Privacy policy

Last updated: October 12, 2026

Account and connected sources

Google or Microsoft authenticates your sign-in. Tidy uses your linked account IDs, name, and email to manage your account and check new-account invitations.

Data access is optional and separate from sign-in. You choose which services to authorize; Tidy reads them when you ask. These connections cannot send mail, edit, or delete source data. Available access depends on your permissions, account, and organization.

Google: Drive files, Sheets, Docs, Slides, calendars, Gmail messages and attachments, contacts, tasks, Forms and responses, Google Analytics, and Search Console.
Microsoft: Files, mail, calendars, contacts, SharePoint, Teams, notes, and tasks.

AI processing

We send relevant messages, file contents, and voice recordings, including content retrieved from connected sources, to AI providers with zero data retention policies to analyze content, answer questions, and transcribe recordings. OAuth access and refresh tokens are not sent to AI providers.

Your content is not sold, used for advertising, or used to train or improve AI models.

Storage and security

Conversations: We save your history and context so you can view past conversations and continue where you left off. They may include relevant excerpts, extracted text, and generated answers, and do not currently expire automatically.
Files: Uploaded and downloaded files are held temporarily in an isolated sandbox and deleted when it is destroyed. Its expiry is extended while it is reused.
Knowledge and credentials: We store saved knowledge to answer your questions and connection credentials to access the sources you authorize.

We use HTTPS for external transfers and encrypt stored OAuth tokens. Providers may process data outside your country.

Hosting and databases: Providers operate our infrastructure and store the information described above.
Diagnostics: Telemetry services receive traces that can retain prompts, answers, and retrieved content.
Analytics: Services collect usage events and browser/device information and may use cookies or local storage.
Web search: Search providers receive queries when you authorize web research.

We use cookies to keep you signed in and remember your language. Your Google locale may set the default language; your own choice takes priority.

Google data safeguards

Tidy's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. Human access is limited to the exceptions allowed by that policy, such as your explicit consent, security investigations, or legal obligations.

Disconnecting and deleting data

Use Connections → Disconnect to clear Tidy's saved tokens.

Google: Disconnect also revokes access. You can revoke it directly in your Google Account.
Microsoft: Disconnect does not revoke consent at Microsoft. Remove it in your Microsoft account or organization's application settings.

For both providers, linked login methods remain available and in-flight reads may finish. Disconnecting does not delete your account, conversations, saved context, saved knowledge, or diagnostic traces.