Privacy Policy

My Buddy is provided by Axiom Ops. It is a personal assistant for everyday tasks: asking questions, understanding documents and email, filling and signing forms, printing, and asking a family member for help.

My Buddy is offered to a small number of invited people. Access is limited to email addresses that have been approved in advance.

Your account. The email address you sign in with, the name your account carries, how you sign in, and the dates your account was created and last used. Sign-in is handled by Google Firebase Authentication; we never see or store your password.

Your questions and the answers. Kept so you can read them again and continue a conversation. You can remove any conversation from your history.

Documents, photos and printouts. Files you upload or create, including completed and signed copies, kept until you remove them.

Your signature. If you save one, it is encrypted and kept apart from every document path, and it is never shared with anyone.

Voice recordings. If you speak a question, the recording is uploaded under a random name, turned into words, and deleted immediately afterwards — whether that succeeded or failed. Only the words remain, and only once you choose to send them. Recordings that are never submitted are removed automatically.

Things you asked My Buddy to remember. Preferences only, such as what to call you or how long you like answers. My Buddy refuses to store health conditions, medicines, passwords, card, bank, or government identity numbers as remembered information. You can see everything remembered, why it is kept, and remove any of it.

Usage records. Counts, model names, durations, outcomes and estimated cost, used to keep the service within budget. These contain no questions, answers, email contents, document contents or recordings.

Connecting email is optional. If you connect it, you grant access through Google’s own consent screen, and we request the narrowest scopes that do the job:

• gmail.modify — to read your messages so they can be shown and explained, and to tidy them: apply a label, star, unstar, archive, or move back to your inbox. This scope does not permit permanent deletion, and My Buddy has no feature that deletes email.
• gmail.send — to send a message that you have read and pressed Send on. Nothing is ever sent automatically.
• userinfo.email — to show you which mailbox is connected.

Your email is read when you open it and is not copied here. My Buddy does not keep a copy of your messages, attachments or threads. An attachment is stored only if you choose to save it to My Documents.

When you send an email, we record that a message was sent, when, the recipient’s domain, and the length of the subject and body — so a send can be traced if something goes wrong. The contents of the message are not stored.

Google gives us a long-lived refresh token so the connection keeps working. It is encrypted with AES-256-GCM before it is written to our database, stored in a location our security rules deny to every browser, and the encryption key exists only on the server.

My Buddy’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, data obtained from Google APIs is not used:

• to serve advertising of any kind
• to build profiles, or for any purpose other than providing the features you asked for
• to train generalised artificial-intelligence models
• and is never sold or transferred to anyone, except as needed to provide the feature you requested, to comply with law, or with your explicit consent

No human at Axiom Ops reads your Gmail data, except where you have given explicit permission, where it is necessary for security purposes such as investigating abuse, or where the law requires it.

Answers, explanations, drafted emails and spoken-question transcription are produced by OpenAI. What you ask, and the document or email text needed to answer it, are sent to OpenAI to produce that answer.

My Buddy asks OpenAI not to retain this content. Requests are sent with storage switched off, so conversations are not kept on OpenAI’s systems for our account, and your content is not used to train their models.

Text and images from a document, a web page or an email are treated as information to read, never as instructions to follow. If a document tries to instruct My Buddy, it is ignored and you are told.

• Google (Firebase and Google Cloud) — sign-in, database, and file storage.
• OpenAI — answers, explanations, and turning speech into words.
• Vercel — hosting and delivery of the application.
• An email delivery service — only if notification emails are switched on. Those messages contain no question, answer, document or email content.

We do not sell your personal information, and we do not share it for advertising.

You may connect a family member who can help you. Being connected does not give that person access to your account, your documents, your email or your conversations.

They see only what you attach to a help request you send them, and only for that request. You can end the connection at any time in Settings, and their access stops immediately.

• Voice recordings: deleted immediately after they are turned into words.
• Email contents: never stored.
• Conversations: kept until you remove them in My conversations.
• Documents and printouts: kept until you remove them in My Documents.
• Remembered preferences: kept until you forget them in Settings.
• Usage records: kept for cost control. They hold no private content.

To disconnect Gmail: open Settings and choose Disconnect my email. We delete our stored token and ask Google to revoke it. You can also revoke access yourself at myaccount.google.com/permissions.

To see, correct, or delete your information, or to ask for your account to be closed and its contents removed, write to support@axiomops.io. We will respond within 30 days.

Information is encrypted in transit and at rest. Sensitive credentials are encrypted again before storage with a key held only on the server. Each person’s data is isolated by security rules enforced by the database itself, not only by application code. Files are reached through short-lived links rather than permanent addresses.

No system is perfectly secure, and we do not claim otherwise. If we discover a breach affecting your information, we will tell you.

My Buddy is not intended for children under 13, and we do not knowingly collect their information.

If this policy changes in a way that affects how your information is used, we will update the date at the top of this page and, where the change is significant, tell you in the application.