App Privacy Policy

This Privacy Policy explains what data Sammy collects, how we use it, who we share it with, and the choices you have. The data controller is Keep DS Pty Ltd (ABN 91 695 408 756) (“Keep DS”, “we”, “us”), an Australian company at Suite 193, Level 5, 33 Stewart St, Richmond VIC 3121, Australia. Sammy is built to be privacy-conscious: where we can keep data on your device, we do.

1. On-device and Sammy Cloud

Sammy answers you in one of two ways:

• On-device mode: a local model (Google’s Gemma) generates the replies on your iPhone or iPad. What Sammy remembers from that chat, and parts of it found by chat search, can be used in your other chats, including Sammy Cloud ones, unless you turn off its Visibility.
• Sammy Cloud: your messages, and what’s needed to answer them, are sent through our servers to the AI providers listed in section 5, which generate the reply.

Sammy asks for your permission before anything first goes to Sammy Cloud. You can withdraw it at any time in Settings → About → Sammy Cloud sharing. While it’s off, nothing goes to Sammy Cloud: chats carry on with the on-device model if it’s downloaded, and Sammy Cloud chat, voice chat, web search and the Daily Briefing pause. Guests (people using Sammy without an account) never use Sammy Cloud.

The free plan includes limited Sammy Cloud usage: chats use Sammy Cloud unless you keep a chat on-device (from the menu under Sammy’s name), and once the limit is reached they continue on-device if the model is downloaded. On every plan, first-time setup uses Sammy Cloud for one short setup conversation, so Sammy can organise what you tell it; it doesn’t count toward your plan’s usage. Some features always use Sammy Cloud, including voice chat, image generation and the Daily Briefing. Web search always goes through our servers to our search providers, even from a chat that runs on-device (the conversation itself stays on your device), so it also needs Sammy Cloud sharing.

Once you’ve agreed, some features also use Sammy Cloud in the background. On the free plan the only one is picking out things worth remembering, at most once a day, and never if the on-device model is downloaded:

• Daily Briefing (off until you turn it on): your calendar events, to-dos, important emails (sender, subject and a short preview), some of your memories, a summary of recent chats, and the topics you follow, to write your briefing.
• Follow-ups: your recent messages in a chat, to suggest checking in with you later.
• Memory: the messages you’ve written or said in chats that use Sammy Cloud, never Sammy’s replies, emails, web pages or documents, to pick out things worth remembering and how you like Sammy to talk to you. The memories themselves are kept on your device. Once a day Sammy also sends the memories it keeps, with the words behind any it needs to double-check, to tidy them up and write a short summary of you. Nothing from chats with Visibility off or from locked messages is sent.
• Email monitoring and Waiting On (off until you turn it on): the sender, subject and a short preview of new emails, to flag what matters and notice replies.
• Keeping Tabs: the subjects you ask Sammy to keep tabs on, as web searches, and the pages it finds.

Appointment Mode records and transcribes meetings on your device; the audio never leaves it. In Appointment Mode +, Sammy also separates who spoke using on-device voice analysis: short-lived acoustic voice signatures are computed during processing, used only to label the transcript (Speaker 1, Speaker 2), then discarded. They are never stored as biometric templates and never sent off your device. If you choose Sammy Cloud for the summary (Appointment Mode + always uses it, including for live insights during the appointment), the text transcript and the details you enter, such as the topic, participants’ names and agenda, are sent to Sammy Cloud.

Chat Visibility and locked messages: with Visibility off, the chat is saved and backed up, but Sammy saves no memories from it, deletes the ones it had learned there, and keeps it out of your other chats, chat search, summaries and the Daily Briefing. Things Sammy does for you there, like a to-do, are saved where they normally go. A locked message is never sent to an AI model again unless you allow it for one reply.

