Privacy policy

Who we are

Augmenter is made by Northbrook PBC, a Delaware public benefit corporation in the United States. This policy covers augmenter.com and the Augmenter apps for Mac and iPhone. For the purposes of European and UK data protection law, Northbrook PBC is the controller of the personal data described here. Write to hello@augmenter.com with any question about it.

What we collect

Your account

Signing in is Google only, through Supabase Auth. From Google we get your name, your email address, and your profile picture. That is the whole of your account.

Your lists

Everything you put into Augmenter: lists and their sections, todos with their titles, bodies, statuses, due dates, priorities, and tags, the change history that lets you undo. This is stored on our servers so it can sync live between your Mac and your iPhone. Our systems can read it, which the section on encryption explains. It also reaches our product analytics, which the section on how the product is used explains.

Your list is yours alone, with two exceptions that come from working with other people who use Augmenter. When someone asks you for something and their list tracks it as an ask, and your own todo came from the same message, they see that todo’s status, its due date and when you finished it. They never see its title, notes, sources or anything else on your list. And people who know you through their own connections can see that you use Augmenter, by your picture showing in colour beside their todos.

What you say to the assistant

When you write to the assistant in the Chat tab, you can type a request, speak one, or attach an image. We process the text you type, the images you attach, and, if you use voice, your audio and its live transcript for the length of that conversation. Each request also carries a summary of the list you are working on, so the assistant knows what it is acting on. A message you write about a task can carry images and files too: they are kept in that task’s thread with your message, read by the task’s worker, and deleted with the task.

Your conversations with the assistant are kept with your lists, so you can pick one up again, and only you can read them. Voice audio is never stored by us; a voice conversation is kept as its transcript. The language models behind the assistant run under zero data retention: the provider keeps nothing once it has answered. Voice is the exception: for a call or dictation, your Mac or iPhone sends your audio straight to OpenAI, and OpenAI may hold what it received for a short period under its API terms. We have told it not to store calls.

Dictation works the same way. When you dictate into a field, your device sends your audio straight to OpenAI to be written out, and the words appear in the field for you to edit. We never receive or store the audio, and the words are kept only if you send them.

The gesture itself needs no macOS permission and captures nothing on its own. The microphone is the only permission the app ever asks for, and it asks the first time you use voice. The assistant cannot see your screen, cannot act in your other apps, and does not run in the background.

Tools you connect

You can connect other tools so the work that comes up in them lands on your list. Nothing is read until you connect a tool. Disconnecting stops further reading and removes the stored sign-in tokens. For OAuth connections, we also request that the provider revoke the grant; you can revoke it yourself in the provider’s account settings. What we read from each, to find what people ask of you and what you have already done:

• Gmail. With your permission, read-only access to your email. We read the messages in your Primary and Updates inboxes and in threads you have written in: who sent them, to whom, when, the subject and what they say. We can search older email for context relevant to your tasks or questions and read relevant images in messages. Bulk and automated mail is normally set aside before model processing, unless the conversation, its recipients or your Gmail markings indicate it may contain work for you. We never change or delete your email or change your Gmail settings. Connecting also asks to send email on your behalf (gmail.send), which you can untick; with it, we send only the replies Augmenter drafted that you approve with Send, as you approved them, from your address in the thread they answer, and keep Gmail's id for each with the todo. We never send email you did not approve.
• Slack, Granola, Wispr Flow and Messages. The messages and meeting notes you are part of, in the same way.
• Attio. With your permission, read-only access to your Attio workspace. We read the tasks assigned to you and the notes you write, with the name of the record each is on, and can search the workspace's notes for context relevant to your tasks. We never create, change or delete anything in Attio.
• folk. With your permission, read-only access to your folk workspace, in the same way: the tasks assigned to you and the notes you write, with who or what each is about. We never create, change or delete anything in folk.

