Privacy Policy.

Neeos is a personal assistant app for iPhone and iPad. It gets to know you: it remembers lasting facts about you from what you tell it, reads the notes and documents you give it, and answers from them. To answer, it uses AI models from two companies, OpenAI and Anthropic. This policy explains what data Neeos collects, how it is used, who else receives it, how it is stored and protected, how long it is kept, and the choices you have.

1. Who operates Neeos, and what this policy covers

Neeos is operated by its developer (the “Service”, “we”, “us”). If you have any question about this policy or your data, contact us at jake@neeos.ai.

This policy covers the Neeos app for iPhone and iPad — whether you installed it from the App Store or as a TestFlight beta — including its share extension and widgets, and the Neeos service it connects to. It describes the version of Neeos available to the public. Some features described in earlier versions of this policy are not part of that version; see section 10. The additions, which reach only accounts we invite, are Gmail, on iPhone, iPad and the Neeos app for Mac (see “Gmail” in section 7), and the calendar, Contacts, meeting recording, connector and Neeos Life exceptions described in sections 2, 6 and 7. Accounts we invite can also try other features before they reach the public version.

2. Information we collect

Neeos collects the information below. Some of it is needed to run your account at all; most of it is what you choose to put into Neeos.

• Account information — when you sign in with Apple, Apple gives us an identifier for your Apple Account that is unique to Neeos, and your email address, which may be a private relay address if you chose Hide My Email. We store both, plus an internal account ID and, where Apple provides one, a token we keep only so that Neeos’s Sign in with Apple access can be revoked when you delete your account. Apple may also offer your name at sign-in; Neeos does not currently store it.
• Subscription records — if you subscribe to Neeos Monthly or restore a purchase, Apple sends us a signed record of the transaction. We keep your plan, its status, when it renews and Apple’s transaction identifier, so we can unlock your plan. Apple takes the payment; we never receive your card or payment details.
• Device and notification information — if you allow notifications, we store the push token Apple gives your device, together with the app version and build, your iOS version and your device model, so we can deliver notifications and work out why one did not arrive. A device’s token is removed when you sign out on that device.
• Crash and hang reports — if the app crashes, freezes, uses too much processing power or writes too much to storage, it sends us a diagnostic report about it (Apple’s, or, for some freezes, the app’s own), usually the next time you open the app. A report can include where in the app’s code it happened, what kind of problem it was, when it happened and how long it lasted, the app version and build, your iOS or macOS version and device model, and the app’s own labels for the screen that was open and its last few actions. Once a day it also sends counts of how often and how the app closed, how often it froze and for how long at most, and its peak memory use. These reports contain none of your content. They are sent from every version of the app, whether or not you allow notifications.
• Your content — what you put into Neeos or ask it to make: notes; documents, files and photos you add to your Vault, including details such as dates, amounts and account references read from bills, receipts or statements; tasks, goals and the names of people you add to a task; projects; if you turn on Neeos Briefing, the calendar events, tasks, notes and documents it reads (section 7); your conversations with Neeos, including files and photos you attach, a short description Neeos writes of each photo you send (kept with the photo, and encrypted on an encrypted account), and images Neeos makes for you; and anything you share to Neeos from another app. If you report a reply from Neeos as inappropriate, we keep the reply you reported and any reason you give, with your account.
• Facts about you (memories) — the entries on the “You” screen. You can add them yourself, and Neeos also saves them automatically from your messages. They can include your name, your work, where you live, the people in your life, your preferences and goals, and health or fitness facts you mention, such as a condition, an allergy or a training plan, and other sensitive details you mention about yourself, such as a pregnancy, your relationship status, or your religion or beliefs. See section 5.
• Voice — Neeos does not listen unless you start dictation, a voice conversation or, on an account we invite to Work, a meeting recording. Your recording is sent to OpenAI to be turned into text. From dictation or a voice conversation, the words become a message like any typed one, and Neeos does not keep the audio; see section 7. A meeting recording’s audio is kept on the device that recorded it, and goes through our server, which does not keep it, to OpenAI to be turned into text; our server then sends the transcript, with the recording’s time, to OpenAI to prepare a meeting plan. The transcript is saved as a note and the plan is kept with your account, both encrypted with your key (section 4). Our server’s working copies of them, also encrypted with your key, are deleted once your device has saved them, or otherwise 7 days after they were last updated.
• Searches and web pages — web searches the assistant runs to answer you; searches for a photo on the web; and, when you use “Ask about this page” in Neeos’s web reader, that page’s address, title and text. Pages you open in the web reader are loaded by your device directly from the website, as in a browser, and so are the previews of links in your notes, including notes Neeos saved for you, and of a link in a message you send.
• Activity log — a record of the consequential things that happen in your account, such as a note, document or memory being created, changed or deleted, or AI data sharing being turned on or off: what kind of thing happened, to which item, whether you, the assistant or the system did it, and when. It is designed to record events, not your content. On an encrypted account, encrypted content that reaches it is withheld rather than recorded; on an account without encryption, an entry can include a short label, such as the title of a document or the words of a photo search. The activity log is kept while your account exists, including entries about items you have since deleted, and is deleted with your account.
• AI usage records — for each request Neeos makes to an AI provider on your behalf: the time, what kind of request it was, which model answered, which conversation it was part of, how much text it used and what it cost. These records hold no content: not your message and not the reply.
• Server logs — our servers record requests and errors so we can run the Service securely. These logs identify your account by its internal ID and are written not to contain your content. Our load balancer can also record the IP address a request came from, the time, and the app and iOS version your device reports.
• Gmail, if we invited your account and you connect it — see “Gmail” in section 7 for what Neeos reads and where it goes. Neeos does not read your mail otherwise, except through Neeos Life if you link it and turn that on (see “Your contacts, email or text messages” below), or through a connector you add yourself (section 6).

