Privacy policy

Sam is a personal assistant operated by and for a single person, its owner. It has no other users, no sign-up, and no public accounts. If you are reading this without being that person, nothing here describes data of yours.

The owner is eng@samerhany.com, who is also the operator and the only person who can sign in.

Only the accounts the owner explicitly connects, one at a time, through Google’s own consent screen. Permissions are chosen per account, so a personal mailbox can be read-only while a work one can send.

Gmail

Reading messages to summarise, search and draft replies. On accounts where the owner granted it, applying labels and sending.

Google Calendar

Reading events to assemble a brief and answer questions about the week.

Google Drive

Creating files the assistant is asked to make, and searching and reading existing files. It cannot modify or delete a file it did not create.

Everything below lives in a private Supabase (PostgreSQL) database on infrastructure the owner controls. Nothing is sold, shared, or used to train any model.

Access tokens

Encrypted at rest with Fernet before they touch the database, so a database dump yields nothing usable. They are never shown to the language model, never passed as a tool argument, and never returned in a tool result.

Messages

The text of what the owner sends the assistant, and what it replies, so a conversation can continue and a run can be audited.

Run records

What ran, when, what it cost, and the answer it produced.

Memory

Facts, notes and documents the owner asked Sam to remember, plus embeddings used to search them.

Email bodies, calendar events and file contents are read at the moment a question needs them and are not copied into storage, except where they appear in an answer the owner asked for or in something they explicitly asked to be remembered.

Answering a question means sending the relevant text to a language model. Sam uses these third parties and no others:

OpenAI

Model inference and embeddings. Sent under an API agreement that excludes the data from training.

Supabase

Database hosting for everything described above.

LangSmith

Execution traces used to debug and measure the assistant. Traces contain message content.

Slack and WhatsApp

Only where the owner has chosen to reach Sam on those channels; the message and its reply pass through them.

No advertising networks, no analytics, no data brokers. Google user data is never transferred to anyone except as described here, and is never used for advertising.

Sam’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: Google user data is used only to provide the assistant features the owner asked for, is not transferred to others except as required to operate those features, is not used for advertising, and no human reads it except the owner.

Access can be withdrawn at any time, in either direction, and neither requires the other:

From Google

Revoke at google.com/account/permissions. Sam loses access immediately.

From Sam

Disconnect the account on the Integrations page. The stored token is deleted, not just disabled.

Deleting an account’s connection removes its credentials. Run records and remembered facts are kept until the owner deletes them, because they are the assistant’s history rather than the provider’s data.

Credentials live until revoked. Messages, run records and memory live until the owner deletes them — there is no automatic expiry, because the value of an assistant that remembers is that it remembers.

Questions about this policy go to eng@samerhany.com.