Privacy Policy

1. What we collect

• Phone number.Required — it’s how we route messages to you.
• Email. Optional at signup; Stripe collects it during checkout for billing receipts.
• Message content. Every text you send the pal and every reply they send back. Stored so the pal can keep context across conversations.
• Profile facts you share.Birth date, what you’re working on, people you’ve mentioned — extracted by the pal from your conversation and saved to make future replies useful.
• Attribution data. If you arrived from an ad, we capture click IDs (fbc / fbp), UTM tags, and first-touch timestamp so we can measure ad effectiveness.
• Billing metadata. Stripe customer ID, subscription status. We never see your full card number — that lives at Stripe.

2. What we do with it

• Send your messages to the AI model that drafts your pal’s reply.
• Charge your card via Stripe and confirm successful payments.
• Compute attribution for ad campaigns via Meta’s Conversions API.
• Improve prompts and pal behavior, in aggregate.

We don’t sell your data. We don’t share message content with advertisers.

3. Subprocessors

The third parties who touch your data, and what they touch:

• Stripe — payments, billing, customer record.
• SendBlue — sends and receives the actual SMS / iMessage texts.
• OpenAI— drafts pal replies. Phone numbers and account IDs are not sent to OpenAI; only the message text and the pal’s system prompt go in.
• Supabase — primary database (user records, message history, embeddings).
• Vercel — hosts the web app and runs the agent loop.
• Meta — receives hashed identifiers (email, phone) and event metadata for ad attribution via Conversions API. We never send Meta your message content.
• Composio — holds the OAuth tokens if you connect your Google Calendar (see section 5). We never store those tokens ourselves.

4. AI processing

Every message you send is sent to OpenAI to generate the pal’s reply. OpenAI may retain that data per their privacy policy (currently 30 days for abuse monitoring, then deleted, when accessed via the API). We don’t use your messages to train any model.

5. Google Calendar (optional)

Some pals can read your Google Calendar — but only if you explicitly connect it. Here’s exactly what that means:

• What we access.Your calendar events (titles, times, dates). The connection is managed by Composio and uses Google’s standard calendar scopes, which grant broader permission than we use: textpals only ever performs two read operations (listing events, reading a calendar’s metadata) and never creates, changes, or deletes anything on your calendar.
• What we use it for. Answering your questions about your day and composing your morning brief — user-facing features you asked for, nothing else. Event text is included in the prompt sent to the AI model that drafts the reply (see section 4); it is not used to train models.
• What we store.Nothing from your calendar. Events are read at the moment they’re needed and never written to our database. We keep only the connection status (connected / disconnected) and which Google account you linked. OAuth tokens live with Composio, our auth provider — never on our servers.
• What we share.No calendar data is sold, shared with advertisers, or transferred to anyone except as needed to generate your pal’s replies. Event titles are masked in our internal observability tooling.
• Disconnecting.Text your pal “disconnect my calendar” and the grant is revoked — or revoke it any time from your Google account permissions.

textpals’ use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

6. How long we keep it

• While you’re a user: we keep message history and profile data so your pal stays useful.
• After you delete your account: message content and profile data are removed within 30 days. Billing records (per Stripe) and webhook idempotency rows (24-hour TTL) are governed by their own retention.

7. Your rights

You can request access to your data, correction of bad fields, or deletion of your account by emailing hi@textpals.co. We’ll respond within a reasonable time (usually within a few business days).

8. Children

textpals is for adults. We don’t knowingly serve users under 18 and will delete any account we discover belongs to one.

9. Contact

Privacy questions: hi@textpals.co.