What Neeos does not collect

• Your location. Neeos never asks for it. Before a photo or video leaves your device, Neeos removes the location stored inside the file (its GPS coordinates and any place names). The weather Neeos shows is looked up from your device’s time zone, not from where you are.
• Your calendar, unless you turn on Neeos Briefing. Neeos reads your calendar only for the Briefing, and only with your permission in iOS. “Add to Calendar” opens Apple’s own event screen and does not read your calendar. An account we have invited has these exceptions, all with your permission in iOS. In a conversation, the assistant can choose to look in your calendar on your device, and what it finds, which can include an event’s notes and, on some accounts, the names of other people invited, goes through our server to the AI provider answering you. When Neeos shows an event as a card in a chat, your tap can add, change or delete it directly, without Apple’s screen. Your device reads your calendar to do that, and that read sends nothing to us. In a voice call, Neeos can also add, change or delete an event directly, without Apple’s screen, after it reads the change back to you and you say yes; what your device finds in your calendar for that goes through our server to the AI provider answering you, like the rest of the call. Neeos’s cards can also show what your device reads from your calendar, such as your events or when you are free, and that read sends nothing to us either.
• Your contacts, email or text messages. The Neeos app for iPhone and iPad does not read them. An account we have invited has these exceptions. If it connects Gmail, Neeos reads that email (section 7), and a connector it adds can read what the connected service holds, which can include email (section 6). When you ask Neeos to write to someone, it looks them up in Contacts on your device, with your permission in iOS, and sends nothing from Contacts to us, unless a voice call reads the address back to you before sending (section 7). And if it links Neeos Life on a Mac and turns on “Chat can use my mail & messages”, that Mac finds short excerpts of matching mail, messages and other items on it to help answer a chat; they go through our server to the AI provider with that message, our server does not keep their text, and the reply can repeat them like any chat.
• Health data from Apple Health or wearables. This version of Neeos does not use Apple Health (HealthKit) and cannot connect to a fitness wearable.
• Advertising or tracking identifiers. There is no advertising identifier, no advertising or analytics code from other companies in the app, and no tracking.
• Payment details. Apple handles payment.

3. How we use your information

We use your information to provide Neeos to you, and to run and improve it:

• To store and sync your notes, documents, tasks, goals, conversations and memories across your devices, and to build the index that lets Neeos find things in them by meaning.
• To answer your questions and do what you ask in chat — including searching the web when a question needs current information, reading documents and photos you add, and making images you ask for — using the AI providers named in section 7.
• To remember lasting facts about you, and to give your conversations titles.
• To verify your subscription, and to apply your plan’s limits: the number of free AI messages a day, and limits on how much AI any one account can use in a short period.
• To send the notifications you have turned on.
• To write your Neeos Briefing at the time you choose, if you turn it on.
• To operate, secure and troubleshoot the Service, and to prevent abuse.
• To understand how Neeos is used — for example what AI costs per account, and whether new accounts get a working first answer. We do this from our own account, usage and activity records — our internal cost report identifies an account by its email address — not from your content, and not with any third-party analytics service.

