Privacy policy

A. Account information

• Your email address and, if you give one, a display name. Signing in by email uses a one-time code that we send to that address.
• Your sign-ins: a sign-in cookie in your browser and, on our servers, a session record that includes the IP address and browser it was created from.
• The desktop device you approved and the last time it was seen.
• Your account kind (Individual or Teams, decided by whether your email address is on a personal or a company domain, or set by our support team when we correct it), the workspaces you belong to, your role in each, and the workspace you are working in now.
• Your preferences (voice, languages, speech-to-text and turn-detection settings, pointer colours, and your wake word, gesture symbol and session context choices), synced so every device uses them. The gesture symbol is stored as the few drawings you saved (64 points each), not as a recording of your pointer.
• Your account's daily limits.

B. Usage and device information

• Usage counts: tasks, voice seconds, AI tokens, verification calls and their cost, recorded against you and the workspace you worked in and priced by the workspace's rate card. They show on your dashboard, enforce your daily limits and are billed to the workspace.
• Voice calibration samples: for each voice request that changes something, only the speech-recognition confidence, the engine and model version, and whether it was sent, confirmed, corrected or canceled after a read-back; never audio or text. We use them to tune when MySunday reads a request back to you, and keep them 180 days.
• Product events, such as a download, a sign-up, pairing the extension, a task being created or checked, or a daily limit being reached.
• Downloads and updates. Downloading the Mac app or the extension from this website needs you to be signed in, as a member of an active workspace, and the installed app gets updates only while it is signed in. Each download or update uses a link that works for 6 hours, and we record who created each link and when it was used: your user id, the workspace that allowed it, the version and file, when the link was created, when it expires and when it was fetched, a hashed form of your IP address (a keyed hash; we do not store the address itself) and your browser's or the app's user agent. We use this to protect the downloads and to see when a link is shared. These records are deleted automatically 90 days after the link expires. Our storage provider also writes an access log of each fetch, with the link's id, the IP address and the user agent; we keep it in a private log bucket for 90 days.
• Messages you send through the contact form. What you write, your name and your email address are stored so we can answer, and are emailed to our support inbox. We delete them 365 days after you send them, and straight away if you delete your account — the copy in our inbox is kept so a conversation we are having with you is not cut off.
• Server logs with request ids, user ids and error details, so we can find and fix problems. Your IP address is used for rate limiting; those counters expire after a minute.
• Page visits on this website, counted without cookies (see section 5).

C. Your content

This is what you create or capture while you use MySunday, and where each part goes.

