Privacy Policy

Effective 28 September 2026

Atheena reads the accounts you connect, turns what you need to do into a todo list, and, when you ask it to, uses an AI agent to get those things done. This policy covers what data Atheena accesses, what it does with that data, who it shares it with, and how to have it deleted. Atheena is operated by Ritwik Kanodia and Madhav Sainanee ("we", "us").

1. What we collect

Your Google account

When you sign in with Google we receive your name, email address, profile picture and Google account ID.

Google Workspace data, with your permission

Google's consent screen asks for the permissions below. You can leave any of them unticked; Atheena then does less, and Settings shows which permissions each connected account holds.

• Gmail (read and modify). We read new messages to find todos, and show the thread next to its todo. When you ask the agent to, it can search your mail, draft and send replies, and change labels.
• Google Drive, Docs and Sheets. When you ask the agent to work on a todo, it can find, read, create and edit files.
• Google Calendar events. When you ask the agent to, it can create and update events.
• Google Contacts and "other contacts" (read only). The agent can look up email addresses.

You can connect more than one Google account. Each has its own permissions and can be disconnected on its own.

Other sources you connect

• Fathom and Pocket. The API key you paste into Settings, and the action items and meeting titles those services return.
• WhatsApp. If you link a number, we store that number, the messages and images you send to Atheena's WhatsApp number, and Atheena's replies.
• Browser history and local folders. These are available only when you run Atheena yourself on your own Mac. They are off by default, and the data stays on that machine.

What you create in Atheena

Todos you type, edits and decisions you make, your conversations with the agent, and a record of the actions the agent took in each conversation.

Technical data

• A session cookie that keeps you signed in. We use no advertising or third-party tracking cookies.
• The address your browser gives us for push notifications, if you turn them on.
• A record of when you open the inbox and Settings pages (page, account, time), which we use to see how Atheena is used. We don't use third-party analytics.

2. How we use it

• To find your todos. An AI model reads each new message or meeting item and decides whether it holds something you need to do. If it does, the model writes a title, a due date and a suggested next step. Newsletters, receipts and sign-in codes are skipped.
• To suggest how to close a todo. When you open a todo, an AI model proposes three ways to handle it.
• To act for you when you ask. The agent runs only when you start it, by typing a request, choosing a suggested action, or replying on WhatsApp. It then uses the permissions above, and a web browser, to do what you asked. It is instructed to ask you before any irreversible step it would otherwise have to guess at.
• To tell you about new todos. Through the morning email digest, browser push notifications and WhatsApp, depending on what you have set up.
• To keep Atheena running and secure. Diagnosing errors, preventing abuse, and meeting legal obligations.

We do not sell your data, use it for advertising, or use it to train AI or machine-learning models, whether ours or anyone else's.

3. Google user data

Atheena's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We use Google data only to provide and improve the features described in this policy, which you can see and control in Atheena.
• We transfer Google data to others only when that is needed to provide those features (for example, sending an email's text to our AI provider to find a todo in it), for security, to comply with the law, or as part of a merger or acquisition with notice to you.
• We never use Google data for advertising, and we never sell it.
• No person reads your Google data unless you have given permission for specific items, it is needed for security or to investigate abuse, the law requires it, or the data has been aggregated and anonymised for internal operations.
• We do not use data obtained through Google Workspace APIs to develop, improve or train generalised AI or machine-learning models.

4. Who we share it with

We share data only with service providers that help run Atheena, and only what each one needs:

• OpenAI processes the content Atheena analyses and acts on: email text, meeting items, todos, your messages to the agent, and images you send. OpenAI's API terms say it does not train its models on API data by default. See OpenAI's privacy policy.
• Google, when Atheena reads or acts in your Google account.
• Meta (WhatsApp Business Platform) carries messages between your WhatsApp number and Atheena's, if you link one.
• Resend sends the morning digest. It receives your email address and the todos listed in the digest.
• Fathom and Pocket, which we call with the API key you provided.
• Your browser's push service (such as Google, Apple or Mozilla) delivers push notifications. Notification contents are encrypted so the push service cannot read them.
• Our hosting provider runs the servers and stores the database.
• Websites and people the agent contacts for you. When you ask the agent to send an email or fill in a form, the recipient gets what the agent sends.

We may also disclose data when the law requires it, or to protect the rights, property or safety of our users, the public or us.

5. Storage and security

Your data is stored in Atheena's database with our hosting provider, and images you send over WhatsApp are stored on the same server. Data is sent over encrypted connections (HTTPS). Google sign-in tokens and service API keys are kept on the server and are never sent to your browser. Only the operators can access the servers. No system is perfectly secure, and we will tell you promptly if a breach affects your data.

6. How long we keep it, and deleting it

• We keep your data while your account exists.
• Disconnecting an account in Settings deletes the credentials we stored for it straight away, and Atheena stops reading from it. Todos already created stay in your list until you delete your account.
• You can also revoke Atheena's Google access at any time from your Google Account permissions page.
• To delete your account and everything associated with it (todos, conversations, messages, images, stored credentials), email hello@atheena.app. We will delete it within 30 days unless the law requires us to keep something, and we'll confirm when it is done.

Our service providers keep data under their own policies. For example, OpenAI may retain API inputs for a limited time for abuse monitoring.

7. Your choices and rights

You can pause any source in Settings, disconnect it, or turn notifications off. You can also ask us for a copy of your data, to correct it, or to delete it. Depending on where you live (for example under the GDPR or India's Digital Personal Data Protection Act), you may have further rights, including to object to processing or to complain to a data protection authority. To exercise any of these, email hello@atheena.app.

8. Children

Atheena is not intended for anyone under 18, and we do not knowingly collect data from children.

9. Changes to this policy

If we change this policy we'll update the date at the top. If a change affects how we use data you have already given us, we'll let you know by email or in Atheena before it takes effect.

10. Contact

For questions about this policy or your data, contact us at hello@atheena.app.