We do not use your information for advertising, do not sell it or share it with data brokers, do not use it to track you across other companies’ apps or websites, and do not use your content to train AI models.

4. How we store and protect your data

Encrypted with a key only your devices hold. When you set up Neeos, your device creates an encryption key. Your notes; your Vault documents, their text and their details (titles, amounts, tags and the like); your conversations and their titles; your memories; the titles of your tasks and goals, your task notes and the names of people on your tasks; your projects’ names and instructions; and the search index built from all of these are encrypted on your device with that key before they are stored. Our servers store them and cannot read them. Your index is built on your device and stored on our servers in that encrypted form; no third party is involved in building it. The key is kept in your device’s keychain and, if you use iCloud Keychain, synced by Apple to your other devices. The recovery key you are shown at setup is the only other way back in: we do not have your key, so we cannot recover your encrypted content if you lose every device and your recovery key. Setting up encryption is part of creating an account; an account created before encryption was available keeps its content protected by our storage encryption (below) until encryption is set up on it.

What this encryption cannot cover, and why. We say so here rather than let “encrypted” imply something it does not cover.

• What the AI has to read. A model cannot answer a question it cannot read. So when you send a message, your device sends the question and the parts of your data needed to answer it to our server readable, for that request, and our server passes them to OpenAI or Anthropic (section 7). A new reply from the AI is saved on our server readable at first, and your device replaces it with an encrypted copy the next time it connects.
• Voice is not sealed on your device before it leaves — a recording nobody can open cannot be turned into words.
• Files you attach to a chat, and files Neeos makes for you (such as images and PDFs), are handled readable while the AI works with them. On an encrypted account, current versions of the app store chat attachments and the files Neeos makes encrypted with your key. Some files are protected only by our storage encryption (below) instead: a file attached in an incognito chat, which is kept readable until that chat is deleted; files attached from older versions of the app; and files, including Vault documents, stored before encryption was set up on your account. Earlier stored versions of a file can also remain in that form for a time (section 8). On an encrypted account, files cannot be added to a project; on an account without encryption, a project file’s text is kept protected by our storage encryption.
• What the Service needs to run your account: your email address and Apple identifier (sign-in has to work before any key exists), your subscription record, your push token and device details, your crash and hang reports, your AI usage records, the structure of your activity log, the sign-in of a connector you add (section 6), and structural details of your content such as dates, due dates, goal targets, units and metrics, sort order and folder layout, together with a few labels and preferences such as your app color and a memory’s sensitivity and domain. If you use Neeos Briefing, this also includes its times and time zone, the search words of news topics you add to it, any style note you apply to it, and, for up to about 12 hours after your Briefing time, the web results found for its topics. These are protected by our storage encryption, not by your key.
• On your device, outside Neeos. If you turn on Siri & Spotlight in Neeos’s settings, the titles and text it lists there are copied, readable, into your device’s own search index, outside Neeos’s encryption, where Siri, Spotlight and Apple Intelligence can use them under Apple’s privacy policy; Neeos itself sends that copy nowhere, and turning the setting off removes it. If you ask Neeos something through Siri or Shortcuts, Apple’s Siri handles your spoken question and reads the answer to you, under Apple’s privacy policy. If you add a Neeos widget, what it shows (such as your next task) is saved on your device for the widget, including on your Lock Screen.

Where and how it is stored. The Service runs on Amazon Web Services in the United States. Data is encrypted in transit (TLS) and at rest; our database and file storage are encrypted with a key we manage in Amazon’s key management service. Our service credentials and API keys are held in a dedicated secrets store and are never exposed in the app. Access to the Service is protected by authentication, and each account can reach only its own content. A small number of administrator accounts, used by us to run the Service, can see account-level records — such as email addresses, subscription status and AI usage — but not the content your key encrypts. On an encrypted account, a notification that shows your words (such as the start of a reply) is sealed to your device’s key before it is sent; Apple’s push service carries only a generic line. The full technical detail is on the private architecture page.

5. What Neeos remembers about you

Remembering you is what Neeos is for, so it happens automatically. When a message you send looks like it states something lasting about you — where you work, a preference, a goal, a person in your life, a health condition, an allergy, or an exercise habit — Neeos sends that message to OpenAI to pick out the fact, and saves it as a memory. The assistant can also save a memory while it answers you, and if you paste in text about yourself for Neeos to learn from, OpenAI reads it to pick out facts. Neeos may also check a new fact against similar ones you already have, so an outdated fact can be replaced.