A message a todo came from, or that its notes show, is kept with the todo, with a link back to where it came from, so the todo can say who asked and what was said. During the beta we also keep the other messages your connections read, so we can see why one did or did not become a todo; see “The beta” below. If you have asked us to stop, once a message has been processed and no todo needs it, its stored source content is discarded after a two-hour processing window, during regular cleanup, and we keep only a bare record that we have seen it, so we do not read it twice. Separate records of the assistant’s work, workflow records and backups have the retention periods described below. When a message carries an image, the language model reads it into words, and we keep a private copy that only you can see for as long as we keep the message. Your Mac sends a few of the texts before each text, so a short reply is read with what it answers; those go when the text does. While your Mac is awake and Messages is connected on it, the assistant can also search your older texts there, the way it searches your email: your Mac answers with the few texts that match, and we use them and let them go within minutes.

From what we read we remember who people are and who you talk with, so the same person is one person across your tools and two people with the same name are not mixed up, and we learn about your work: who the people and organizations you deal with are to you, what you are working on, and how you like things done, so the todos and briefs we write understand it. To start, we read the last 14 days of each tool you connect to learn from them, and keep none of those messages: only who is in them and what we learned. For Messages, WhatsApp and Telegram, your Mac reads those days where they are kept on it and sends them to us once to learn from, in the same way. We remember facts, never messages, and never passwords, codes or account numbers. What we learned stays with your account after the messages it came from are gone, including after you disconnect the tool that taught it, until you delete your account. Disconnecting deletes that connection’s stored messages, image copies and sign-in tokens. Todos, their notes, your saved assistant conversations and their history remain part of your board, including text derived from those messages, until you delete them or your account. What a connection brings in is sent to the language model to decide what belongs on your list, under zero data retention, and during the beta it also reaches our product analytics and session recordings, as described below. Sign-in tokens for your tools are encrypted before they are stored.

Augmenter’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Google user data is used for the email productivity features you can see in Augmenter. It is not sold, used for advertising, or used to train or improve general-purpose AI models. Human access to Gmail data, including data derived from it, requires your documented, explicit permission. Joining the beta and connecting Gmail gives that permission, as the app says before you connect: the people who build Augmenter may read the email Augmenter processed for you, to fix what it got wrong. You can withdraw it at any time by writing to us.

How the product is used

We use PostHog, a product analytics service, to understand how augmenter.com and the apps are used and to find out when something breaks. From the website it gets which pages are visited and from what kind of device, with a first-party identifier so repeat visits can be told apart. From the apps and the assistant service it gets what you did and wrote in Augmenter, tied to your account: the todos you added or changed and what they say, what you asked the assistant, by typing or aloud as a transcript, and what it answered and did, how long things took, what they cost, and errors. During the beta it also gets what your connections brought in and what the assistant read of it: other people's messages, email, meeting notes and documents, and the pages your tasks' browser read. Voice audio is never recorded.

It also records your sessions, meaning a replay of the screen as you used the apps, so we can see what worked and what broke. A replay shows what was on screen, including your lists and your conversations with the assistant, and the messages, email and meetings your notes show.

The beta

Augmenter is in beta, and we learn from how it handles real work. So for everyone in the beta, the people who build Augmenter can see what your connections bring in, in analytics, session recordings and the assistant’s records, and we keep the messages your connections read and the assistant’s records of its work, so we can find out why it did what it did and test changes against it. This is a condition of the beta. If you would rather we did not, write to us: we will stop for your account, discard the messages no todo needs, and let its records expire as below. Content from before you asked stays in analytics until it is deleted on its usual schedule, or sooner if you ask.

Here is what we do with it and what we will never do. We look at it to make the product better: to see what the assistant gets wrong, what people try that does not work, and what is slow or broken. We do not sell it, we do not share it with advertisers or data brokers, we do not train models on it or let anyone else, and we do not use it to advertise to you. There are no advertising trackers and no social pixels anywhere. Only the people who build Augmenter can see it, and only to do that work. You can have all of it deleted by writing to us. Our hosts keep ordinary server logs, including IP addresses, for a short period so the service can be operated and defended.

