Privacy Policy

What We Collect

Sooba collects the minimum data needed to text with you and help you plan:

• Phone number— the number you text Sooba from or sign in with. It identifies your account and is where Sooba texts you.
• Google Calendar data— only if you connect your calendar. Calendar access requires a separate connection and permission.
• Photos you text Sooba— stored so Sooba can look at them and reply.
• Text messages— the messages you send Sooba and his replies, processed to answer you and help you plan.

How We Use It

Your data is used solely to reply to you, help you plan and send the event heads-ups you opt in to. We do not sell, rent, or share your personal data with third parties for marketing purposes.

Limited Use of Google User Data

Sooba’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

Specifically, Sooba uses Google Calendar data solely to provide user-facing features: (1) reading your connected calendars to answer your questions, help you plan and send the event heads-ups you opt in to, and (2) only when you ask by text, creating, changing, removing and responding to events on your own calendar. We do not use this data for advertising, do not allow humans to read it (except with your explicit consent, for security investigations, or where required by law), and do not transfer it to third parties except as necessary to provide or improve these user-facing features.

Third-Party Services

We use the following services to operate Sooba:

• Supabase— phone sign-in and database storage.
• Google APIs— authorized calendar access.
• Composio— hosted calendar consent, connection authentication and authorized calendar API requests. Calendar requests and responses pass through Composio when you use this connection.
• Twilio— SMS messaging.
• Anthropic— AI processing for Sooba’s replies.
• Vercel— hosting and serverless functions.

Data Retention

Your data is retained as long as your account is active. You may request deletion of your account and all associated data by contacting us.

How We Protect Your Data

• Encryption in transit— all communication between your device, Google, and Sooba is protected with TLS 1.3.
• Encryption at rest— user data, including synced calendar events and connection records, is stored in Supabase. Composio manages credentials for calendar connections made through its hosted consent flow. Existing direct Google credentials remain in protected server-side storage while those connections are in use.
• Credential handling— Sooba does not use or store passwords. You sign in with a one-time code texted to your phone. Calendar access is granted through OAuth 2.0, and you can revoke it at any time via Google Account Permissions.
• Access controls— row-level security is enforced in Supabase so each user can only access their own data. Personnel access is restricted, logged, and justified.
• Data retention and deletion— revoking calendar access stops future authorized access; it does not itself delete previously saved events and connection records. To request deletion, email privacy@momentum.study.
• No sale or advertising use— we do not sell user data or use Google user data for advertising.
• Sub-processors— Supabase (database and storage), Composio (calendar connection and API transport), Vercel (hosting), Anthropic (AI processing), and Twilio (SMS). AI prompts sent to Anthropic do not include raw OAuth tokens.
• Breach notification— in the event of a data breach affecting your information, we will notify affected users within 72 hours.

Contact

For privacy questions, contact us at privacy@momentum.study.