Privacy policy
Thetical is a personal assistant that you talk to in a messaging app (Telegram today). This policy explains what data Thetical accesses, how it uses, stores and shares that data, and how you delete it. "Thetical", "we" and "us" mean the operator of thetical.co and the Thetical assistant. You can reach us at privacy@thetical.co.
The short version
- We use your data only to provide the features you use. We never sell it, never use it for advertising, and never use it to train AI models.
- Anything that spends money, sends a message on your behalf, changes a booking or shares your details happens only after you approve that exact action.
- We keep the minimum. From your email we keep extracted facts (such as a merchant, an amount and a date), never the emails themselves.
- You can export everything (
/export), disconnect an account and delete its data (/disconnect), or delete your account (/delete_account) at any time.
Data we collect
From you and your messaging app
- Your messaging account identifier and the name your messaging app shares with us.
- Your language, country, time zone and confirmation that you are 18 or older.
- The messages you send to Thetical and its replies, and voice notes if you send them.
- Things you ask Thetical to remember about you, reminders and tasks you set up.
- Items you add to your vault on the Thetical web app (website logins, personal details you choose to store). These are entered on a private web page, never in chat.
- Your approvals and the log of actions Thetical took for you.
From accounts you connect
You choose which accounts to connect (Google, Microsoft Outlook, Notion, Linear, Granola, GitHub). Thetical stores the access tokens for them encrypted, and accesses them only to provide the features described below. The Google section explains exactly what we do with Google user data.
Usage and cost records
We record counts, timings and costs of operations (for example, how many AI calls a feature made and what they cost) to run the service and keep it affordable. These records contain no message or email content.
Google user data
When you connect a Google account, Thetical asks for these permissions and uses them only as described.
| Permission | What Thetical does with it |
|---|---|
Gmail: read emailgmail.readonly | Reads the sender, subject and preview of your messages to find receipts, subscriptions, renewals, trials, failed payments, refunds, bookings and emails that need your attention or a reply. For a message that is relevant, it reads the text once to extract facts: merchant, amounts, currency, dates, order or booking references. It stores only those facts, encrypted. It never stores email bodies. It also receives notifications of new mail so it can tell you about important emails quickly. |
Gmail: drafts and sendinggmail.compose | Creates drafts and sends emails or replies you ask for, or replies it suggests to people who wrote to you. Every email is sent only after you approve the exact recipient and text. It does not delete, archive or label your email. |
Google Calendar eventscalendar.events | Reads your events to answer questions ("what's on tomorrow?") and to tell you when an upcoming event you attend is moved or cancelled. It keeps the last known time and place of your upcoming events, encrypted, to notice changes. It creates or changes events only after you approve. |
Google Taskstasks | Reads and adds tasks when you ask. |
Google Drive: files Thetical createsdrive.file | Creates Google Docs, Sheets and Slides you ask for, and reads those files back. It cannot see any other file in your Drive. |
Your Gmail address is stored only as a one-way fingerprint, used to match new-mail notifications to your account.
Thetical's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
In particular:
- We use Google user data only to provide and improve the user-facing features described above.
- We do not transfer Google user data to others except as needed to provide those features (the AI processing described below), for security, to comply with the law, or as part of a merger or acquisition with your notice.
- We do not use Google user data for advertising, and we do not sell it.
- We do not use Google user data to develop, improve or train generalized artificial-intelligence or machine-learning models.
- No person at Thetical reads your Google data unless you ask us to (for example, for support) and agree, it is needed for security (such as investigating abuse), or the law requires it.
How Thetical uses AI
Thetical uses AI models to understand your messages, sort new emails, extract facts from receipts and confirmations, summarize, and draft replies. The text involved is sent to these providers for processing:
- Anthropic (Claude models). Under Anthropic's commercial terms, data sent through its API is not used to train its models.
- TypeSafe (Jev decision model), reached through OpenRouter. Every request is sent with OpenRouter's settings that allow only providers that do not train on inputs and do not retain them.
Before email or web content reaches a model, card numbers and bank account numbers are removed. Content from emails and websites is treated as untrusted: it can't make Thetical take an action without your approval.
How we use data
- To provide the features you use: replies, reminders, your money report, inbox and calendar alerts, tasks, bookings, calls and website tasks you approve.
- To keep your account and the service secure, and to prevent abuse.
- To measure cost and reliability, using records without content.
We don't use your data for advertising, sell it, or use it to train AI models.
Who we share data with
We share data only with service providers that process it on our behalf to run Thetical, and only what each needs:
- Telegram: delivering messages between you and Thetical.
- Anthropic, OpenRouter and TypeSafe: AI processing, as described above.
- Cloudflare and Google Cloud: hosting and network.
- ElevenLabs: turning voice notes into text and replies into speech, only if you use voice notes.
- Telnyx: phone calls to businesses and text messages, only when you ask for them.
- Duffel: flight search, and bookings you approve (your passenger details go to the airline then).
- Browserbase: running some website tasks you approve.
- The services you connect (Google, Microsoft, Notion, Linear, Granola, GitHub): Thetical talks to them on your behalf.
We may disclose data if the law requires it, or to protect the safety of people or the service.
How long we keep data
- Emails: never stored. Extracted facts are kept until you disconnect the account or delete your account.
- Conversations, memory, reminders, tasks, vault items and your action log: kept until you delete them or your account. Older conversation is kept as an encrypted summary.
- Incoming notifications from messaging apps and providers: deleted after 7 days.
- Disconnecting an account deletes all data derived from it within minutes and destroys the encryption key that protected it, so copies in backups can no longer be read. Thetical confirms with counts.
- Deleting your account deletes everything we hold about you the same way.
- Usage and cost records without content may be kept in aggregated form.
Security
Data is encrypted in transit and at rest. Content is encrypted with keys specific to you and to each connected account. Actions that matter go through an approval step that the AI cannot skip. Thetical never asks for or handles card numbers, card security codes, bank account numbers or passwords in chat; logins are filled in from your vault without being shown to the AI.
Your choices and rights
- Access and portability:
/exportsends you a copy of all your data. - Deletion:
/disconnectfor one account,/delete_accountfor everything. You can also revoke Thetical's access in your Google Account settings at any time. - Control:
/settingsand the web app let you choose what Thetical may do without asking and which emails it tells you about. - Depending on where you live, you may have further rights, such as to correct your data or object to processing. Email privacy@thetical.co and we will respond within 30 days.
Age
Thetical is for people aged 18 and over. If someone tells us they are under 18 during sign-up, we delete their account.
International processing
Our service providers process data in the United States and other countries. We use providers that protect data under contractual safeguards.
Changes
If we change this policy in a way that matters, we will tell you in your chat with Thetical before the change applies.