Memories are used to personalize Neeos’s answers: the ones that matter most go with every message, as the short profile described in section 7.

• See, edit and delete. Every memory is on the You screen, where you can read, add, edit or delete any of them. Nothing Neeos remembers about you is hidden from you.
• Deleting a memory stops Neeos using it straight away. The deleted entry is kept with your account, encrypted like your other memories, under “Recently deleted” on the memories screen, so that it can be restored. The same happens when Neeos replaces an outdated fact with a newer one. There is currently no way to erase a single memory permanently: deleted memories are erased when you delete your account.
• Chatting without memory. An incognito chat saves no memories, gets no title, does not use your memories, notes or documents, and is deleted when you leave it; any left behind (for example, if the app closes first) is cleaned up automatically later.
• Turning AI off. Settings → AI data sharing turns AI off, which also stops automatic memory (section 7).

6. How we share information

We do not sell, rent or trade your personal data, and we do not share it with anyone for their own advertising or marketing. We share it only with the service providers below, or with services that you connect yourself, only as needed for the purpose given, and only under the terms described here and in section 7:

• Amazon Web Services, which hosts the Service in the United States.
• OpenAI and Anthropic, the AI providers described in section 7.
• Apple, for Sign in with Apple, notifications and App Store purchases. Place names and street addresses mentioned in a reply may be looked up with Apple Maps, from your device, to show them on a map. Apple’s own privacy policy covers what Apple does as the platform.
• Openverse, a public image library: when Neeos looks for a photo on the web, usually because you asked to see something, our server sends it the search words, and then downloads the picture you get from wherever it is hosted. Neither receives your account details.
• Open-Meteo, a weather service: our server asks it for the weather at a city matching your device’s time zone. It receives only that city’s coordinates, and nothing about you.
• Websites an answer cites: when an answer cites web pages, our server — not your device — fetches each page’s icon and preview image, so those sites see our server and not you.
• Connectors you add yourself, on an account we invite: if you add a connector, the assistant can send that service requests made from your conversation, such as a search, and our server holds the connector’s sign-in, encrypted under a key the server holds rather than yours, because our server is what calls that service. Deleting your account deletes the sign-in. That service’s own terms cover what it receives.

Amazon Web Services, OpenAI and Anthropic process your personal data on our behalf. Each is bound by its terms with us to use your data only on our behalf — to provide its service to us and, in the case of OpenAI and Anthropic, to keep it for the limited periods described in section 7 to monitor for abuse and meet legal requirements — and each provides the same or equal protection of your data as this policy describes. Openverse receives only the words of a photo search, and Open-Meteo only a city’s coordinates; both requests come from our server, not your device, and carry nothing that identifies you. We may also disclose information if the law requires it.

7. AI processing (important)

Nothing is sent to OpenAI or Anthropic until you agree. Right after you sign in, Neeos shows a screen that names both companies and what they receive, and asks for your permission. If you choose “Not now”, you can keep using Notes, the Vault and Momentum without AI. You can turn AI on or off at any time in Settings → AI data sharing; while it is off, the app sends nothing to either company and our server refuses AI requests for your account.

What is sent with a message. Your question, the conversation you are having, and anything you attach. With every message Neeos also sends a short profile of you — the saved facts, preferences and goals about you that matter most (which can include health or fitness facts you have told it), and how you have asked it to respond — plus the parts of your notes, documents and tasks needed to answer. Your library and your index as a whole are never sent; only what is needed for that message. We do not send your email address or account ID with these requests.

Which company does what.

• OpenAI answers your questions, including running the web searches the assistant makes; picks out lasting facts about you from your messages (section 5) and checks them against similar saved facts; reorganizes your memories when you ask it to; gives new conversations a title on an account without encryption (on an encrypted account, titles are made on your device by Apple’s on-device model, where it is available); helps edit a note or document when you ask the assistant inside it, which sends that note or document with your request; turns your speech into text and replies into speech; prepares a meeting plan from a meeting transcript, on an account we invite to Work; holds live voice conversations; makes and edits images you ask for; reads text you paste for Neeos to learn about you; and, on an account without encryption, reads the PDFs you add to a project and the text and PDFs of documents you add to the Vault so Neeos can suggest their title, date and other details.
• Anthropic (Claude), on an account without encryption, reads images you add to a project, and photos and images of documents you add to the Vault, to extract their text and details.

