android version without text scanning cannot read text messages.

Message notifications (Android only). If you switch on “Read message notifications” and allow notification access for Sidefolk in Android settings, the app reads the text of new notifications from messaging apps only: Messages, WhatsApp, WeChat, Messenger, Telegram, Signal, Viber and LINE. It never reads notifications from any other app. The text is checked on your phone with the same kind of filter, and only messages that might contain a plan leave your phone, with the sender’s name and the app’s name, to be drafted by our AI providers (Groq, then Google Gemini if needed). Sidefolk never replies to, dismisses or changes those notifications or messages. You can switch it off in Sidefolk, or remove notification access in Android settings, at any time; switching it off also deletes anything read but not yet sent.

Drafts wait for you. Anything found by scanning, forwarding, WhatsApp or WeChat is always saved as a draft in your Inbox and never added to your calendar until you confirm it. In the mobile app, when you capture something yourself and the event is complete and clear, it may be added straight away with an Undo shown for at least 30 seconds; turn on “always ask me” to review every one.

What we keep. For a drafted message: its text (removed after 30 days, see “Retention”), the sender, subject line and date, and the draft. For a message the filter skipped: nothing. We only keep our place in your inbox, so we do not read a message twice. You can switch scanning off, mute senders, or disconnect Gmail at any time in Sidefolk, or remove access in your Google Account.

Sidefolk’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, data from Gmail and Google Calendar is used only to provide the features you switch on (drafting items from your messages and showing your calendar events in Sidefolk). It is not used for advertising, not sold, not used to train or improve general AI models, and not read by people, except with your permission, for security or abuse investigations, or where the law requires it. It is shared only with the service providers listed below that are needed to provide those features. We use Google’s paid Gemini service, under which Google does not use what we send to train its models, and Groq keeps nothing we send it (zero data retention).

If you link WhatsApp, we store your WhatsApp phone number against your account. Texts, photos, voice notes and PDFs you send to Sidefolk’s WhatsApp number reach us through Meta’s WhatsApp Business Platform, are drafted by our AI providers (as described under AI processing), and appear in your Inbox.

If you link WeChat, we store the identifier WeChat gives your account for Sidefolk’s Official Account (not your WeChat ID or phone number). Texts and photos you send to Sidefolk on WeChat reach us through Tencent’s WeChat Official Account platform and are drafted the same way.

We may reply to confirm we got a message. We cannot see your other chats in either app, and we don’t keep the photos, voice notes or PDFs you send this way: they are read once to make the draft.

You can connect Google Calendar (read-only), Outlook (read-only, through Microsoft), iCloud (using an app-specific password you create at Apple), or a calendar link. We read events from them to show them in Sidefolk and check for clashes. We do not write to or change those calendars. The access tokens and app-specific passwords are stored on our servers only, never sent to your devices, and are removed when you disconnect or delete your account. You can also revoke access at Google, Microsoft or Apple at any time.

Text and messages you ask Sidefolk to read (typed or pasted text, scanned or forwarded emails, text messages, message notifications, and WhatsApp and WeChat messages) are sent to Groq, and to Google’s Gemini API if Groq can’t produce a draft. Photos, screenshots and PDFs (including those sent on WhatsApp or WeChat) are sent to Gemini. Voice notes you record as a capture or send on WhatsApp are uploaded and turned into text by Groq (or read by Gemini if that fails), then drafted the same way. The assistant and note summaries use Gemini. The mobile voice assistant turns your speech into text on your phone and sends only the text. AI can make mistakes, so please check drafts before you rely on them.

You must be 16 (18 in India) or older to create a Sidefolk account yourself. A parent or guardian can add children and teenagers to their household, either as a name on the family calendar or by inviting them to their own account with a limited role. By doing so, the parent or guardian consents on the child’s behalf to the processing described here. A child never has a login of their own: they appear only as a person the parent or guardian adds. A teenager can be invited to a limited login by their parent or guardian. Every time someone adds a child or teenager, we ask them to confirm they are that person’s parent or guardian, and we keep the date and time of that confirmation. When you create an account we ask for your birth month and year to check your age, and keep only the fact that you passed, not your date of birth.