2. Information we collect

• Account information: your email address, display name, how you sign in (email, Apple or Google), and a record that you confirmed you’re 18 or over, held by our authentication provider.
• Content you provide: messages, attachments, memories, and settings. These are stored on your device and in any backups you make, not on our servers. When Sammy Cloud is used, the relevant content is sent to generate the reply (see section 5).
• Device data you let Sammy use: with your permission, Sammy can use your calendar, reminders, contacts, photos, camera, microphone and location to provide a feature you ask for, such as adding an event or attaching a photo. When a Sammy Cloud chat needs this content, the relevant part is sent to carry out your request and is not used for anything else. You can change these permissions at any time in iOS Settings.
• Google account data: if you connect Google, Sammy can read your Gmail and, when you ask, tidy it (mark read, star, archive, file under your labels) and write drafts for you to send; read your Google Calendar and, when you ask, add events or change them; and save backups to Google Drive. When you ask Sammy about your email in a Sammy Cloud chat, the relevant email content is processed by our AI providers only to carry out that request, unless you turn on Read email on-device only. It is not used to train AI models and is not kept beyond providing the feature. Sammy can’t send or delete your email, or delete calendar events. See section 12.
• Location: when you ask for something local, such as weather or places near you, or use the Daily Briefing, Sammy uses your approximate location. It goes to our weather provider as rounded coordinates, to Apple to find your town’s name, and, for local web searches, as your town or city and rounded coordinates. Time-to-leave alerts send it to Apple Maps to work out the trip. When you ask how long a trip will take, when to leave, or where you are, Sammy uses a more precise location, to about 100 metres, for that request only: it goes to Apple Maps to find your street and plan the route, and in a Sammy Cloud chat the AI is told your street and suburb, never your exact position or a house number. A rounded location may be kept on your device for up to 7 days so Sammy doesn’t have to ask again; we don’t store your location on our servers.
• Voice: speech recognition runs on your device for voice notes, voice chat and Appointment Mode. Only the resulting text is sent to Sammy Cloud, and only when that chat uses it; your audio is not sent to us. Spoken replies use Apple’s voices on your device. On Apple Watch, dictation is handled by Apple’s own dictation service.
• Usage information: records of your Sammy Cloud use (the feature, the model, token counts and cost) and counts of your web searches and stock lookups, without their content, used to apply plan limits, prevent abuse, show you your usage, and count how many people use Sammy, as totals. We don’t keep your search queries.
• Subscription status: your plan and the details of your Apple purchase (transaction IDs, product and dates), checked against Apple’s signature.
• Connected integrations: if you connect a service like Google, its access tokens are stored securely in your device’s keychain. Our server takes part in connecting Google and refreshing access, because it holds Sammy’s Google app credentials, but it does not store your tokens.
• Diagnostics and crash reports: crash and hang reports and performance summaries, which include stack traces, memory and hang statistics, the app and iOS version, and your device model. They are sent only if you choose Share usage and crash data, which Sammy asks about once in the app and you can change at any time in Settings → About. Until you choose, they stay on your device for up to 14 days; if you choose Don’t share, they’re deleted and no more are kept. Once you’ve said yes, they’re uploaded while you’re signed in, linked to your account, and used only to find and fix stability problems, never for advertising. We do not log the contents of your access tokens.
• Anonymous completion counts: if you choose Share usage and crash data, once a day the app reports how many items were finished, for example to-dos completed, awaited replies received and check-ins kept, as plain counts only, with the app version and plan type. These reports carry no account or device identifier and no content, so they cannot be linked to you; we use the totals to understand whether Sammy is genuinely helping people finish things.
• Sign-up checks: before you create an account, we check your email against the early-access waitlist, and keep a one-way hash of your IP address for up to a day to stop abuse.
• How you use Sammy, on your device: Sammy keeps simple patterns about how you use it, such as when you’re usually active and how often you finish to-dos, to tailor its help. They stay on your device, aren’t included in backups, and go to Sammy Cloud only as part of a chat prompt, to shape the reply, or in the once-a-day memory tidy-up on paid plans.

Notifications from Sammy are created on your device. We don’t use push notification servers.

3. How we use your data

We use data to provide and improve the Service, generate responses, enforce plan limits, prevent abuse, fix problems, and provide support. We do not sell your personal data, and we do not use your conversations to train AI models. We don’t use your data for advertising, and we don’t track you across other companies’ apps or websites.