We may change which of the two companies handles a feature, but Neeos sends your data to no AI company other than these two, apart from a connector you add yourself (section 6). (Siri and Apple Intelligence on your own device are covered in section 4.) On an encrypted account, a document you add to the Vault is normally read on your device, by Apple’s on-device tools, and is not sent to an AI company to be read; only if a document reaches our server before your device could read and encrypt it is its text read by one of these companies instead, as it would be on an account without encryption. A document you attach to a chat, or ask about in chat, is sent like anything else a message needs.

Live voice. In a live voice conversation, your phone connects directly to OpenAI’s Realtime service and streams your voice to it, so OpenAI also sees your device’s IP address; Neeos never receives the audio. Your words come to Neeos, which answers them the same way it answers a typed message, and the answer goes back to OpenAI as text to be spoken. The facts in your profile are included in the instructions for the call so the conversation is about you. For dictation, and for voice conversations when a live one is not available, the recording goes to our server and on to OpenAI to be turned into text, and the reply Neeos speaks is sent to OpenAI as text to be turned into audio. Neeos does not keep the recording of a dictation or voice conversation; what is stored is the message, as if you had typed it.

How these providers protect your data. OpenAI and Anthropic process what Neeos sends as our service providers, acting on our behalf, through their business API services and under their terms with us: to provide these features to you, and to keep it for the limited periods below to monitor for abuse and meet legal requirements.

• No training. OpenAI’s API data policy says it does not use data sent through its API to train its models unless a customer opts in to share it; Neeos has not opted in, and data sharing is turned off for our account. Anthropic’s Commercial Terms say it may not train models on customer content, and they incorporate Anthropic’s Data Processing Addendum.
• How long they keep it. For text requests — answers, and reading text and documents — Neeos asks OpenAI not to store them; requests for speech, transcription, live voice and images carry no such instruction and are kept under OpenAI’s standard terms. OpenAI says it keeps abuse-monitoring logs, which can contain requests and replies, for up to 30 days, unless longer is required by law or reasonably necessary to protect its services or others from harm. OpenAI may also hold the first part of a recent request in a short-lived prompt cache, for up to 24 hours, so that repeated requests are faster; Anthropic may likewise cache the first part of a request for up to an hour. Anthropic says it deletes API inputs and outputs within 30 days of receiving or generating them, and keeps them for up to 2 years if they are flagged for a policy violation. These are the providers’ own published terms, which we do not control: OpenAI API data policy, Anthropic Commercial Terms.
• Equal protection. Under these terms, OpenAI and Anthropic provide the data Neeos sends them the same or equal protection as described in this policy.

Neeos Briefing. Neeos Briefing is a summary of your day that Neeos writes at a time you choose. It is part of Neeos Monthly and is off until you turn it on. When you turn it on, Neeos shows you what it will send and asks you to agree. Each day at your Briefing time, even while your iPhone is locked (as long as it has been unlocked once since it last restarted), your iPhone sends Neeos what you allowed it to read: the titles, times and places of your calendar events from 2 hours ago to 2 days ahead (never who is invited or an event’s notes); your open tasks that are due in the next 2 days, overdue or undated; up to 10 notes you wrote or changed since your last Briefing (never Vault documents), with the first 600 characters of each; anything you asked your Briefing to keep in mind; and how you have asked Neeos to respond. It never includes your journal. Our server sends these to OpenAI to write your Briefing. Your iPhone also sends the titles of events up to 120 days ahead and of tasks due later, and the titles and short excerpts of your other notes and Vault documents and of memories that state a plan; our server uses these only so your Briefing does not suggest plans you already have, and does not send them to OpenAI. Our server keeps no readable copy of what your iPhone sends, and your Briefing is stored encrypted with your key.

Your Briefing also brings you news about topics you follow: the topics Neeos has learned from your saved memories, and the topics you add. Our server sends those topics to OpenAI to choose what to look up, and searches the web for news about them through OpenAI; a search sees only a few words about a topic, never your notes, tasks or calendar. When you open your Briefing, Neeos also gets a deeper look at each card ready: that card’s words are sent to OpenAI to write it, and for a card that came from the web, such as a news story, our server may search the web once using the card’s title. A card about your calendar or tasks is expanded on your iPhone and sends nothing. The Briefing uses your calendar only with your permission in iOS; outside the Briefing, Neeos uses it only as section 2 describes.