When you write to us

Support, security, and press mail comes to one address, and we keep what you wrote so we can answer it.

How we use it

• To run the product. Keeping your lists, syncing them between your devices, and letting the assistant do what you ask.
• To answer you. Support and security mail.
• To keep it working and safe. Diagnosing failures, preventing abuse, and meeting legal obligations.

Augmenter is free today, so there is no billing and nothing about you goes to a payment processor. When paid plans arrive, the processor we use will be named in this policy before any charge is made.

Where it lives and how it is protected

Your account and your lists live in Supabase in the United States, encrypted in transit and encrypted at rest. The assistant runs on Vercel, also in the United States.

This is not end-to-end encryption. Our systems hold the keys, which means they can read your lists. That is how sync works and how the assistant can act on a list for you. We would rather say so plainly than let the word encrypted do work it cannot do.

We hold no security certifications and will not imply otherwise.

Every company that touches your data

This is the whole list. If it changes in a way that matters, we will say so here before the change takes effect.

• Supabase. Holds sign-in accounts, your lists, their history, your conversations with the assistant, and the messages your todos keep, in the United States.
• Vercel. Hosts augmenter.com and the assistant service, runs the sandbox the assistant works in, and routes model requests through its AI Gateway. Its durable workflows also keep step inputs and outputs, which can include email content and model responses, while the workflow runs and for seven days after it finishes.
• OpenAI. Provides the language models behind the assistant, through Vercel’s gateway, under zero data retention, and the voice model, directly. It receives your request text, any images you attach or your connections bring in, what your connections read, your voice audio, and the summary of the list needed to act on it. Even under zero data retention, OpenAI checks images for abuse and keeps any it flags for review. Your Mac or iPhone sends voice audio straight to OpenAI; the transcript of anything that needs the list comes back through our assistant service. Our provider contracts do not permit training on your content, and we do not train on it.
• Anthropic. Provides the model that reads what your connections bring in and decides what belongs on your list, through Vercel’s gateway, under zero data retention. It receives those messages, your list, and what it looks up in your connections to decide. Our provider contracts do not permit training on your content.
• TypeSafe. Provides the model that makes the assistant’s quick decisions, such as which section a todo belongs in and whether a message is an ask, through Vercel’s gateway, under zero data retention. It receives the question and the part of your list or message it is about.
• Browserbase. Runs the browser that reads websites for your tasks and that you sign in to websites with. It receives the pages that browser opens, whether or not you are signed in to the site, and what you type into its live view, your password included, which goes to that site and never to Augmenter. It keeps your saved sign-in for each site, encrypted, until you remove it or delete your account. We turn its recording and logging off, so it keeps no recording of what you saw or typed, only a record of each browser session (when it ran and for whom) for its plan’s retention period, up to 30 days. Its browsers run in the United States.
• Google. Signs you in, and, when you connect Gmail, gives us read access to your email; if you allow it, sends the replies you approve.
• GitHub. Hosts the Mac installer and the update feed. It sees your Mac’s IP address when you download the installer and each time the app checks for an update, which is on launch and every four hours.
• Apple. Distributes the iPhone app through the App Store.
• PostHog. Holds the product analytics described above: usage events and error reports from the website, the apps and the assistant service, with what you did and wrote in Augmenter and, during the beta, what your connections brought in, and session recordings. In the United States. Its contract with us forbids it from using any of it for its own purposes.
• Our email provider. Carries support mail. Gets your email address and what you wrote.

What we do not do

• We do not sell your personal data, and we never have.
• We do not share it with advertisers, data brokers, or anyone building a profile of you.
• We do not train models on your lists or your conversations with the assistant, and we do not let anyone else train on them.

If a government or a court demands your data, we will tell you unless the law forbids it, and we will give only what we actually have.