Data protection laws, including the GDPR and UK GDPR, ask us to give a legal basis for each use of your data. Ours are:

• Providing Sammy under our Terms of Service: your account and sign-in, the age and waitlist checks, your plan, usage and subscription, the features you ask for (including Google features you connect), account emails and support. This is necessary to perform our contract with you.
• Sending your content to Sammy Cloud: your consent, which Sammy asks for before anything first goes there. You can withdraw it at any time in Settings → About → Sammy Cloud sharing; that doesn’t affect what was sent before.
• Keeping Sammy secure and working well: sign-up abuse checks and the reports you send about responses. These rely on our legitimate interests in protecting Sammy and the people who use it and fixing problems. You can object to them (see section 11).
• Crash reports and completion counts: your consent, given when you choose Share usage and crash data. You can withdraw it at any time in Settings → About; that doesn’t affect what was sent before, and every feature works the same either way.
• Meeting legal obligations, such as keeping records the law requires and responding to lawful requests.

You need to give us an email address and confirm you’re 18 or over to create an account. Everything else is your choice, though some features need it: without Sammy Cloud sharing, for example, Sammy Cloud features pause.

Sensitive information. You may choose to tell Sammy about your health, beliefs, sexuality or other sensitive matters, for example in a chat or an Appointment Mode transcript. In an on-device chat, replies are generated on your device; what Sammy remembers from it can be used in your Sammy Cloud chats unless you turn off its Visibility or lock the message. If it goes to Sammy Cloud, it’s sent to our providers only to answer you, and agreeing to Sammy Cloud sharing is your explicit consent to that. You can withdraw it at any time in Settings → About → Sammy Cloud sharing. We don’t use sensitive information for anything else.

Some decisions are made automatically. The age check when you sign up decides whether you can use Sammy, the waitlist check decides whether you can create an account during early access, and your usage counts (not your content) decide when Sammy Cloud pauses until your allowance refills. If you think one of these got it wrong, contact us: a person will review it, and you can explain your view and challenge the decision.

4. Backups

You can back up your data to iCloud and/or Google Drive. Backups are encrypted on your device before they leave it, with a key kept in your iCloud Keychain, and are stored in your own iCloud or Google account. They are controlled by you: you choose when to back up and when to restore. Backups include your chats, memories, voice-note recordings and documents, but not your sign-in tokens. A few details about each backup, such as your device’s name and the backup date, aren’t encrypted, so Sammy can list your backups.

5. Who we share data with

We use service providers to run Sammy. We share only what each one needs, and only with providers whose terms limit them to using it to provide their service to us and require them to protect it at least as well as this policy does. Your messages are sent to them only to generate the response you asked for.

