1. Information We Collect
When you create an account we collect your name, email address, authentication records, and profile information you choose to provide. We also collect data you enter into skills (for example, golf scores, wine notes, recipes, tasks, and health or fitness entries) and limited operational events needed to secure and operate the service.
Google user data
Google connections are optional and separated by feature. If you connect Calendar, MyCrewAI accesses event titles, start and end times, all-day status, locations, and event links so it can show your schedule, find availability, and create events you request. If you connect Gmail, MyCrewAI accesses message identifiers, sender headers, subject headers, dates, unread labels, and snippets from messages matching the inbox search you request so it can display and summarize relevant mail. It can create a draft you request and send that existing draft only after your approval or an autonomy setting you deliberately enable.
MyCrewAI stores an encrypted Google refresh token, a short-lived encrypted access token, the granted scope list, and connection timestamps. Inbox and Calendar query results are processed for the active request and are not copied into the skill database. Email draft text and Calendar event details placed in the approval queue are retained for up to 30 days while pending and up to 7 days after a decision.
Health and fitness data
If you allow it, MyCrewAI reads data from Apple Health (iOS) or Health Connect (Android): workouts, steps, heart rate, heart-rate variability, blood oxygen, sleep stages, weight, and similar measurements, plus what you log by hand. It is used only to power the health, sleep, fitness, nutrition, and habit features you open, is stored in your account, and is never used for advertising or sold. Sleep and recovery scores are screening signals, not medical diagnoses. You can revoke access at any time in the Health app or Health Connect; already-imported samples are deleted when you delete your account.
Location
Location is optional and used for weather, local weather-aware coaching, trails and courses near you, Local (neighbourhood board, sales, borrowing) and Nearby (meeting people). For Local and Nearby your position is stored rounded to roughly a city block and other people see only a rounded distance, never your coordinates — except a garage-sale address you deliberately publish. Live location shared inside a chat is end-to-end encrypted and only readable by the person you share it with.
Photos, video and voice
Photos and short videos you attach to listings or posts are compressed on your phone, stored with your account, shown only to the audience you chose, and removed when the listing expires or you delete it. A photo or voice note you send to the assistant is processed by the AI provider you configured to answer that request. Contacts are read only when you pick one to invite; the address book is not uploaded.
Messages and channels
Direct messages between MyCrewAI users are end-to-end encrypted on your devices; our servers relay ciphertext and cannot read them. If you link Telegram or WhatsApp, messages you send to your assistant there are received by our server, processed to answer you, and kept in your chat history. On Android, if you turn on “Messages on this phone”, MyCrewAI reads incoming notifications from messaging apps on the device to surface replies you owe; that text is used for the follow-up features you see and can be turned off in Channels at any time.
Your AI keys
The assistant runs on an AI provider key you add (OpenAI, Anthropic or Google Gemini). Your prompts, the minimum relevant data from your skills, and any photos or voice notes you send go to that provider under its terms. Keys are stored encrypted and never shared with other users.
Product analytics
We record content-free usage events (for example “opened Habits”, “logged a meal”, “notification opened”) with timestamps to understand which features people use. These events never contain what you wrote, ate, or where you were.
2. How We Use Information
We use information to:
- Provide, maintain, and improve MyCrewAI services
- Personalize your experience across skills
- Send transactional emails (account verification, password resets)
- Protect accounts, investigate abuse, and maintain reliable operations
- Analyze product usage that does not include Gmail message content or Calendar event content
We do not use Google user data for advertising, retargeting, lending or credit decisions, data brokerage, or sale. We do not use raw or derived Google Workspace data to train or improve a generalized AI or machine-learning model.
3. Data Storage & Security
Connections use HTTPS in transit. Google OAuth tokens are encrypted at the application layer with authenticated encryption and a server-managed key separate from the database. Access is restricted to the signed-in account and security-relevant actions are audited without copying Gmail or Calendar content into audit logs. No system can guarantee absolute security.
4. Data Sharing and AI Providers
MyCrewAI does not sell Google user data. When you use an AI assistant feature involving Gmail or Calendar, the minimum user-visible fields needed to answer the request may be sent to the model API provider you configured, such as OpenAI, Anthropic, or Google Gemini. Google message, thread, event, and source-link identifiers are removed from model tool results. Workspace tools are disabled unless the service operator has explicitly approved the provider configuration for this data. Providers process this information only to return the feature you requested, subject to their API data-processing terms. We may also disclose limited information to infrastructure providers that host the service, for security, when required by law, or as part of a business transfer with legally required notice or consent.
5. Retention and Deletion
Google OAuth tokens are retained until you disconnect Google, delete your account, or the grant becomes invalid. OAuth authorization transactions expire after 10 minutes. Pending approval content expires after 30 days and decided approval content after 7 days. Operational security logs are minimized and do not retain Gmail or Calendar content.
Disconnecting Google asks Google to revoke the grant and deletes the local token. Account deletion removes personal content, skills, connections, tokens, sessions, memberships, invitations, and identifiers from shared records. If you are the sole owner of a collaborative space, MyCrewAI will first ask you to transfer ownership or delete that space so other participants' data is not destroyed. If Google is temporarily unavailable during account deletion, local credentials are still erased and MyCrewAI directs you to confirm revocation in Google Account permissions.
6. Your Choices and Rights
You may:
- Access, update, or delete your personal data at any time from your account settings
- Connect Gmail and Calendar independently and disconnect Google
- Request a copy of your data by contacting us
- Delete your account, subject to resolving sole ownership of shared collaborative spaces
7. Google API Limited Use
MyCrewAI's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google Workspace data is used only to provide or improve prominent user-facing features requested by the connected user. Humans do not read Google user data except with the user's explicit consent for a specific support purpose, when required for security, or when legally required.
8. Cookies
We use essential cookies for authentication and session management. We do not use advertising or third-party tracking cookies.
9. Children's Privacy
MyCrewAI is not intended for users under the age of 13, and the Nearby feature is restricted to users 18 and over. We do not knowingly collect personal information from children under 13.
10. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a revised date.
11. Contact Us
If you have questions about this Privacy Policy, contact us at dev@scrumdigital.com.