Privacy Policy

Effective 20 July 2026

JoeHukum is a personal CRM and executive assistant, operated by Aryabhatta Labs ("we", "us"). This policy explains what we access, what we store, and the choices you have. We built JoeHukum on one principle: trust is the product. Contact us any time at ask@aryabhattalabs.com.

We handle personal information in line with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and the CSA Model Code principles.

Information we access

Google Calendar (read-only) — event titles, times and attendees, to log meetings and prepare you for them.
Basic profile — your name and email address (from Google or Apple sign-in), to create your account.
Mail you forward to us — and only that. You get a private address (joe@joehukum.app); anything you forward there is read once to extract the amount, due date and biller, after which the copy is deleted. Mail we cannot verify came from you is discarded unread.

We request the minimum scopes needed and never request write access — JoeHukum cannot send, delete or modify anything in your Google account. We never ask for access to your inbox: the only email we ever see is what you choose to forward.

JoeHukum's use and transfer of information received from Google APIs adhere to the Google API Services User Data Policy, including the Limited Use requirements.

What we store

Relationship and obligation extracts — contacts, one-line interaction summaries, commitments, bills, important dates derived from your calendar.
Your Google access and refresh tokens, encrypted at rest.
Your app content — notes, facts and reminders you create.

AI processing

To do its job, JoeHukum sends relevant content to established AI providers — Google (Gemini) and OpenAI — for processing. This includes: your conversations with Joe, emails you forward, photos you attach (for example, to read a bill's amount and due date), and — when Joe needs them to answer you — details of the people you have added (names, organisations, saved dates, facts, tasks and one-line interaction summaries). When you ask Joe to search the web, your search query is sent to Brave Search (or Google). Under these providers' API terms, your content is used only to return a result to us: it is not used to train their models, and it is never used for advertising. You agree to this in the app before first use, and your agreement is recorded. Hosting is provided by Google Cloud.

Data obtained through Google Workspace APIs (your Google Calendar data) is not used to develop, improve, or train generalized or non-personalized artificial-intelligence or machine-learning models. It is used only to provide and improve the JoeHukum features you have asked for, and is never transferred to or used by any third party to train such models.

How we make money

Our focus is building the best personal assistant, not monetising your data. Whatever the business model becomes, one rule is fixed: we do not sell your data, show ads, or monetise your attention.

What we never do

We never sell or rent your data.
We never show ads or use your data for advertising.
We never send messages, make changes, or transact on your behalf — JoeHukum only prepares drafts and hands off to the apps you already use.
We never share your data with third parties except the sub-processors needed to run the service (hosting, AI processing), under confidentiality.

Your rights and choices

Export — you can export your full graph as JSON at any time from the app.
Delete — you can disconnect Google, which revokes our access, and permanently delete your account and data from Settings → Delete account. If you cannot access the app, email us from your account address or use the account deletion page.

Product analytics

The mobile app reports anonymous, device-level usage measurements (which screens and features are used, via Google Firebase Analytics) so we can improve the product. This website counts anonymous page views the same way. These measurements are never linked to your identity or account, contain none of your content (no names, messages, amounts, or billers), and are never used for advertising or shared with data brokers.

Cookies

JoeHukum is entirely app-based — there is no sign-in, form, or transaction on this website. The only cookies it sets are Google Analytics cookies, used to count anonymous page views so we know whether anyone is finding us. We set no advertising cookies, run no ad networks, and share nothing with data brokers. Separately, a single session cookie is used by our own staff on the signed-in admin area.

You can block or clear these at any time in your browser; nothing on this site depends on them.

Data protection & security

We protect your information — including sensitive data obtained from Google APIs — with layered technical and organizational safeguards:

Encryption in transit — all traffic between your device, our servers and our sub-processors travels over TLS (HTTPS), version 1.2 or higher. We do not transmit your data over unencrypted connections.
Encryption at rest — your Google access and refresh tokens and the data we store are encrypted at rest on Google Cloud infrastructure.
Access controls — access to production systems and user data follows the principle of least privilege and is restricted to the authorized personnel who need it to operate the service. No person reads your data except as strictly necessary to respond to a support request you have made, or where required by law.
Sub-processors — we share data only with the sub-processors needed to run the service, under confidentiality and data-protection terms: Google Cloud (hosting), the AI providers named above (Google, OpenAI), whose API terms prohibit using your content to train their models, and Brave Search (web-search queries only).
Breach handling — if a security incident affects your personal information, we will notify affected users and the relevant authorities without undue delay, in line with PIPEDA's breach-reporting obligations.

Retention

We keep your data while your account is active. When you delete your account (or disconnect Google), we revoke your Google tokens immediately and permanently delete your stored extracts and personal data — including from backups — within 30 days. We do not retain Google user data longer than needed to provide the service you requested.

Changes & contact

We'll post any changes here and update the date above. Questions? Email ask@aryabhattalabs.com. This policy is governed by the laws of Canada.