• Our backend (Supabase): hosts sign-in and our database (in Sydney, Australia), which holds your account, subscription, usage, and safety and diagnostic records, and runs the Sammy Cloud servers that pass your requests to the providers below. Sammy does not keep cloud conversations on its servers: your conversations, memories, and attachments are kept on your device and in any backups you create.
• AI model providers: General chat and image understanding run on open models (currently Qwen) hosted by AkashML, which runs them across a network of independent GPU operators. AkashML does not store prompts or responses, apart from short-lived error logs, and only allows limited human review, for safety. Under its own policy, those error logs are deleted within 30 days, and your data isn’t used for training. When AkashML is unavailable, the same Qwen model answers from DeepInfra (based in the United States), which doesn’t store prompts or responses on disk, doesn’t log their content and doesn’t use them for training. Ask a Specialist and Office document creation (Word, Excel, PowerPoint) use Anthropic’s Claude. What goes to Anthropic is limited to what the task needs, with as little personal detail as possible. A file you ask a specialist to work from goes to Anthropic for that task and is deleted from its file storage when the task ends; if a task fails partway, a nightly clean-up removes anything it left behind. Under its commercial terms, Anthropic does not train on this data and deletes it within 30 days by default, unless it needs to keep it longer for safety or legal reasons. Image generation uses FLUX.2 image models from Black Forest Labs, run by DeepInfra, which receives your image request and any reference images you choose, doesn’t use them for training, and deletes them once the image is made; the finished image stays on DeepInfra’s servers only briefly, until our servers collect it for you. With each request we send these AI providers an anonymous code for your account (a one-way hash, never your name, email or account ID), so their safety systems can tell one person's requests from another's; it can't be used to identify you. Before your Daily Briefing prints, an open model (gpt-oss) run by DeepInfra reads it once more, with your town and the day’s plans, to take out anything that doesn’t apply to you, under the same DeepInfra terms.
• Web search and online information: through our servers, web and news searches go to Serper (Google’s results), with Brave Search when Serper can’t answer; on paid plans, local, product and place searches also go to Serper (with your town or city and rounded coordinates, for local results), with SerpAPI when Serper can’t answer, and Jina reads web pages; X searches go to the X API; stock quotes look up the ticker symbols you ask about with Yahoo Finance and Stooq; and AFL fixtures and results come from Squiggle, which our servers ask for whole seasons, so it never learns which clubs you follow. These providers receive the query, not your account details.
• Straight from your device: weather comes from Open-Meteo; news and news-feed discovery use Google News and Feedly, which receive your chosen topics, sports and region; team websites and calendar links you give Sammy are read straight from those sites; news articles and images load from publishers’ own websites; and the on-device models, including the memory search model every install downloads, come from Hugging Face. Like any website you visit, these services see your device’s IP address. When a team page has no calendar or fixture table Sammy can read itself, and you shared it in a Sammy Cloud chat, the page’s text and the team’s name go to Sammy Cloud to pick out the games. Never from an on-device chat.
• Apple: for Sign in with Apple, payments and subscriptions, iCloud backup, the age-range check, and Apple Maps services for place names and travel times.
• Google: for Sign in with Google, and the Gmail, Calendar and Drive features you choose to connect.
• Email delivery: our email provider (Resend) sends account emails (such as sign-up confirmations and password resets) and waitlist emails on our behalf, and alerts our team when you report a response.

We may also disclose information where the law requires it.

6. Safety and content reports

If you choose to report a response, we receive the reported reply, the message you sent just before it, Sammy’s reasoning for that reply, the reason you chose and any note you add, along with the model, the app version and references to the conversation. You’re shown what is included before you submit a report. Reports are emailed to our team for review and kept for safety and quality review. Reports from an account are linked to it and are removed when you delete your account (see section 7); reports from guests aren’t linked to anyone.

7. Data retention and deletion

Most of what Sammy holds about you is on your device and in your backups, and stays there until you delete it. On our servers, we keep your account, subscription and report records, and the counts that apply your plan limits, while your account is open, and delete them when you delete your account. Crash and diagnostic reports are deleted automatically after 12 months, and records of your Sammy Cloud use after 24 months, or sooner if you delete your account. Counts of stock lookups are deleted after 7 days, and sign-up abuse checks after a day. Entries on our website’s waitlist (an email and referral details) are deleted six months after Sammy’s public launch. Our providers keep data as described in section 5.

• Delete your account at any time in the app, in Settings → Account → Delete Account. This deletes your account and our records about you, including your entry on our website’s waitlist, erases Sammy’s data on your device, and disconnects Google.
• Delete All Data, in the same place, erases Sammy’s data on your device but keeps your account.
• Backups stored in your own iCloud or Google account are deleted through those services.
• Anonymous completion counts can’t be linked to you, so they can’t be deleted for one person.

8. Security

We use encryption in transit, encrypt backups on your device before they’re uploaded, and keep sensitive values such as sign-in tokens in your device’s keychain. Speech recognition runs on your device. No system is perfectly secure, but we work to protect your data.

9. Age and children

Sammy is for users aged 18 and over. When you sign up we ask for an age signal, either Apple’s age-range check or a date of birth you enter, only to confirm you are 18 or over. The date of birth is checked on your device and never sent to us: we do not store your date of birth; we keep only the result that you are an adult. Sammy is not directed at children, and we do not knowingly collect data from anyone under 18. If you believe a child has provided us data, contact us at the address below and we will delete it.

