Privacy Policy

When you register we collect your name, email address, and a securely hashed password (if you sign up with email/password). If you sign in with Google we receive your name, email address, and profile picture from Google.

To personalise your brief we store your selected interests and sub-interests, preferred delivery schedule, location (for local news, if provided), custom focus keywords, and favourite news sources.

Premium users may create tasks manually or sync them from Google Tasks. We store task titles, notes, and due dates solely to include them in your daily brief.

Premium users may optionally connect a Google account to enable calendar and task features. When you connect a Google account, we request the following OAuth scopes and access the following specific data:

• https://www.googleapis.com/auth/calendar.readonly — We read the title, start and end date/time, and location of events on your primary Google Calendar for the current day only. We do not access event descriptions, attendee lists, video conference links, or any other calendar metadata beyond what is needed to display your daily schedule.
• https://www.googleapis.com/auth/tasks.readonly — We read your Google Task titles, notes, and due dates for incomplete tasks. We do not access completed tasks, subtasks, or task list metadata beyond what is needed to surface your to-do list.
• https://www.googleapis.com/auth/userinfo.email & https://www.googleapis.com/auth/userinfo.profile — We read your Google account email address and display name solely to identify which Google account is connected to your MyDailyBrief account.

What we do not access: We do not access the content of your emails (Gmail), your contacts, Google Drive files, your full calendar history, private event details, attendee information, or any Google data beyond the specific scopes listed above.

We store your OAuth access token and refresh token in encrypted form in our database solely to fetch calendar events and tasks on your behalf at the time your brief is generated each morning. Calendar event data and task data are not stored permanently — they are fetched at generation time, included in your brief email, and then discarded. Only the OAuth tokens themselves are stored.

We record which newsletter sections you click on (pillar and article URL) to gradually improve article ranking for your account over time. This data is associated with your account and is never shared with third parties for advertising purposes.

Payments are processed by Stripe. We do not store your card number or payment details on our servers. We store a Stripe customer ID and subscription status to manage your premium plan.

When you connect a Google account, we access only the minimum data necessary to provide the requested features:

• Google Calendar: event title, start/end date and time, and location for today's events only
• Google Tasks: task title, notes, and due date for your incomplete tasks only
• Google Account: your email address and display name to identify the connected account

We do not access Gmail, Google Drive, Google Contacts, full calendar history, attendee details, or any data beyond what is explicitly listed above.

Google user data is used exclusively to provide and improve the features you have explicitly enabled:

• Calendar data is used solely to render a "Today's Schedule" section in your daily brief email, showing your meetings and events for the day.
• Tasks data is used solely to render a "Your Tasks" section in your daily brief email, surfacing incomplete tasks as a morning reminder.
• Account identity data (email, name) is used solely to link the Google account to your MyDailyBrief account and to display which account is connected in your dashboard.

We do not use Google user data to train AI or machine-learning models, to build user profiles for advertising, to personalise content outside your brief, or for any purpose beyond the features described above.

Google user data is not sold, rented, or shared with any third party for advertising, analytics, or any commercial purpose. Specifically:

• Your Google Calendar or Tasks data is never sent to OpenAI, NewsAPI, Meta, TikTok, or any advertising platform.
• Your Google OAuth tokens are stored only in our database (Supabase) and are not shared with any third party.
• The only service that handles your brief content (which includes calendar/task data rendered as text) is Resend, our email delivery provider, which receives the finished HTML of your brief solely to deliver it to your inbox.

We may disclose Google user data only if required by law or to protect the rights and safety of our users, and only to the minimum extent necessary.

• OAuth access tokens and refresh tokens are encrypted at rest in our Supabase (PostgreSQL) database hosted on AWS infrastructure.
• All data in transit between our servers and Google's APIs is protected by TLS 1.2 or higher.
• Calendar event data and task data are not stored persistently. They are fetched from Google at brief generation time, rendered into your email, and discarded. Only the OAuth tokens are stored.
• Access to stored OAuth tokens is restricted to the application service account. No employees have routine access to individual users' Google data.
• We do not allow any human to read your Google Calendar or Tasks data unless you have explicitly requested support assistance, or we are required to do so by applicable law.

Retention:

• OAuth tokens are retained only while your Google account remains connected to MyDailyBrief. They are permanently deleted as soon as you disconnect your Google account from your dashboard, or when you delete your MyDailyBrief account.
• Calendar and task data is not stored — it is fetched at brief generation time and exists only within the email delivered to your inbox. We retain no copy of this data.
• Account identity data (your Google email and display name used to identify the connection) is retained until you disconnect the Google account or delete your MyDailyBrief account.

Deletion:

• Disconnect Google: You can disconnect your Google account at any time from your dashboard. This immediately revokes our access and permanently deletes all stored OAuth tokens.
• Delete your account: You may request full account deletion, including all Google user data, by emailing privacy@mydailybrief.co. We will complete the deletion within 30 days and confirm by email.
• Revoke via Google: You can also revoke MyDailyBrief's access to your Google account at any time from your Google Account permissions page. Upon revocation, our refresh token becomes invalid and we will no longer be able to access your Google data.