Gmail

This part applies only to an account we have invited to connect Gmail, and only after you connect it. Gmail is not part of the App Store version of Neeos. While Google lists Neeos as being tested, the connection lasts seven days at a time, and then you reconnect in Settings.

What this access can do. Neeos asks Google for read-only access to your Gmail. With that access alone it can read your mail and cannot send, change or delete it. If you also turn on Save Drafts to Gmail on a device, Neeos asks Google for a second permission, kept only on that device. Google describes that permission as able to manage your drafts and send email, because Google has no permission for drafts alone. Neeos uses it in three ways only. It saves a draft to your Gmail Drafts when you tap Save to Gmail. It sends an email when you tap Send and then confirm the address and subject. And it sends a draft it has shown you when you tell it to, by typing or saying something like “send it”. Typed, the draft waits a few seconds with Undo before it goes. In a voice call, Neeos first reads back who it is going to, the subject and the email itself (only its opening, if it is a draft you have already seen in Neeos), and sends it only if you then say yes. Neeos sends only the draft you saw or heard, and only when your own words say to send it; it never sends mail on its own, and words inside an email Neeos reads cannot tell it to. A reply that would go to a different address than the one the email came from is sent only when you tap Send, where Neeos shows you that warning. Without that second permission, an email you write in Neeos leaves only if you press Send yourself on Apple’s Mail screen, or copy it and send it from somewhere else. A connector you add to Neeos yourself is separate from this access and can have its own tools for sending; Neeos asks you each time before it uses one it recognizes as sending, and any other connector tool can run without asking if you set it to Always Allow or if the connector marks it as read-only.

Where the access is kept. Our server holds no Google password, token or key for your account. The access is kept in your devices’ keychain, iCloud Keychain carries it between your own devices, and your devices connect to Google directly. The second permission, if you turn it on, stays on the device where you turned it on and is not carried by iCloud Keychain.

What Neeos reads, and where it goes. Your devices read your mail in two cases. When you send a message in a chat, or talk to Neeos in a voice call, on a device connected to Gmail, the assistant can choose to look in your mail to answer it, even if you did not mention email. And if you turn it on, your iPhone reads some of your mail before your Briefing (below). In a chat, a search returns the sender, subject, date and preview of each message and whether it is unread. Opening a message or a whole thread returns the sender, the addresses in To and Cc, which can be other people’s, the subject, the date, the plain text of each message and the names of its attachments, up to a set amount of text. It does not open attachments or load images. What it reads passes through Neeos’s server to OpenAI, so the assistant can answer. Our server holds it in memory for that request and does not keep it. OpenAI may keep it for up to 30 days, as described above. It goes to Anthropic instead, under the terms described above, only if a chat runs on Anthropic’s Claude model, which happens if our OpenAI connection is not set up or an administrator chooses that model. In a voice call, or when you tap Speak on a reply, what the assistant says about your mail is also sent to OpenAI as text to be spoken, the way every spoken reply is (see “Live voice” above), and is kept under OpenAI’s standard terms for speech.

Drafts. The assistant writes a draft, so its words pass through our server to OpenAI like any reply. When you ask it to change a draft, the draft and your request go the same way, under the same terms. The address does not, unless a voice call reads it back to you before sending: it comes from your device. For a new email, Neeos looks up the person in Contacts on your device; for a reply, your device reads the address from the thread.

Email in Your Briefing. This is off until you turn it on. Before your Briefing, your iPhone reads the sender, subject, date and preview of your unread Primary mail, up to ten messages, and sends them to our server. Our server sends only the subject and preview of each message on to OpenAI, to write one short summary of it, and holds the rest in memory for that Briefing. OpenAI may keep it for up to 30 days. The Email card stays in your Briefing history, encrypted so only your devices can open it. Neeos doesn’t read the full messages for this.

What stays afterward. An answer the assistant writes about your mail is a chat reply, saved in your conversation like any other, so it can repeat what your mail said. As section 4 says, our server holds a new reply readable until your device replaces it with an encrypted copy. Like any chat, it can also enter your search index, which is built on your device and stored encrypted (section 4), and a memory saved from that chat stays until you delete it (section 5), as does a task, note or other item you ask Neeos to save from it. Where Neeos keeps a running summary of a long chat, that summary can repeat what your mail said too: it is written on your device or by OpenAI (or Anthropic, in the cases above), and it is stored encrypted like the chat. On some accounts, two things from a chat about your mail can be sent to the AI provider with your messages in other chats, for up to a week after you last use that chat: its title, which can also repeat what your mail said, and a one-line version of any such summary. Section 8 says how long the chat, the Email card and deleted items are kept.

