Legal
Privacy Policy
Last updated 11 August 2026
CEO Sidekick is an assistant app for iPhone. To be useful it needs access to your email, calendar, files and messages. This page explains exactly what it accesses, what it does with it, where it is stored, and how to get rid of it.
Who we are
CEO Sidekick ("we", "the app") is operated by Forma. You can reach us at support@example.com about anything on this page, including a request to delete your data.
What we collect
Information you give us
- Account — the email address you sign up with, and an encrypted password (or a Google/Microsoft sign-in, in which case we never handle a password at all).
- Personalization — the answers you give during setup: your role, how you prefer to work, whether you want an assistant or a coach, and what you name it.
- Content you create — tasks, notes, journal entries, and messages you send to the assistant.
- Voice notes — audio you record in the app, and its transcript.
Information from accounts you connect
Nothing here is accessed until you connect that account yourself, and each connection can be revoked independently at any time.
| Service | What we access | Why |
|---|---|---|
| Google — Gmail | Read, organize and send messages on your behalf | To show your inbox, summarize threads, and send drafts you approve |
| Google — Calendar | Read and write events | To show your day and schedule meetings you accept |
| Google — Drive | Read-only file names, metadata and contents | To find documents when you search for them |
| Microsoft | Profile, Outlook mail read/send, calendar read/write, Teams chats and channel messages, OneDrive read-only | The same features, for Microsoft accounts |
| Slack | Channels and messages you have access to | To surface what needs a reply |
| Notion | Pages you share with the integration | Document search |
Information collected automatically
- Usage counts — how much assistant capacity you have used, so we can apply plan limits.
- Subscription status — whether you have an active plan, via our payments processor.
We do not use advertising identifiers, third-party analytics, or tracking pixels.
What we do with it
- Run the features you asked for — showing your day, drafting replies, finding files, transcribing voice notes.
- Remember context you have shared, so the assistant improves for you. Everything it has learned is visible under Memory in the app, and you can delete any entry.
- Enforce plan limits and process your subscription.
- Keep the service secure and diagnose faults.
We do not sell your data. We do not share it for advertising. We do not build profiles of you for anyone else.
Google user data — Limited Use
CEO Sidekick's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically: Google user data is used only to provide and improve the user-facing features described above. It is not transferred to others except as needed to provide those features, for security purposes, or to comply with applicable law. It is never sold, never used for advertising, and never used to develop, improve, or train generalized AI or machine learning models. No human reads your Google data except where you explicitly ask us to for support, or where required for security or by law.
AI processing
The assistant is powered by large language models we access as a service. When you ask a question, the relevant context — which may include the text of an email thread, a calendar entry, a document excerpt, or a voice-note transcript — is sent to that provider to generate the response.
We use providers under agreements that prohibit training on our customers' data. Content sent for processing is not retained by them to improve their models.
Who else touches your data
| Provider | Role |
|---|---|
| Supabase | Database, authentication, and file storage |
| Anthropic | Language model powering the assistant and coach |
| OpenAI | Speech-to-text for voice notes, and speech synthesis |
| RevenueCat | Subscription management |
| Apple | App distribution and payment processing |
These are processors acting on our instructions. None of them receives your data for their own purposes.
How it is stored and protected
- Data is held in our Supabase project and encrypted in transit and at rest.
- Access tokens for connected accounts are stored server-side and never exposed to the app or to other users.
- Row-level security is enforced at the database, so a given user's records are only ever readable by that user.
- Voice recordings live in a private bucket scoped to your user ID.
No system is perfectly secure, and we cannot guarantee absolute security. We will notify affected users promptly if a breach occurs.
How long we keep it
- Your content stays until you delete it or close your account.
- Email, calendar, file and message data is fetched live from the provider and shown to you — we do not keep our own copy of your mailbox. Portions may be cached briefly to render a screen, and appear in the assistant's conversation history where they formed part of an answer.
- Disconnecting an account deletes its stored tokens immediately and ends all access.
- Deleting your account removes your profile, preferences, memories, tasks, notes, journal entries, conversations and voice recordings within 30 days.
Your choices
- Review memory — Settings → Memory shows everything the assistant has learned. Delete any of it.
- Disconnect an account — Settings → Connections. You can also revoke access from your Google account, Microsoft, or your Slack workspace settings.
- Delete everything — from Settings, or by writing to us.
- Access or export — ask us and we will send you a copy.
If you are in the UK, EEA, or a US state with a privacy statute, you have rights to access, correct, delete, and port your data, and to object to certain processing. Exercise them at support@example.com — we will not charge you or degrade your service for asking.
Children
CEO Sidekick is for business use and is not directed at anyone under 16. We do not knowingly collect their data.
International transfers
Our infrastructure and processors may handle data in the United States and other countries. Where required, transfers are made under Standard Contractual Clauses or another approved mechanism.
Changes
If we change this policy materially, we will update the date above and tell you in the app before the change takes effect.