Privacy
Effective 2026-10-01
Information you provide
saypo processes your account email address, account identifier, profile name and preferences to provide your account. It stores projects, tasks, time sessions, notes, tags and calendar entries you create, and attachments, photos or audio recordings you upload. Meeting records may include transcripts, summaries, decisions and action items you save.
Booking pages process guest names, email addresses and requested appointment details. Public share links make the selected information available to people with the link. Do not include information you do not intend to share.
How information is used
Information is used to authenticate users, save and synchronize their work, calculate time records, manage bookings and authorized sharing, and protect and operate the service. Hosting infrastructure processes request, network and error information needed for delivery, security and troubleshooting.
The current application does not include advertising tracking. Account and workspace data are still processed to provide the service.
Sign-in, calendars, recordings and AI connections
Google sign-in is supported through Supabase authentication. When you choose it, Google provides the identity information authorized during sign-in, such as your account identifier, email address and profile information. Signing in with Google does not by itself grant access to Google Calendar.
Google Calendar is a separate, optional connection from Google sign-in. With your authorization, saypo reads your calendar list so you can choose calendars, including calendar names, identifiers, time zones and access permissions. For selected calendars, saypo processes event content and synchronization information, including event titles, start and end times, time zones, busy/free and all-day status, event identifiers, recurrence information and change markers. These data support calendar display, synchronization and availability checks for bookings.
Where a selected Google calendar permits changes and the event is editable, saypo can create, update and delete events as part of two-way synchronization. Calendar connection access tokens and offline refresh credentials are stored encrypted on the server so synchronization can continue without a new interactive sign-in each time. Offline permission does not guarantee that synchronization is always running or immediate.
Disconnecting a calendar in saypo stops that connection and removes its stored credentials. You can also revoke saypo’s Google access in your Google Account permissions. Disconnecting or revoking access does not automatically delete events or copies already synchronized into saypo or Google Calendar. Previously synchronized records may remain until removed through available content controls or addressed through a request to the publisher.
On iOS, device calendar access separately requires your permission. Connecting a selected device calendar processes event content, identifiers and synchronization records to exchange changes. You can change calendar permissions in device settings. Removing saypo content does not necessarily remove events held in your external calendar.
Recording and uploads are initiated by you. Pending recordings and attachments may remain on your device before upload. Uploaded files are held in private service storage and accessed through authorized requests or time-limited links. Cloud transcription and summaries are initiated by you. To provide these features, saypo sends the meeting audio, transcript and necessary linked-session context to Google Gemini when its production eligibility has been verified; OpenAI is used when Gemini is not eligible or as an authorized operational fallback. Model-generated minutes and action items are drafts; tasks are created only after your review and confirmation.
If you authorize an external AI client through the MCP interface, it can receive information and perform actions covered by your grant. The external client handles received information under its own privacy practices. You can revoke the saypo grant; revocation does not recall copies already received by that client.
Google API data and Limited Use
saypo’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy and the Google Workspace API User Data and Developer Policy, including their Limited Use requirements.
Google API data may be used or transferred only as permitted by Limited Use to provide or improve the authorized, user-facing features described here. It must not be sold, used for advertising, or used to develop, improve or train generalized AI or machine-learning models. When Google API data is shared with an authorized external AI client through MCP, the permitted use remains limited to the user-authorized, visible functionality and the applicable Limited Use restrictions. Authorizing a client does not give it permission to use the information for unrelated purposes.
Calendar information is used for the calendar, synchronization and booking features described above. If you grant an external AI client permission to read calendar events through MCP, that client can receive the events covered by your grant. Review the client and requested access before authorizing it. Revoking the grant stops future authorized access; it does not recall information already received.
Service providers and storage
saypo uses Supabase for authentication, database and file storage, and Heroku for application hosting. Google processes information when you choose Google sign-in. Authorized sharing, booking or external connections may disclose the content needed for those features.
Information may be processed in locations used by these providers. This policy does not promise storage exclusively in one country, zero provider retention or immediate erasure from infrastructure backups.
Retention and deletion
Workspace information is retained to provide your account and features. You can edit or remove content where the application offers those controls. Copies already shared with other people or external services are not recalled by removing the original.
Account deletion is not currently available in the service. To ask about access, correction or deletion of your information, contact the publisher below. Sending a request does not mean deletion has completed; we will need to confirm the request and what action can be taken. No automatic deletion completion time is promised.
Infrastructure backups, operational logs and information held by connected providers can have separate retention practices. This policy does not state a fixed retention period for those systems.
Your choices and contact
You can manage your profile and workspace content, stop sharing links where the application provides that control, revoke AI grants, and change device permissions. Contact the publisher for privacy questions or requests not covered by these controls.
Material changes to these practices will be reflected on this page with an updated effective date.