Privacy Policy

1. Information We Collect

We collect information you provide directly, including your email address when you create an account. If you connect Google Calendar, we store an encrypted OAuth refresh token that allows us to read your calendar events on your behalf. If you connect Gmail, we store a separate encrypted refresh token and read order and receipt messages to name items on matching bank charges. We do not store your Google password. If you connect a bank or credit card through Plaid, we store an encrypted access token and sync account balances and transactions for your household.

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and improve the Suzu service
• Display your household's calendar events, meals, groceries, todos, and money
• Authenticate you and maintain your session
• Respond to your requests and support needs

3. Google Calendar and Gmail

Suzu accesses your Google Calendar data only to display events within the app. We request read-only access and do not modify, share, or sell your calendar data. Your refresh token is encrypted at rest using AES-256. You can disconnect Google Calendar at any time from Settings, which deletes your stored token.

If you connect Gmail, Suzu requests read-only access and searches recent order and receipt messages. When a message matches a bank charge by amount, date, and merchant, Suzu stores the item name and order id on that transaction. Messages that do not match are not saved as purchases. Disconnecting Gmail deletes that token and does not disconnect Google Calendar.

Our use of Google user data complies with the Google API Services User Data Policy, including the Limited Use requirements.

4. Bank Connections

Suzu uses Plaid to connect bank and credit card accounts that you choose. Access tokens are encrypted at rest using AES-256. Transaction and balance data is shared with every signed-in member of your household. You can disconnect an institution at any time from Settings or the Money tab, which deletes the stored token and synced transactions for that connection. We never store your bank password.

5. Data Sharing

We do not sell, rent, or share your personal information with third parties for their marketing purposes. We may share data with service providers (Supabase for database and authentication, Vercel for hosting and the AI Gateway, OpenAI (through that gateway) for AI features, Plaid for bank connections) solely to operate the service.

6. Data Retention

We retain your data as long as your account is active. You may request deletion of your account and associated data by contacting us. Google Calendar tokens, Gmail tokens, and Plaid bank connections are deleted immediately when you disconnect the connector.

7. Security

We use industry-standard security measures including encryption in transit (TLS) and at rest (AES-256 for sensitive tokens). No system is perfectly secure; please keep the email or Google account you sign in with secure.

8. Changes to This Policy

We may update this policy from time to time. We will notify you of significant changes by updating the date at the top of this page.

9. Contact

Questions about this policy? Email us at andrewmcewen96@gmail.com.