Your data is yours.

1. Who we are

Sageful ("we", "us", "our") is a software product operated by Brian LeSage. You can reach us at hello@sageful.app. Sageful is currently in beta and is operated as a sole proprietorship.

2. What we collect

Information you give us directly

• Account info: email address, password (hashed by Supabase), display name, role (Executive, Creator, Student, Founder), timezone, and an invite code if you used one.
• Settings and preferences: dashboard layout, card sizes, theme, weather location, quote category preferences, Gmail filter choice, and similar UI state.
• Tasks, projects, and ideas you enter: the text you type into Sageful's task and idea queue cards.

Information from connected services

When you connect third-party services (Google Calendar, Google Tasks, Gmail, LinkedIn analytics), Sageful accesses limited data through those services' APIs. Specifically:

• Google Calendar: read your events, create new events when you add them through Sageful, and update or delete events you change in the dashboard. Scope: calendar.
• Google Tasks: read your task lists and tasks, mark tasks complete or incomplete from Sageful. Scope: tasks.
• Gmail: read message metadata (sender, subject, date, snippet) from your inbox to display unread counts and previews. Read message bodies only when you explicitly click an email to view it. Mark messages as read when you open or dismiss them in Sageful. Scope: gmail.modify. We never send email on your behalf.
• LinkedIn analytics: data is imported via a CSV file you provide or a Chrome extension you install. We never access LinkedIn directly.

Information we collect automatically

• Basic technical data (browser type, device type, screen size) for responsive layout.
• Anonymous, privacy-friendly analytics on the public marketing pages (sageful.app, /about, /privacy, /terms) via Plausible Analytics. Plausible is a GDPR-compliant, cookieless service that does not use any personal identifiers, IP addresses, or cross-site tracking. We use it to count page views and waitlist signups so we know which pages are working. Plausible analytics are not loaded inside the dashboard itself.
• OAuth tokens from connected services (encrypted, stored in our database).

3. What we don't collect

• We do not read the content of your emails unless you explicitly click an email to view it in Sageful.
• We do not store the body of your emails on our servers — message bodies are fetched on demand and shown only to you.
• We do not use tracking cookies, advertising pixels, session replay tools, or any analytics inside the dashboard.
• We do not sell, rent, or share your personal data with anyone for marketing purposes.
• We do not train AI models on your data.

4. How we use your data

We use the data you give us — and the data we access via connected services — solely to operate Sageful for you:

• To display your calendar, tasks, emails, and other data in the dashboard.
• To save your settings so they sync across your devices.
• To provide the AI assistant feature, which sends contextual data (your tasks, calendar, priorities) to Anthropic's Claude API to generate responses for you. Anthropic does not retain or train on this data per their commercial terms.
• To send essential service emails (account verification, password resets, security alerts).
• To respond to your support requests.

5. Where your data lives

• Account, settings, tasks, ideas: stored in our Supabase database (Postgres). Hosted in the United States.
• OAuth tokens: stored encrypted in Supabase, accessible only by your account via row-level security policies.
• Email content: not stored. Fetched on demand from Gmail when you view a message and discarded after rendering.
• AI conversations: not retained on our servers. Each request is sent fresh to Claude and the response is shown to you and discarded.

6. How we protect your data

• All data is transmitted over HTTPS with strict transport security.
• Supabase row-level security policies ensure that you can only access your own rows.
• OAuth refresh tokens are stored server-side; we never expose them to your browser.
• API endpoints validate JWT tokens on every request.
• Rate limiting protects against abuse and credential stuffing.
• We follow security best practices including content security policy, anti-clickjacking headers, and input sanitization.

No system is perfectly secure. Sageful is in beta and operated by one person. While we take security seriously, you should not store regulated, classified, or extremely sensitive data in Sageful at this time.

7. Your rights

You have the right to:

• Access the personal data we hold about you.
• Disconnect any connected service at any time from your settings page.
• Delete your account and all associated data by emailing hello@sageful.app. We will permanently delete your data within 30 days.
• Export your data on request.
• Object to or restrict our processing of your data.

8. Cookies

Sageful uses only essential cookies and local storage required to keep you signed in and remember your settings. We do not use advertising or tracking cookies. By using Sageful, you consent to these essential cookies.

9. Children

Sageful is not intended for users under 16 years of age. We do not knowingly collect personal information from children. If you believe a child has provided us information, please contact us and we will delete it.

10. International users

Sageful is operated from the United States. If you access Sageful from outside the US, your information will be transferred to and processed in the US. By using Sageful, you consent to this transfer.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version on this page with a new "last updated" date. For material changes, we will notify active users by email. Continued use of Sageful after changes constitutes acceptance of the updated policy.

12. Contact

Questions, concerns, or requests? Email hello@sageful.app.