Retention and deletion

Your lists, your conversations with the assistant, and the messages your todos keep are kept until you delete them or until your account is deleted. A todo you delete can be brought back with undo for 30 days; after that its history is deleted too, along with its files and the messages it kept. During the beta, the messages your connections read and what the assistant recorded about its own work on your list are kept until you delete your account or ask us to stop; once you ask, messages no todo keeps are discarded after the processing window described above and the assistant’s records are deleted after 30 days. A website you have signed in to through Augmenter stays signed in, saved with Browserbase, until you remove it or delete your account; removing it has our daily cleanup delete the saved sign-in there, trying again each day until Browserbase confirms it is gone. Product analytics are kept for up to two years and then deleted, or sooner when you ask. Our hosts keep ordinary logs, and our database keeps backups, for a short period after something is deleted, so the service can be operated and recovered. Vercel’s durable workflow records remain while a workflow runs and for seven days after it finishes under our current hosting plan. Deleting a todo or disconnecting a tool does not immediately remove copies from those records, backups or analytics. We keep support and security mail for as long as we need it to handle the thing you wrote about, and we will keep billing records for as long as tax law requires once there are any.

There is no in-app account deletion yet. Write to hello@augmenter.com and we will delete your account and your data within 30 days. We do not charge for this and we do not make it hard.

Your rights

Anyone, anywhere. Whatever the law where you live says, you can ask us what we hold about you, ask for a copy in a portable form, ask us to correct it, ask us to delete it, or withdraw a consent you gave. Write to hello@augmenter.com and we will do it.

Europe and the UK

If you are in the EEA, the UK, or Switzerland, we rely on these legal bases:

• Contract. Running your account, keeping and syncing your lists, letting the assistant act, and answering support.
• Consent. Voice, and, during the beta, letting the people who build Augmenter see what your connections bring in, which you give by joining it. Withdraw either at any time by writing to us, or voice by turning the microphone off for Augmenter in macOS System Settings, or on iPhone in Settings › Augmenter › Microphone. Withdrawing it does not undo processing that was lawful before.
• Legitimate interests. Keeping the site and the service secure and working, and understanding how they are used, including the product analytics described above. You can object to that processing at any time by writing to us, and we will stop collecting it for your account.
• Legal obligation. Tax, accounting, and responding to lawful demands.

You have the right to access your data, correct it, delete it, restrict or object to processing, take it elsewhere in a portable form, and withdraw consent. You also have the right to complain to your data protection authority, though we would rather you told us first.

California

In the past twelve months we have collected these categories of personal information: identifiers, such as your name, email address, and profile picture from Google; commercial information, which will mean what you bought once paid plans exist; internet activity, such as page and feature usage, server logs, and session recordings; audio, when you talk to the assistant; and the contents of your own files, meaning the lists and todos you write, your requests to the assistant, and the messages your connected tools bring in. Each is collected for the purposes described above, from you or from your own devices.

We do not sell personal information and we do not share it for cross-context behavioral advertising, as those terms are defined by California law. You have the right to know, to delete, to correct, to opt out of sale or sharing, which is moot because we do neither, and to not be discriminated against for exercising any of it. You can use an authorized agent. Write to us and we will verify the request through the address or account it concerns.

Children

Augmenter is not for anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has given us something, write to us and we will delete it.

International transfers

We are a United States company, and your data is stored and processed in the United States. If you are outside the United States, using Augmenter means your data goes there. We rely on the standard contractual clauses, and the UK addendum where it applies, for those transfers.

Changes to this policy

We will update this page as the product changes, and the date at the top will change with it. Material changes to what we collect, who touches it, or how long we keep it will be described plainly and announced before they take effect, not buried in a diff.

Contact

Write to hello@augmenter.com with any privacy question or request, including the rights above. See Contact for how to reach us about anything else, and Terms of use for the rules around the product itself.