Each member sees only what their role and the household owner allow. We never use children’s information for advertising, profiling or tracking. Booking links and other business features never show your family calendar’s contents. If you believe we hold a child’s information without the right consent, contact us and we will delete it.

We use these service providers. Each processes data only to provide its part of Sidefolk, under its own data processing terms. We rely on each provider's standard data processing terms.

We share information with members of your household only as you choose, and with authorities only where the law requires it. We do not otherwise share or sell it.

Our database is in South Korea, and some providers above process data in other countries, including the United States. When your information leaves New Zealand, India or the European Economic Area, we rely on the provider’s contractual safeguards. The European Commission has recognised South Korea as providing adequate protection. We remain responsible for your information wherever it is processed. Where a provider is in a country without equivalent privacy law, we rely on its standard contractual clauses or equivalent safeguards.

• Original text of captures and scanned messages (the email or message body, a pasted text, text read from a screenshot) is removed automatically 30 days after you confirm or discard the draft, or 30 days after it arrived if you never do. The draft, and the sender, subject and date of a scanned message, stay until you delete them.
• Items you delete go to the Bin and are permanently deleted after 30 days.
• Uploaded files (photos, PDFs, voice notes): kept until you delete the item they belong to. A draft you dismiss stays in Recently discarded for 30 days so you can restore it; its photo is deleted after that. When your account is deleted, we also delete your uploaded files, within 90 days after the account is permanently deleted.
• Everything else is kept while your account is open.
• Deleting your account. You can delete your account yourself in the app or on the website under Account. You are signed out straight away, and you can restore the account within 30 days. After 30 days, your account and its data are permanently deleted. If you own a household, the household and what is in it are deleted with your account unless you hand ownership to another member first. Backups and logs held by our providers expire on their own schedules (about 30 days). We keep payment records where tax law requires.

Access to your data is limited by database rules tied to your account and your role in each household. Connection credentials stay on our servers. Error reports are set up to exclude names, email addresses, cookies and request contents, and carry only a technical account ID. No system is perfectly secure; if a breach puts you at risk, we will tell you and the regulators as the law requires.

You can ask us to:

• tell you what information we hold about you and give you a copy (access);
• give you your data in a portable format (export);
• correct information that is wrong (you can also edit most of it in the app);
• delete your information (you can delete your account yourself, see above);
• stop a particular use, or withdraw a consent (for example, switch off scanning).

Email privacy@sidefolk.app to make a request. We will reply within 20 working days. We do not charge for requests.

New Zealand. We follow the Privacy Act 2020. Our Privacy Officer is Sandeep Sharma, privacy@sidefolk.app. If a privacy breach is likely to cause you serious harm, we will tell you and the Office of the Privacy Commissioner as soon as practicable. You can also complain to the Office of the Privacy Commissioner (privacy.org.nz).

India. Under the Digital Personal Data Protection Act 2023, you can also nominate someone to exercise your rights if you die or become unable to. Our Grievance Officer is Sandeep Sharma, grievance@sidefolk.app. If you are not satisfied with our response, you can complain to the Data Protection Board of India.

European Economic Area and UK. You also have the rights to restrict and to object to processing, and you can complain to your local data protection authority.

We share your information with authorities only when the law requires it, for example a court order, and we share only what is required. If Sidefolk is sold or merged, your information may move to the new owner, who must keep to this policy or tell you first and let you delete your account. We tell you before that happens where we reasonably can.

If we make a material change, we will update the effective date above and tell you in the app or by email before it applies.

Highbrow Marketing Limited, a company registered in New Zealand (company number 8564669). Privacy questions and requests: privacy@sidefolk.app. General questions: support@sidefolk.app.