Google’s Limited Use requirements. Neeos’s use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements, and to the Google Workspace API User Data and Developer Policy. For your Gmail data, that means:

• Use. We use it only for the features you see in Neeos: answering you in chat or in a voice call (including the chat’s title, its running summary and your search index, as “What stays afterward” describes); memories the assistant saves from a chat about your mail (section 5); saving a task, note or other item you ask for; writing a draft, and saving or sending one you ask for; and the Email card if you turn it on.
• Transfer. We pass it on only to provide those features with your consent, for security, to comply with the law, or, with your explicit prior consent, as part of a merger, acquisition or sale of assets. To provide those features it goes to OpenAI and Anthropic, as described in this section; from your device, to Apple Maps for the places and street addresses a reply names, to show them on a map; from our server, to Openverse, the few words of a photo search; to a connector you added yourself, if the assistant uses one in a later message once your mail’s words are in the conversation (section 6 describes these three); and, from your device, to the website of a link from your mail that is in a note Neeos saved for you, when your device shows that link’s preview (section 2).
• No advertising or sale. We do not use it to serve ads, and we do not sell it or transfer it to advertising platforms, data brokers or information resellers.
• No credit decisions. We do not use it to determine credit-worthiness or for lending.
• No training. We do not use it to create, train or improve an AI model. The no-training terms of OpenAI and Anthropic are described above.
• People do not read it. Nobody at Neeos reads your Gmail data unless you ask us to look at specific messages, security requires it, or the law does.

8. Data retention and deletion

Neeos keeps your data while your account is active, or until you delete it, with the exceptions below. Deleted documents, notes and chats hold a 30-day recovery window, in Recently Deleted, before they are purged. Chats past that window are purged automatically; notes and documents past it are purged as later deletions in your Vault and Notes clear them out, so one can remain in Recently Deleted for longer if you delete nothing else. Deleted memories are kept as described in section 5. Deleted tasks, subtasks and projects, and files removed from a project, disappear from the app straight away but are kept with your account, in the same form as before, until you delete your account. You can delete your account at any time from inside the app: Settings → Delete account. This removes your account and its content — chats, memories, notes, documents, tasks, goals, settings and activity log — from the live Service immediately, and signs out every device; see “Backups” below for the exception. Deleting your account does not cancel an App Store subscription: cancel it in Manage Subscription first. Your AI usage records are not deleted, because they are our record of what the Service spent, but they are anonymized: the link to your account is replaced with a random identifier, and they never contained your content.

Neeos Briefing. Your Briefings are kept, encrypted with your key, in the Briefing’s chat until you delete that chat or your account; deleting Neeos Briefing itself stops it and leaves that chat in place. Deeper looks at your Briefing’s cards are kept encrypted with your key and deleted 30 days after they were saved.

Gmail. For an invited account (“Gmail” in section 7), our server does not keep the mail it reads for you, apart from chat replies, a chat’s title and running summary, your search index, memories saved from those chats, and other items you ask it to save that repeat it. A chat reply about your mail is kept like any other chat, and the Email card is kept with your Briefing, until you delete that chat or your account. A draft you are writing reaches OpenAI as section 7 describes; on your device it stays in memory, and Neeos does not keep it after the app closes, except what a voice call reads back to you before sending, which is saved in that conversation like any reply. Deleting your account from a device connected to Gmail also removes the connection from your devices and asks Google to end Neeos’s access. Neeos doesn’t tell you if Google couldn’t be reached, so to be sure, remove Neeos in your Google Account. If you delete your account any other way, nothing ends that access for you, so remove Neeos in your Google Account; otherwise it ends within seven days while Google lists Neeos as being tested.

Copies already sent to the AI providers. Requests already sent to OpenAI or Anthropic are kept by them under their own terms, as described in section 7, and deleting a conversation or your account does not shorten that.

