Privacy Policy

The philosophy

Tidy reads your email, notes, files, and calendar so it can turn the daily noise — the overflowing inbox, the dropped follow-up, the scattered notes — into something structured and useful. That data exists to make your life calmer. It stays yours. We don’t build a profile to manipulate you, and we don’t sell it. This page is written in plain English because you deserve to know exactly what happens to it.

The short version

• We don’t sell your data. Ever.
• We don’t train AI models on your personal content.
• Your data is encrypted in transit and at rest.
• You can export or delete everything, anytime.
• We only look at your content when you explicitly ask for help.

What we process

To make Tidy work, we process:

• Your communications: the email, messages, and calendar events you connect.
• Your content: the notes, tasks, files, and contacts you create or upload, and the projects you run.
• Derived AI data: summaries, embeddings, and structure Tidy generates from the above so it can recall and reason across your work.
• Usage data: basic metrics like whether the app is working — no content.

Google account data

If you connect a Google account, Tidy requests only the access its features actually use. Google’s own consent screen is where you approve it, and you can disconnect at any time from Settings — which revokes Tidy’s tokens with Google.

Tidy's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Here is every permission Tidy asks Google for, and why:

• Gmail: Read your mail so Tidy can surface what needs your attention, send the messages you write, and apply your Tidy labels back to your Gmail threads.
• Calendar: See your calendars and events so Tidy can show your day, and create or update the events you ask it to schedule.
• Contacts: Read your saved contacts so Tidy can put a name and a face to the people in your mail and calendar. Tidy never edits your Google Contacts.
• Other contacts: Read the addresses Google records from people you have corresponded with, so they appear in Tidy by name rather than as a bare email address.
• Drive (read): List, search and open your Drive files so you can bring a document into Tidy. Tidy never modifies or deletes a file you already own.
• Drive (create): Create new documents and folders in your Drive when you ask Tidy to. This covers only the files Tidy creates, never your existing ones.
• Meet (create): Create a Meet call when you start one from Tidy.
• Meet (read): Read back the recording and transcript of a call that Tidy started, so the notes land in your journal.
• Email address: See which Google account you connected, so Tidy can label it and avoid connecting the same mailbox twice.
• Basic profile: See your name and profile picture so your connected account is recognisable in Tidy.

What happens to that data: it is encrypted in transit (TLS 1.2 or better) everywhere it crosses a network — between your device and Tidy, between Tidy and Google, and between Tidy and every provider named below — and it is encrypted at rest, with the access tokens themselves separately encrypted before they are stored. It is kept only while the connection is active: disconnecting deletes the connection, and deleting your account removes ingested content within 30 days. No one at Tidy reads it routinely — staff access happens only on the explicit, time-boxed support grant described below.

We never sell it, never share it for advertising, and never hand it to a data broker. It is never used to train any AI model — ours or anyone else’s.

Who else processes it. To actually do the work you asked for — reading your inbox and turning it into summaries, tasks, and answers — Tidy sends content to a small number of AI providers acting purely as our service providers, on our instructions, for that request only:

• Google (Gemini): the live lane for AI extraction. Content that came from Google APIs is processed by Google’s own model API.
• Groq and Fireworks AI: additional model lanes for assistant and embedding work.
• OpenAI: configured for bulk extraction and for speech/image features. The bulk-extraction lane currently has no active credential, so it processes nothing today — we list it because the configuration exists.
• Cloudflare: handles encryption and routing for web traffic. It carries requests; it does not receive your stored content.

Audio transcription runs on Tidy’s own servers — recordings are not sent to an outside transcription service.

Cookies and campaign attribution

Our marketing site sets one first-party analytics cookie(tidy_aid) — a random id with no personal information in it. It lets us understand which campaigns bring people to Tidy, from the first visit through signup, so we can spend on what actually works. We record the campaign link you arrived from (the UTM tags and referring page) against that random id, and connect it to your account only if you go on to sign up.

• No third-party trackers. No advertising pixels, no cross-site cookies, no data brokers — the id is ours and stays first-party.
• No content, ever. Attribution records a campaign source and a random id, never your email, notes, or anything you create in Tidy.

The “absolutely not” list

• No training on your data. Your inbox and your notes will not become part of ChatGPT’s or Gemini’s brain.
• No selling. Your data is not a product line.
• No “aggregate” reselling. We don’t repackage your activity and sell it to anyone, anonymized or not.

How we lock it down

A session key unlocks your data when you sign in. Everything is encrypted in transit and at rest. For offline search, Tidy uses an on-device AI model (Google’s Gemma-based EmbeddingGemma) that runs locally — nothing leaves your device for that.

The two times we see anything

Your data is yours. There are exactly two situations where our systems touch your content:

1. “Is the engine running?” — automated performance metrics that never include your actual content.
2. The “help me” button — when you explicitly request support, you grant us time-boxed access to help, and only for as long as you allow it.

Bottom line

You are the customer, not the product. Tidy earns its keep by making your work calmer — not by mining your life. If we ever change something that matters, we’ll tell you plainly.

Contact

Questions about privacy? Email us at[email protected].