• Voice audio. Voice is an open microphone, not push-to-talk. From the hotkey until you turn voice off, say goodbye, or after 2 minutes without speech, what the microphone hears is turned into text and replies are spoken by the speech engines MySunday uses (see “Where voice runs” below), and only while voice is on. The 2 minutes are a default you can change on This Mac on your dashboard (0 means never). Replies are made from text the app writes; fill values are never spoken. A voice session can also start from your wake word or gesture (H below).
• Where voice runs. MySunday chooses the speech engines for everyone, not each user: by default speech recognition (Moonshine) and spoken replies (Kokoro) run on your Mac and your audio does not leave it. MySunday may instead use a cloud speech engine, Deepgram (speech-to-text) or ElevenLabs (spoken replies), for everyone or for a workspace; then your audio, or the text of each reply, goes to that provider while voice is on. The app shows no engine names; this page and the subprocessor list below are where they are named. You choose only the voice that speaks and your language, in the app. The app never switches to a cloud engine on its own because of a language: a language the engines in use do not serve is left out.
• Voice model downloads. Voice models are downloaded from Hugging Face after you install the app and sign in, from fixed addresses, and checked before use. The downloads carry the app's name and version and no account information; Hugging Face sees your Mac's IP address, as any website you visit does.
• The voice model. Your transcripts, the labels of the elements you point at, the names of what is on your screen and page URLs, and, during a session, the first 80 characters of items you copied, selected or dragged (never your audio), go to a language model, on OpenRouter by default, which turns what you say into a request. So does a screenshot of the window you point at when you ask about it, as described under “Screenshots when you ask about your screen”. Section 8 lists the other model providers an administrator can route it to. When you type a request to fill a field, the labels of that field and the fields around it (never their values) go to a model on OpenRouter to suggest the value.
• What you point at. The HTML, text, styles and screenshots of the elements you point at, with your instruction, go into the prompt of the coding agent you installed yourself. Claude Code sends them to Anthropic, and Codex sends them to OpenAI, under your own account and those providers' terms, together with whatever of your code the agent reads. MySunday does not receive your agent's model traffic. Values typed into inputs are removed from these captures before they leave the browser.
• Checking the result. Screenshots of the element you pointed at, of any reference you captured and of the result after the agent's edit go to a model (OpenRouter by default, or the provider an administrator routes change checks to), which judges whether the change matches what you asked. They may contain whatever was on that part of the page.
• Your project's own checks. When MySunday runs your project's own commands (tests, type checks, lint) to check a change, their output stays on your Mac. Only when a check fails, and only to write the short summary that tells your coding agent what broke, the failing command's output goes to a model (OpenRouter by default, or the provider an administrator routes failure summaries to). That output is your project's, so it may contain file names, code and test data; keys and tokens are removed first. An administrator can turn that summary off by setting its daily budget to zero, and your agent is then given the raw output as before.
• Field fills. MySunday can type a value into a field on your page after you confirm it. The form is never submitted. The value is never stored, logged, synced or spoken by MySunday: the request we keep and sync carries only its length. If you say a value out loud, it is part of your transcript, which the voice model receives as described above (and part of your audio, which Deepgram receives only if you chose it).
• Questions and explanations. You can ask about an element you point at, a whole page, your code or text you selected. A question about why something in your own project happens goes to your coding agent, which answers in read-only mode from the page's text (with secrets removed), your code and, when the rules in I say it matters, the page's recent console errors and failed requests. Nothing is edited. A question about what something means or shows, any question about a page that is not one of your projects, and, when no coding agent is ready on your Mac, any question you type about text you selected, a page or something you picked, goes instead to a language model (the “explain” purpose, OpenRouter by default) with the text or element you pointed at, the page's title and address, up to three knowledge-base excerpts and, for your own project, the source lines around it. For a why or what-happened question, up to three of that page's recent responses from its own address (from the session context above, on any site, each cut to 4 KB with secrets removed) and its console errors go with it. When you ask by voice, up to three earlier questions and answers from the same voice session and tab (from the last 5 minutes) go with it, so a follow-up such as “and this dip?” is understood. For a question about a whole page, up to 4,000 characters of the page's visible text (with secrets removed) go with it. A question about your code always needs a coding agent. Answers are shown beside what you pointed at and spoken in one sentence. A coding-agent answer is synced as the task summary, at most 500 characters; the page text and selection are not. An answer from the language model is not synced: a question you typed is kept on your Mac with your tasks (30 days by default), and other explanations for 7 days.
• Meeting notes. When you start meeting notes (from the tray, the hotkey, the app's Meetings page, a detected call or by asking), the app records your microphone and your Mac's system audio, which includes the voices of the other people in the call. Both are transcribed on your Mac by default; if an administrator turned on a cloud speech engine and you chose it, the audio goes to that provider (Deepgram) to be transcribed. The audio itself is never stored. To label who said what, the app computes voice fingerprints (speaker embeddings) of each stretch of speech while it is in memory and keeps them with the meeting on your Mac. The transcript and the notes you type are kept on your Mac (state.sqlite) for the number of days set for this Mac (180 by default; you can change it on the website under This Mac) and deleted when that time is up or when you delete the meeting. To write the summary, the transcript and your typed notes go to a language model (the “notes” purpose, OpenRouter by default; see section 8). You are responsible for telling the other people in the call that you are taking notes and for any consent the law where you or they are requires before a call is recorded or transcribed (see the Terms).
• Edits in documents. When you ask for a change in a Google document, sheet or deck, or in a Mac office app, the app reads what you pointed at and, when the request needs it, the document's own export: the text around the edit, up to 50 KB on each side (at most 200 KB), or a sheet's contents. That text, your instruction and screenshots of the document window go to a language model (“rewrite” or “operator”, OpenRouter by default) to plan and check the edit. The export is held in memory for the plan only. The app keeps a list of the edits it made (the app and document, the step names and whether Undo is possible) in memory on your Mac, never their text, and loses it when the app restarts.
• Input tasks. When you ask MySunday to put text in a box, fill a form or do steps on screen, it shows you first and does nothing until you say yes. To write or change text, your request, what the box holds and the words around it go to a language model. To fill a whole form, the form's box labels and what you said for them go to a language model. To work out steps, your request and the names of the controls on screen go to a language model, with a picture of the browser tab unless a password or card field is in view, never what the boxes hold. The box's label and the app or site stay on your Mac, and are never synced. Your account's Sessions page shows only the kind of task, how many boxes or steps it had and how it ended, never the text. Your saved details (“My details”: your name, email, phone, address, company and job title) stay only on your Mac, are never synced and go to no model. On banks and password managers nothing from the page goes to a model.
• Booking from a message (“book this”). When you point at a date in an email or a message and ask MySunday to book it, the text you pointed at and up to 6,000 characters of the message around it go to a language model (the “explain” purpose, OpenRouter by default; see section 8) to read the event's title, day, time, place and who to invite. MySunday then checks when you are free and proposes a time; nothing is created until you confirm on the card in the app (or by saying yes while the card is shown). With a Google account connected (below), your Mac reads only the busy times of your primary calendar, never the details of your events, and creates the event you confirmed through Google, which emails the invitation to the people on it. Without a connection, the app reads the busy times shown in your own Google Calendar tab in Chrome and fills its event form, also only after you confirm. The message text, the proposed event and the people's addresses are held in memory on your Mac for the request (at most 5 minutes) and are never synced to us.
• Suggestions, decisions and failure summaries. To offer what you can do with something you pointed at, a short description of it (its kind, role, name and a few words of its text) goes to a language model (“suggest”). When the app recommends a choice, the task's instruction, its verification result and the names of the changed files go to a decision model (“decide”). When a command or check fails, its last lines, with secrets removed, go to a model to write a short summary (“triage”). An administrator can turn each of these off for a workspace; the full list, with what each sends, is on the privacy map (/privacy/map).
• Sessions synced to your account. Your instructions, transcripts, requests and task outcomes (kind, status, verdict, attempt counts, summaries and changed file names) are synced to our backend so your dashboard can show them. A spoken request to fill a field is synced as “[fill request, N characters]”, so the value you said stays on your Mac. TheThis Mac on your dashboard has “Sync what I say” (on by default): turn it off and no transcripts leave your Mac for our backend. Your words still go to the voice model while voice is on, so the app can understand you; your audio leaves your Mac only while a cloud speech engine is in use (see “Where voice runs”).
• Clips. A short recording of a change is uploaded only when you choose to share it. A clip is a private link until you publish it to the gallery.
• Diagnostics, only when you press Send to support in the app, with your note: the app's settings without its tokens, which providers are set up (yes or no, never the keys) and its recent log lines.

