How Percy handles your data

Before you sign up, connect an account, or give Percy a file, here is what the current features do with your information and what their controls can remove.

This is a factual explanation of current behavior. It is not a complete legal Privacy Policy or Terms of Service. Legal terms, supported ages and regions, and a formal rights request process have not yet been established here.

Storage and AI processing

You can sign in with Google or email and password. Google sign-in is separate from authorizing Percy to read Gmail or Calendar.

Percy uses Supabase for authentication, its application database, and private file storage. Ordinary personal notes, conversations, sources, and financial records belong to their owner. Household membership alone does not reveal your private notes, messages, sources, or bank imports.

When you use chat, document reading, or other AI features, Percy sends relevant prompts, context, or submitted content to its configured OpenAI model service. These requests use store:false. That setting alone does not establish how long OpenAI retains data or whether it may use data for training; it is not a promise of no provider retention.

Public web research is on by default. For current-fact questions and accepted plan-research requests, Percy can send a minimized public query through the OpenAI Responses API and its hosted web search tool. The current read-only adapter separates the query from private conversation, files, household records, and identity before sending it. These minimization safeguards do not guarantee protection against every semantic disclosure, and do not completely bound retrieval within the provider.

Research results provide evidence for a reply; the search is not an application-side public posting. Not every conversation is searched. Percy's research telemetry does not store the query, URLs, owner ID, or private content.

Render hosts the web application and Trigger.dev runs background processing. These services can process personal data as part of operating Percy. This page does not make provider-specific retention, training, or backup deletion promises.

Connections and files you choose

Gmail

Gmail requires separate, optional Google authorization and is read-only. Percy imports message bodies from an initial recent 30-day window, then newer messages. Attachments, spam, and trash are excluded. Percy cannot send or change your email.

The supported disconnect path removes Percy's imported copy and source-derived records subject to the retained-record limits below; it does not delete or alter Gmail originals. Stopping a connection locally is different from confirming that Google removed access. Review the displayed disconnect status and, when needed, your Google Account permissions.

Google Calendar

Calendar access is optional and read-only. You choose which calendars Percy reads; the described context covers the next 14 days. Percy does not write calendar events. Google access removal can affect Gmail and Calendar together; follow the connection screen's review and status.

iCloud Calendar

Percy asks for your Apple Account email and an Apple app-specific password, not your main Apple Account password. It seals that credential for its server-side CalDAV connection and reads only selected calendars.

Disconnecting removes Percy's connected and synced data through its local path, subject to the retained-record limits below. It does not revoke or delete the app-specific password at Apple. You can revoke that password in Apple account settings.

Photos, PDFs, text, and CSV

Percy stores original uploads in private application storage and may send relevant file or page content to its configured model service for reading. Extraction provides proposals and evidence. It does not verify that a bill is paid or that a document is complete.

Deleting a source removes it through the supported source paths. It does not rewrite earlier chat answers or erase every derived record. Sharing an original bill file is a separate, explicit choice described below.

Bank linking

If bank linking is presented and enabled for your account, it is a separate opt-in provider flow. Plaid integration code and Sandbox tests do not establish production institution access or coverage. Test and Sandbox records are simulated, not real balances. This page does not promise live bank availability, coverage, or accuracy.

Learning, deletion, and export

Automatic learning is on by default. Percy may derive private tasks, routines, preferences, or source-linked facts from conversations and connected sources. You can review, correct, confirm, or forget learned items, or pause learning. Pausing new learning does not erase existing records, previous chat answers, or facts you confirmed or corrected.

Deletion is scoped to the action you take. Confirmed financial entries, confirmed or corrected learning, and previous chat answers can remain after their source is removed. Removing a source also does not retract a copy deliberately shared into an independent household record. These are separate stored records; their presence does not mean the deleted source still exists.

Your owner-scoped export is a snapshot of supported data. Its download link is available for a short time. An export is not account deletion, and is not a guarantee of a complete export or complete erasure.

Full account closure and cleanup across providers and stored objects are not yet fully available or verified. Source deletion is not account-wide erasure. Percy does not promise a deletion deadline or that every provider copy or backup has been erased.

Supported plans have explicit audience and role permissions for plan information. Those permissions do not grant access to all your private notes, conversations, source files, or financial accounts.

Sharing a bill requires its own preview, exact recipient and field set, and your approval as owner. Original files are included only when you individually select them. A file can contain more information than the bill fields shown in the preview.

A plan audience link is not consent to share bills, bank data, or original files. Revoke or stop-sharing controls affect supported Percy access; they cannot retract a copy someone already downloaded or information they already saw.

Product feedback

If you explicitly ask Percy to send product feedback, or assent to the displayed report, Percy submits a concise, sanitized title, summary, and category to a private GitHub issue. It does not automatically attach your profile identity, transcript, files, calendar, email, or financial context.

GitHub feedback records are stored separately and may remain after the originating conversation is deleted. A report stays queued if delivery credentials are missing; it is filed only after a GitHub receipt exists. This is a product feedback path, not customer support or a guaranteed response channel.