Privacy Policy

Last updated: April 25, 2026

1. What We Collect

We collect only the data you explicitly provide or that is necessary to deliver the service:

• Account information: When you sign in with Google, we receive your name, email address, and profile picture from Google. We never see or store your Google password.
• Messages: The text you send through Telegram or the web chat is processed and stored to provide conversation history, task management, reminders, and memory features.
• Tasks and plans: Tasks, reminders, daily plans, and notes you create are stored in our database.
• Calendar data: If you connect Google Calendar, we access your calendar events and free/busy information to generate daily plans. Calendar tokens are encrypted at rest.
• Usage data: We log message timestamps and action types for service improvement. No analytics cookies or tracking scripts are used.

2. What We Don't Collect

• We do not collect your location, IP address logs, device fingerprints, or browsing history.
• We do not use cookies for tracking or advertising. Session cookies are used exclusively for authentication.
• We do not sell, rent, or share your personal data with third parties for their own use.

3. How We Use Your Data

• To provide and maintain the Progresser service (chat, tasks, reminders, memory, planning).
• To improve the AI classification and response quality through anonymized aggregate analysis.
• To communicate with you if you contact us with questions or support requests.

4. Data Storage and Security

• Data is stored in Cloudflare D1 databases. Cloudflare is our data processor.
• Calendar OAuth tokens are encrypted with AES-256-GCM before storage.
• Session tokens are cryptographically signed and expire after 7 days.
• We implement industry-standard security practices including HTTPS enforcement, HttpOnly cookies, and CSRF protection via state verification.

5. Data Retention

• Conversation messages are retained to provide context and memory features.
• Sessions expire after 7 days. Expired sessions are periodically cleaned.
• Pending actions expire after 5 minutes.
• You can delete your tasks, messages, and other data at any time through the app.
• Account deletion requests are processed within 30 days.

6. Third-Party Services

• Google: Used for authentication (OAuth 2.0) and optionally for Calendar access. Google's privacy policy applies to data handled by their services.
• Telegram: If you use the Telegram bot, Telegram's privacy policy governs your use of the Telegram platform.
• DeepSeek: Message classification uses the DeepSeek API. Messages sent for classification are not stored by DeepSeek beyond processing.
• Cloudflare: Our hosting provider. See Cloudflare's privacy policy for their data handling practices.

7. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access personal data we hold about you.
• Request correction or deletion of your data.
• Export your data in a portable format.
• Withdraw consent for calendar access at any time.
• Delete your account and associated data.

To exercise these rights, contact us at the email below.

8. Children's Privacy

Progresser is not directed at children under 13. We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us to have it removed.

9. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated through the app or via email. Continued use after changes constitutes acceptance of the updated policy.

10. Contact

For privacy questions or data requests, contact us at privacy@progresser.app.