D. Knowledge base and memory

• Website sources. Workspace members can add websites to the workspace's knowledge base. We fetch their pages on the schedule the workspace sets (manually, daily, weekly or monthly), honouring each site's robots.txt.
• Uploaded files: Markdown and text, PDF, Word (docx), CSV and JSON.
• For both, we store the uploaded file, the extracted text, chunks and embeddings for the workspace. The chunks are sent to an embeddings model on OpenRouter to make the embeddings. When you work in the workspace, the passages that best match your request are added to your coding agent's prompt.
• Memory: the workspace's instructions and notes, including notes learned from tasks you accept. They are added to your coding agent's prompt in that workspace.
• A document stays until someone removes it or its source. All of it is deleted when the workspace is purged. Add only material the workspace is allowed to use; it is visible to the workspace's members.

E. Sign in with Google

Signing in with Google is optional; a one-time email code works just as well. If you choose Google, Google tells us your email address, your name and your profile picture. We do not get your Google password, and signing in gives us no access to anything else in your Google account (Google Calendar is a separate, optional connection; see below).

F. Google Calendar (optional)

Connecting Google Calendar is optional and separate from signing in. You start it on the website (Account → Google Calendar) and Google asks you to allow two things: seeing when you are free or busy (calendar.freebusy) and creating and editing the events you confirm (calendar.events), plus your email address so the app can name the account on each booking card. Google gives us a key for this access. We never keep it in readable form: our server seals it with your account's own encryption key, which only your Mac can open, and deletes the sealed copy as soon as your Mac collects it (at most 30 minutes). After that the key exists only on your Mac, in the private file where the app keeps its sign-in. When your Mac needs to talk to Google Calendar it sends the key to our server, which asks Google for a short-lived access pass and hands it back without storing either; your Mac then talks to Google directly. We keep only whether you are connected, the Google address you connected and when. Disconnect on the website at any time: we stop issuing access at once, and your Mac revokes the key at Google and deletes it the next time it is online. You can also remove MySunday at myaccount.google.com → Security → Third-party apps. MySunday's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use calendar data for advertising, do not sell it, do not let people read it, and do not use it to train AI models.