Files. When a file is purged from Recently Deleted, or your account is deleted, it is removed from Neeos and can no longer be reached through the Service. Our file storage also keeps earlier versions of stored files as a safeguard against mistaken deletion, and those earlier versions are not erased at the same moment: one can remain in storage for an extended period after the file itself is gone. It stays in the form it was stored in — encrypted with your key, or, for a file stored before encryption was set up on your account, protected by our storage encryption only. Those versions are not reachable through the Service and are never used to restore a deleted account or for any other purpose.

Logs. Our server logs and load-balancer access logs described in section 2 are kept for up to 30 days. Crash and hang reports (section 2) are kept with your account for 90 days, then deleted automatically, and are deleted with your account.

Backups. Our database is backed up automatically, in encrypted form, and each backup expires after 7 days. Because a backup is a copy of the whole database taken at a moment in time, it cannot be edited record by record — so for up to 7 days after you delete something, or delete your account, a copy can still exist inside a backup that has not yet expired, in the same form the database held it: encrypted with your key where your content was, and protected by our storage encryption otherwise. Those backups are used only to recover the Service from a failure, never to restore a deleted account. After they expire, they are deleted by our hosting provider on its own schedule. Separately, before major maintenance we may take an additional backup by hand, as a way to undo that maintenance; such a backup is not on the automatic schedule and can be kept for longer. It holds data in the form the database held it when the backup was taken — for data stored before encryption was set up on an account, that means protected by our storage encryption rather than your key. It is used for nothing else, and never to restore a deleted account.

9. Your choices

• AI data sharing — turn AI on or off at any time in Settings → AI data sharing. While it is off, nothing is sent to OpenAI or Anthropic, and Notes, the Vault and Momentum keep working.
• Memories — see, add, edit or delete any of them on the You screen; use an incognito chat to talk without saving memories.
• Neeos Briefing — off unless you turn it on. In Briefing Settings you can choose what it reads, leave out any calendar, pause it or delete it; turning off AI data sharing stops it too.
• Gmail — for an invited account (“Gmail” in section 7), off unless you connect it. In Settings → Connected Services, Disconnect removes the connection from all your devices and asks Google to end Neeos’s access. If Google can’t be reached, remove Neeos from your Google Account, which you can also do at any time. Signing out of Neeos does not end the access; use Disconnect. The Email card in your Briefing has its own switch, off until you turn it on. If you disconnect from an iPad or Mac, your iPhone removes email from your Briefing the next time it wakes, and a Briefing already prepared on that iPhone may still run once with the email it had read.
• Siri & Spotlight — off unless you turn it on (Neeos asks once, and the switch is in Settings); turning it off removes what it added to your device’s search index.
• Notifications — turn them off in iOS Settings at any time.
• Devices — see where you are signed in, and sign a device out, in Settings → Devices.
• Export — Settings → Export All My Data makes a copy of your content — notes, documents, chats, tasks, memories and more — as ordinary files. Because your data is encrypted with your key, the export is put together on your device, and the finished file is not encrypted. You can also share a single note (as a Markdown file) or document (as its original file) from inside the app.
• Access & deletion — delete individual items at any time (section 8 says what is kept after an item is deleted, and for how long), delete your account yourself in Settings → Delete account, or ask us to do it by contacting us. You can also stop using Sign in with Apple with Neeos in your Apple Account settings.

10. Features not in this version of Neeos

Earlier versions of this policy described features that are not part of the version of Neeos available to the public: Apple Health, connections to WHOOP and Oura, reading Mail, Messages or Contacts, and finance features. None of them is available in the App Store version: it cannot connect them or read that data, and an account created in it collects none of it. If this policy ever covers them again, it will say so before they are offered to you. For accounts we invite, sections 2 and 7 describe the exceptions for reading mail, messages and contacts.

If your account connected WHOOP or Oura to an earlier test version of Neeos, that data was accessed only through each provider’s official API, within the permissions you approved, and used only to provide features to you — never for advertising, resale or sharing with third parties. WHOOP can continue to send new data to Neeos until you revoke Neeos’s access in your WHOOP account, ask us to disconnect it, or delete your account; you can also revoke Oura’s authorization in your Oura account. Ask us at jake@neeos.ai to disconnect a service; when it is disconnected, you can choose whether Neeos keeps or deletes entries already imported from it.

11. Children’s privacy

Neeos is for people aged 18 and over. It is not directed to children, and we do not knowingly collect data from anyone under 18. If you believe a child has given us data, contact us and we will delete it.

12. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the “Last updated” date at the top of this page.

13. Contact

Questions about this policy or your data? Email jake@neeos.ai.