Privacy Policy

Remy (“Remy,” “we,” “us”) is an AI-powered coaching service delivered over text message. This policy explains what we collect, how we use it, and your choices. Questions: remyadhd@gmail.com.

Who can use Remy

Remy is for adults 18 and older. We do not knowingly collect information from anyone under 18.

What we collect

We collect only what's needed to run the service:

• Contact & account info: your name, email, and (once you verify it) your phone number.
• Your messages: the texts you send Remy and the texts Remy sends you, including the goals, tasks, schedule, and preferences you choose to share.
• Usage signals: task completions, timing, and similar activity Remy derives from your normal use, to make its coaching more relevant.
• Calendar events — only if you choose to connect Google Calendar. See the section below for exactly what we read and store.
• Payment info: handled by Stripe, our payment processor. We do not store your full card number; we store a Stripe customer/subscription reference and your plan status.

How we use it

To deliver and improve your coaching: to send check-ins and reminders, track your tasks and goals, personalize Remy's responses over time, process your subscription, and respond to support requests. We do not sell your personal information, and we do not use it for third-party advertising.

How your messages are processed

Remy uses third-party providers to operate. Your messages are delivered over iMessage or SMS/RCS through LoopMessage, generated using AI models from Anthropic, and stored in our database hosted on Supabase (United States). These providers process data on our behalf under their own terms. AI-generated responses can be imperfect; use your own judgment.

Google Calendar (optional)

Connecting Google Calendar is entirely optional and off by default. Remy works fine without it, and you can disconnect at any time.

What we access. We request a single permission, calendar.events.owned, which lets Remy see, create, change, and delete events on calendars you own. We read only your primary calendar, and only a rolling window of roughly the next two weeks. We do not read calendars other people have shared with you, and we do not touch anything outside that window.

What we store. For each event in that window we store the title, start and end time, location if there is one, whether it is an all-day event, and whether you have marked it busy or free. This copy is refreshed continuously and events drop out of it as they fall outside the window.

How it is used. Event titles and times are included in the information sent to our AI provider so Remy can work around your real day — avoiding a reminder in the middle of a meeting, proposing tomorrow's plan into time you actually have free, and adding events when you ask it to. Our AI provider does not use data submitted through its API to train its models. Your calendar data is never sold, never used for advertising, and never shared with anyone beyond the service providers listed above.

How it is protected. Calendar data is encrypted in transit and at rest. The tables holding your events and your Google OAuth tokens have row-level security enabled with no public access policies, so they are unreachable with any client-side key and readable only by our server-side processes. Tokens are never sent to your browser and never written to logs. See Security and data protection below for the full list.

How to disconnect. Disconnect from your account page at any time. We immediately revoke our access with Google and delete our stored copy of your events. You can also revoke access directly at myaccount.google.com/permissions. Deleting your Remy account does both automatically.

Sharing

We share data only with the service providers above (LoopMessage, Anthropic, Supabase, Stripe, Google if you connect your calendar, and our email provider) as needed to run Remy, or when required by law. We never sell your data.

Retention

We keep your account and message history while your account is active so Remy can stay useful. You can delete your data anytime from your account page, by emailing remyadhd@gmail.com, or by texting STOP and requesting deletion.

Your choices

• Stop texts: reply STOP at any time to opt out; reply START to resume. You can also pause from your account page.
• Access or delete: delete your data from your account page, or email us to request a copy.
• Cancel: cancel your subscription anytime (see Terms).

Security and data protection

We protect your information — including sensitive data such as your messages and connected calendar — with the following measures:

• Encryption in transit. All traffic between your device, our servers, and every third-party provider we use is encrypted with TLS (HTTPS). Unencrypted connections are not accepted.
• Encryption at rest. Your data is stored in a managed PostgreSQL database hosted by Supabase in the United States and is encrypted at rest.
• Access control. Tables holding sensitive data — including calendar events and OAuth tokens — have row-level security enabled with no public access policies. They cannot be reached with any public or client-side API key and are readable only by our server-side processes. Administrative access is limited to the operator of the service, on accounts protected by two-factor authentication.
• Credential handling. OAuth tokens for connected accounts are stored server-side only. They are never sent to your browser, never written to logs, and are revoked with the provider and deleted when you disconnect or delete your account.
• Data minimization. We request the narrowest permissions each feature needs, and store only what those features use — for calendar, a rolling window of roughly two weeks rather than your calendar history.
• Deletion. Deleting your account removes your data from our database and revokes any third-party access grants. Disconnecting a single integration deletes the data associated with it immediately.

No system is perfectly secure. Please share only what you're comfortable sharing over text.

Changes

We may update this policy; we'll post the new date here and, for material changes, let you know.