G. Payments and billing

• Payments are sold and processed by Paddle, which is the merchant of record for your purchase. You enter your card into Paddle's payment form — it opens on our payment page, but the form itself is Paddle's and your card details go straight to Paddle, not to us. You manage your card and see your invoices on Paddle's own customer portal. We receive only what Paddle tells us about a payment, such as its amount and status.
• For each workspace we keep its billing data: plan, plan credit and top-up credit, top-ups, automatic top-up settings (threshold, amount and monthly cap), subscription status, invoices and the usage charged to it.
• To work out tax, Paddle collects your billing address or tax location and any tax ID you give (such as a GST or VAT number), and calculates and remits the tax itself as the merchant of record.
• Paddle emails receipts and invoices for payments and top-ups. We email billing notices (subscription started, renewal, top-up, failed payment) and billing reminders to the workspace's owners and admins.

H. Other information

• Early access. While sign-up is by invite, if you ask for an invite we store your email, the page you asked from, your optional note, the site that sent you there, campaign tags and the invite status, so we can send you an invite. We use it for nothing else. Once you sign up, it is part of your account export.
• Invites. When a workspace owner or admin invites someone, we store the invited email address and role, and send the invite by email.
• Support. When you write to us, we keep the conversation so we can help you and follow up.

I. Wake word, gesture and session context

• The wake word. It is off until you turn it on in your preferences. While it is on and you are signed in, the app keeps your microphone open and the word is detected on your Mac by a small on-device model; the tray shows when it is listening. Nothing you say before the word leaves your Mac: the app keeps only about 2 seconds of audio in memory to spot it. Once it hears the word, it opens a voice session, and what you say after the word (up to 5 seconds, then the live microphone) is handled like any voice session (C above): on your Mac by default, or by Deepgram if you chose it.
• The gesture. Gesture wake is on once you save a symbol (drawn 3–5 times on the Preferences page). The symbol is stored with your account and matched on your Mac; the pointer path never leaves it. The drawings of your symbol that you save on this website are stored with your preferences; delete the symbol to turn gesture wake off. While a symbol is saved and voice is off, the app watches the pointer on your Mac. Pointer movement is never recorded, logged or sent; only a count of candidate strokes is logged.
• Session context. MySunday keeps it only while a session runs: a voice session, a task being worked on or waiting for your review, the side panel or the Ask window being open. During a session the extension notes console errors and warnings, details of every call a page makes (method, address, status, timing and size), the pages you visit in every tab, and the text or JSON responses a page gets from its own address, on any site, so a question about a page (such as “and this dip?” on a dashboard) can use the data it shows. So that a question asked right after you open a page can still use what it loaded, the extension also keeps the page's last 20 such responses (text or JSON from its own address, each cut to 32 KB) inside that page, in your browser, while no session runs. They are not sent anywhere, not even to the app on your Mac, until a session starts on that tab; then they join the session under the same rules as above (secrets removed, nothing from another address, nothing from password managers or banking sites) and are cleared from the page. Leaving or closing the page clears them too. A response from another address is never kept, and password managers and banking sites keep no responses at all. Request bodies are kept only on pages under an address you attached as a project, including a deployed staging or production site, and only for calls to that page's own address. Each response is cut to 32 KB, with secrets removed before it is kept. It is all held in memory on your Mac and never synced to us; responses from sites that are not your projects are deleted as soon as the session ends, and the rest is wiped 5 minutes after it ends (Clear wipes it at once). You can switch it off in your preferences.
• Secrets are removed first. Tokens, API keys, passwords, private keys and card numbers are replaced before anything is kept, in the browser, the app and again in the local service. On sites you have not attached as a project the query string is dropped from every address; on your projects the values of sensitive parameters are removed. Request headers and cookies are never kept.
• The debugger. To see errors a page cannot report itself, the extension can attach Chrome's debugger to your project tabs, and Chrome shows a bar while it does. By default it attaches on demand, for at most 3 seconds while a question or a bug report is handled. In your preferences you can switch it off or keep the debugger attached for the session. If you cancel Chrome's bar, it never re-attaches on its own until the next session.
• Copied, selected and dragged items. During a session only, and never outside a session, MySunday keeps the last 5 things you copied, the last 5 you selected and the last 5 you dragged: text, links and file names, never file contents (for an image, only its size). Copies from password managers, and items marked concealed or temporary, are skipped. Text you select on web pages is noted during a session; text in other Mac apps only when you press the Ask hotkey. A drag records what was dragged, where it came from and where it landed. You can switch these off in your preferences.
• The Ask hotkey. It reads the text you selected in any Mac app when you press it, through macOS Accessibility. If an app does not share its selection that way, MySunday copies it for a moment and puts your clipboard back as it was (restored); it never does this while macOS protects secure input, such as a password field. When you send your question, it goes to your coding agent; when none is ready, a question about the selection or the page goes to a language model instead, as described under “Questions and explanations”.
• Screenshots when you ask about your screen. When you ask about something on your screen (this, that, here, a page or a button) or ask for a change while voice is on, or press the Ask hotkey, MySunday takes a screenshot of the window under your pointer and draws your pointer's path of the last few seconds on it, so the AI sees what you mean. Other apps' windows need macOS Screen Recording, which you allow in System Settings; without it the voice is told it cannot see your screen. A Chrome tab (through the extension, never an incognito window) and MySunday's own window need no Screen Recording. Password managers, a password field and secure input are never captured. The screenshot goes only with that ask: to the voice model or the model that answers your question, and to your coding agent when the ask starts a task. It stays on your Mac, is never synced, and is deleted when voice ends, after 30 minutes, or with its task.
• Walkthroughs you record. When you ask it to record one (“watch me”, the menu bar or the Activity page), MySunday keeps a screenshot with your pointer's path at each click, app or tab switch and each thing you say, with the app, window or page and the words, until you say “that's it” (at most 30 minutes or 100 steps). Unlike the screenshots above, a walkthrough is kept on your Mac until you delete the walkthrough, and is never synced. Copying it as a tutorial or “Make a plan” sends its steps (and, for a plan, the paths of its pictures) only where you choose: your clipboard, or your coding agent.
• What reaches your coding agent. A short summary (recent errors, failed calls, pages, or the item you referred to) is added to your coding agent's prompt only when it matters: errors on the page in the last minute, a bug report, a question, or a word like “copied” or “this”. The rest stays on your Mac unless the agent asks for it through MySunday's tools, which answer from the same redacted store. Your agent's provider (Anthropic or OpenAI) receives it under your own account, as in C above. The voice model gets only counts and short labels, such as the first 80 characters of an item you copied, selected or dragged, never bodies or full texts. Nothing from the session context is synced to our backend.