10. Where your data is processed

Keep DS is based in Australia, and our main database is hosted in Sydney, Australia. Most of our service providers are based in the United States, and some process data in other countries where they or their infrastructure operate: AkashML’s independent GPU operators and Google, for example, don’t commit to a single country. We send personal information overseas only to provide the Service you use.

If you’re in the EU or UK: Australia isn’t covered by an EU adequacy decision. When we send your personal data to a provider outside the EU or UK, we use the safeguards in that provider’s data protection terms. Supabase’s and Anthropic’s terms include the European Commission’s Standard Contractual Clauses, with the UK Addendum for UK data, and Resend is certified under the EU-US Data Privacy Framework and its UK Extension. You can ask us for details of the safeguards for any provider at privacy@sammyai.app.

11. Your choices and rights

You can:

• turn Sammy Cloud sharing on or off at any time, in Settings → About → Sammy Cloud sharing;
• turn Share usage and crash data on or off at any time, in Settings → About;
• change what Sammy can access on your device in iOS Settings, and disconnect Google in Sammy’s settings or in your Google Account;
• see, change and delete your data in the app, and ask us for a copy of, or a correction to, what we hold on our servers;
• delete your account at any time (see section 7).

Depending on where you live, you may have additional rights under laws such as the Australian Privacy Principles, the GDPR, the UK GDPR, or the CCPA, including rights to access, correct, or delete your data. To exercise them, or to make a complaint, email privacy@sammyai.app. We may need to confirm it’s you, and there’s no charge. We aim to respond within 30 days. For requests under the GDPR or UK GDPR, we’ll respond within one month, or tell you within that month if a complex request needs up to two more months. If you’re not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au) or your local data protection authority.

If you’re in the EU or UK, you have the right to:

• access: get a copy of the personal data we hold about you;
• rectification: have it corrected if it’s wrong or incomplete;
• erasure: have it deleted;
• restriction: have us limit how we use it, for example while we check a correction;
• portability: get the data you gave us in a common, machine-readable format, or have it sent to another service;
• objection: object at any time to any use of your data that relies on our legitimate interests (see section 3);
• withdrawing consent: withdraw it at any time, without affecting what we did before. Turning off Sammy Cloud sharing withdraws your consent for Sammy Cloud, and turning off Share usage and crash data withdraws your consent for crash reports and completion counts.

You can also complain to a data protection authority at any time: in the EU, the one where you live or work, or where you think the problem happened (the European Data Protection Board lists them at edpb.europa.eu); in the UK, the Information Commissioner’s Office (ico.org.uk).

12. Google user data

Sammy’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use your Gmail, Calendar and Drive data only to provide the Sammy features you use, and it reaches our AI providers only to produce what you asked for. We don’t sell it, use it for advertising, or use it to develop, improve or train AI models, and we don’t let people read it unless you agree (for example, by reporting a response), it’s needed for security, such as investigating abuse, or the law requires it.

Newsletter suggestions and unsubscribing. If you connect Gmail, Sammy can show you which senders keep emailing you while you never open their messages. To do this the app reads only email headers (sender, mailing-list and unsubscribe headers, and read/starred status) from the last 90 days of your mail, on your device; it does not read the content of those emails, and the results are kept on your device only. If you ask Sammy about these suggestions in chat, sender names and counts are processed like any other chat content, but unsubscribe web addresses are never sent to Sammy or to any AI model. When you tap Unsubscribe, your phone sends one request directly to the sender’s unsubscribe address (a one-click unsubscribe), without cookies or any Google sign-in details; the sender can see that request and your phone’s IP address, as with any website you visit. Sammy never sends email on your behalf. Your choices (unsubscribed, keep, later) are stored on your device and removed by Delete All Data.

13. Changes

We may update this policy; we will change the “last updated” date above when we do. If we make material changes, we’ll let you know in the app or by email.

14. Contact

Keep DS Pty Ltd is the data controller for the Sammy app. For any privacy question or request, email privacy@sammyai.app or write to Keep DS Pty Ltd, Suite 193, Level 5, 33 Stewart St, Richmond VIC 3121, Australia.