Privacy Policy

Who publishes this

SYSTEM ("SYSTEM," "we," "us," or "our") is operated by Safeeullah Samir, an individual, not a registered company ("Operator"). Operator is the data controller for the purposes of this policy. If that changes, this policy will be updated.

This policy describes what we collect through the SYSTEM website and application (together, the "Service"), why we collect it, and who we share it with.

The short version

• We collect your name and email address from Google, and whatever you choose to put into SYSTEM: your tasks, goals, projects, notes, and progress.
• We do not sell your personal information.
• We do not share it for money, and we run no advertising or cross-context behavioural advertising.
• You can ask us to delete everything we hold about you, and we will.
• The Service is not directed at children under 13.

Personal information we collect

Information you give us. When you sign in with Google we receive your name, email address, and profile picture. When you use the Service you create tasks, goals, projects, notes, events, and evidence, and you record how you spend your time. All of that is personal information.

Information collected automatically. Your IP address, browser type, and the pages you visit. We use this to keep the Service running and to prevent abuse.

Information from third parties. We use AuthKit (by WorkOS) to handle sign-in and sessions, Convex to store your data, and Vercel to serve the application. Each receives only the data it needs to do its part.

Connected services. If you connect a calendar, we store the availability information needed to answer questions about your schedule. We do not store calendar event titles or descriptions.

How we use your personal information

• To provide the Service, including the MCP endpoint
• To authenticate you and keep your session secure
• To record what has left the Service, in the egress log below
• To enforce rate limits and prevent abuse
• To respond to your requests and support you
• To detect and prevent fraud, abuse, and security incidents

We do not use your personal information for advertising or marketing.

AI and third-party model providers

This is the part worth reading carefully, because it is where your data can leave the Service.

Connected assistants. The Service exposes an MCP endpoint. If you connect an external assistant such as ChatGPT, Claude, Gemini, or Grok, that assistant receives the data its tools return, and the requests it makes are sent from your account. What any given assistant sends onward is governed by that provider's own terms and privacy policy, not ours. You control which assistants you connect and what they can see.

Steering. Some features ask a model provider to interpret what you type. When that happens, the text you submitted and the surrounding context are sent to our model provider. If no model provider is configured, these features fall back to local rules and no data is sent.

No model training on your data. We do not use your personal information to train models, and we require our processors not to either.

How we share your personal information

Service providers. Convex (database), Vercel (hosting), and WorkOS (authentication and sessions). These providers process personal information on our behalf and are not permitted to use it for their own purposes.

Nothing is sold. We do not sell your personal information, and we do not disclose it for a business purpose in the way California law describes as "sharing" for cross-context behavioural advertising, because we do not run that.

Legal requests. We may disclose information if required by valid law.

Business transfers. If the Service is transferred to another owner, your information may be part of that transfer. We would notify you beforehand.

The egress log

Every time data is read out of the Service by a connected client, we record it. This log contains which tool ran, when, roughly how much data was involved, and which Areas were included or excluded. It exists so that you can see what left the Service, and it is visible to you inside the product.

Retention

We keep your personal information for as long as your account is active, and delete it when you ask us to. Aggregate or de-identified data that can no longer be linked back to you may be retained. Data we are legally required to keep is kept only for as long as required.

Your rights

Depending on where you live, you may have the right to know what personal information we hold about you and to receive a copy of it, to correct inaccurate information, to delete it, to opt out of sale or sharing, to appeal a denied request, and to receive certain information in a portable format.

We do not sell or share your personal information, so the opt-out rights do not currently apply. To exercise any other right, email safeeullahsamir1@gmail.com. We will verify your identity before acting, and will respond within the period required by applicable law.

We will not discriminate against you for exercising a privacy right.

Security

We use encryption in transit, hashed passwords where we hold them at all, and sealed session cookies. No system is perfectly secure, and we cannot promise your information will never be compromised. If a breach affects your personal information we will notify you and any regulator as required by law.

International transfers

Operator is based in Pakistan. Data is stored with Convex and served by Vercel, which may process it in other countries, including the United States, where privacy protections differ from those in your country.

Children

The Service is not directed at anyone under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has given us personal information, contact us and we will delete it.

Changes to this policy

We may update this policy. If we make a material change we will update the date above and post a notice on the Service. Continuing to use the Service after a change means you accept it.

Contact