Never captured:

• what you type (keystrokes) and the values of form fields;
• incognito tabs, and browser pages such as chrome:, extension, devtools and file: pages;
• request bodies on sites you have not attached as a project, responses from any address other than the page's own, anything a password manager or banking site returns, request headers and cookies;
• audio before the wake word, and pointer movement outside gesture matching, voice sessions and walkthroughs you record;
• selections from password managers, or while macOS secure input is on.

What you should know:

• A coding agent's answer can quote page text, and its summary is synced like any other task. An answer from the language model is not synced, but the model's provider receives the text you asked about (section 8).
• A clipboard manager on your Mac may still record the brief copy the Ask hotkey makes when it has to.
• With Codex, a question about a site that is not your project runs read-only, but Codex can still read files outside its empty folder. It cannot change them.

A. On our servers

Deleting your account removes your sessions, clips, usage counts and diagnostics straight away; product events and download records stay only without your user id, and audit entries and storage access logs age out on the schedule above. Billing records are marked deleted and kept only as long as the law requires.

B. On your Mac

Deleting your account does not touch the files on your Mac. To remove those:

1. To keep the app but clear what it stored, open the tray → Settings → Delete local data. It removes screenshots, walkthroughs, prompts, transcripts, task folders, My details and logs, and the device sign-in; it keeps the app's settings and the extension pairing, the voice models and today's usage counts (the voice models go with the app when you delete it).
2. To uninstall, quit MySunday from the tray and move MySunday.app from Applications to the Bin.
3. Delete the data folder ~/Library/Application Support/myfriday (the folder keeps the app's original name; open it with Finder → Go → Go to Folder). It holds the device sign-in, the local database (My details is in it), task folders with screenshots and prompts, transcripts and logs. Delete ~/Library/Application Support/myfriday-agent-files beside it too (it also keeps the app's original name): the copies of pictures your coding agent was given.
4. Versions before 2026.10.19 kept the device sign-in in the Keychain. If it is still there, open Keychain Access and delete the entries named com.mysunday.desktop, and com.myfriday.desktop if an older version left one (it carries the app's original name).
5. Remove the extension on chrome://extensions (Remove from Chrome); if you loaded it unpacked, also delete that folder.
6. What was synced to this service stays until you delete it: delete your account to remove every synced row and sign the device out.

A. Service providers

These providers process data for us so the Services can work. The app on your Mac calls the model provider in use (OpenRouter today), and Deepgram or ElevenLabs only when you chose them, directly with keys we issue; that data does not pass through our servers. It downloads its voice models from Hugging Face. Our backend calls the model provider for knowledge-base embeddings, and Paddle and Resend for billing and email. An administrator chooses the model provider for each purpose (the voice model, change checks, fill suggestions, embeddings); we update this page before switching to a provider that is not in use today.

Anthropic and OpenAI are not on this list: your coding agent sends data to them under your own account (section 2C), and MySunday does not receive that traffic.

B. Inside a shared workspace

• In a workspace with other members, your sessions, transcripts and requests are visible only to the person who created them, including to the workspace's owners and admins.
• The workspace's memory, knowledge base, settings, usage totals and billing are shared with its members according to their role. Only owners and admins manage billing.
• Owners and admins see each member's usage and cost; other members see their own usage and the workspace total.
• Invitations and member lists show members' names, email addresses and roles to the workspace.

C. Support access by our staff

To give you support or investigate a problem, authorised MySunday staff may sign in to your account as you (“impersonation”). Each session needs a stated reason, ends after at most 60 minutes, and is recorded in our audit log. While in your account, staff cannot make billing changes or delete anything. We do not notify you each time this happens; you can ask us at support@mysunday.live whether and why your account was accessed.

D. Legal reasons

We may disclose information if the law, a court order or a valid request from a government authority requires it, or where it is needed to prevent fraud or abuse, or to protect the rights, property or safety of our users, the public or us.

E. Business transfers

If MySunday is reorganised, merged, acquired or sells its assets, including when the business moves into a registered company, your information may move with it. This policy will keep applying to it, and we will tell you before it becomes subject to a different policy.

F. With your consent

We share information in other ways only when you ask us to. For example, when you publish a clip to the gallery, anyone can see it.

A. India (DPDP Act, 2023)

Under the Digital Personal Data Protection Act, 2023 you have the right to:

• get a summary of the personal data we hold about you, what we do with it, and who we have shared it with;
• have your data corrected, completed or updated;
• have your data erased, unless we must keep it by law;
• withdraw your consent at any time (this does not affect what we did before you withdrew it);
• have your grievances addressed by our Grievance Officer (section 15);
• nominate another person to exercise these rights for you if you die or become unable to.

If our answer to a grievance does not satisfy you, you can complain to the Data Protection Board of India.

B. EU and UK (GDPR)

If the EU or UK GDPR applies to you, you can ask to access, correct or erase your data, restrict or object to how we use it, and receive it in a portable format. Where we rely on consent, you can withdraw it at any time. You can also complain to the data protection supervisory authority where you live or work.

C. California (CCPA)

If you live in California, you have the right to know what personal information we collect, use and disclose, to have it deleted or corrected, and not to be treated differently for using these rights. You can use an authorised agent.

We collect these categories: identifiers (email, name, IP address), commercial information (plan, payments, top-ups and credit), internet activity (usage counts, product events, page visits), audio (voice audio sent for speech-to-text) and other content you give us (transcripts, sessions, clips, knowledge-base documents, memory). They come from you and your devices, from Google if you sign in with it, and from Paddle about your payments. We use them for the purposes in section 3 and disclose them only to the providers in section 8 and, by role, to the members of your workspaces. We do not sell or share personal information for cross-context behavioural advertising, and we do not use sensitive personal information to infer things about you.

D. How to exercise your rights

• Export and delete: the account page downloads everything we hold about you as one JSON file, and deletes your account: every synced row, clip file, device, key and sign-in is removed immediately and the desktop app is signed out. There is no undo. Billing records are kept as section 6 describes.
• Billing: owners and admins find invoices and receipts in Paddle's billing portal and in Paddle's emails; our billing notices say what was charged.
• Local data: tray → Settings → Delete local data in the app, or the steps in section 6B.
• Anything else (correction, a question, a nomination, a complaint): write to support@mysunday.live from the address you signed up with, so we can confirm it is you.