Privacy Policy

When you connect a third-party account to Homebase, we request access only to the specific data needed to operate the features you use:

Google (via Google OAuth):

• Gmail (read-only): the content and metadata of your email messages, so your agent can read and summarize them at your request.
• Gmail (compose/drafts only): the ability to create email drafts on your behalf. We do not have the ability to send, edit, or delete email — every draft requires your manual review and action in Gmail to send or revise.
• Google Calendar (events): your calendar events, so your agent can view and create events at your request. Calendar invites are created without automatically notifying attendees.
• Google Drive (read-only): the content of files in your Drive, so your agent can search for and reference files at your request. We cannot modify, delete, or share your Drive files.

We request the same categories of data (email, calendar, files) from Microsoft, Slack, and Notion when you connect those services, scoped equivalently to what is described above.

We only request the narrowest permissions necessary for the features described in this policy. We do not request access to data for features that are not currently available in the app.

We use the data described above solely to provide and operate the features of Homebase that you directly use and see in the app — specifically, to let your personal AI agent read, summarize, draft, schedule, and search content at your explicit request.

We do not use your Google user data, or any data from connected accounts, for any purpose other than providing or improving the specific user-facing features described in this policy. In particular:

• We do not use Google Workspace API data to develop, improve, or train any generalized or non-personalized AI or machine learning models. Homebase's AI functionality is powered by the Anthropic Claude API. Per Anthropic's standard commercial API terms, data submitted via the API is not used to train or improve Anthropic's models. Any AI processing that occurs happens only in the context of fulfilling your specific, individual request in that session, and is not used to train or fine-tune models for other users or for general model improvement.
• We do not transfer Google user data to any third-party AI/ML service for the purpose of training that service's models.
• Limited Use Compliance Statement: The use of raw or derived user data received from Google Workspace APIs by Homebase will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
• We do not use your data for advertising, ad targeting, or interest-based marketing of any kind.
• We do not use your data to determine creditworthiness or for any lending-related purpose.

We do not sell, rent, or trade your data to any third party, under any circumstances.

We do not transfer your data to third parties except in the following limited circumstances:

• To the AI service providers that power your agent (e.g., Anthropic, for processing your requests), strictly to the extent necessary to fulfill the specific task you asked your agent to perform, and subject to those providers' own data protection obligations to us.
• For security purposes, such as investigating suspected abuse, fraud, or a security incident.
• To comply with applicable law, a valid legal process, or a government request.
• As part of a merger, acquisition, or sale of company assets, in which case we will provide notice and, where required, obtain your consent before your data is transferred.

We do not permit our employees, contractors, or agents to read your data except:

• With your explicit, specific consent to view a particular message, file, or item;
• As necessary to investigate a bug, security issue, or suspected abuse;
• As required by law.

We take reasonable technical and organizational measures to protect your data, including:

• Encryption of stored access and refresh tokens.
• Access to production data restricted to authorized personnel on a need-to-know basis.
• Secure transmission of data using industry-standard encryption (HTTPS/TLS) for all data in transit.

No method of storage or transmission is 100% secure, and we cannot guarantee absolute security, but we are committed to promptly addressing any vulnerabilities we become aware of.

We retain your connected-account data only for as long as your account remains connected and active.

• You may disconnect any connected service at any time from within the app. Disconnecting immediately and permanently deletes the associated stored credentials (tokens) from our database — this happens synchronously, not on a delay or batch schedule. Note that disconnecting in Homebase removes our copy of your access credentials; it does not by itself revoke the connection on the provider's side. To fully revoke Homebase's access at the provider level, you can also review and remove Homebase from your connected apps in your Google Account, Microsoft Account, or other provider's security settings.
• You may delete your Homebase account entirely at any time from the Account page in the app. Account deletion immediately and permanently deletes your profile and all associated data, including connected-service credentials, intake information, skills, conversations, messages, and memories.
• We do not retain copies of your email, calendar, or file content beyond what is necessary to actively service your in-session requests; we do not maintain a persistent archive of your Gmail, Calendar, or Drive content.

To request deletion of your data, disconnect the relevant service or delete your account directly in the app, or contact us at privacy@homebaseagents.ai.

• You control which services you connect to Homebase, and can disconnect any of them at any time.
• You review and approve every email draft before it is sent — Homebase never sends email on your behalf without your action.
• You can request a copy of your data or its deletion by contacting us at the email above.

Homebase is not directed to individuals under 18, and we do not knowingly collect data from children.

We may update this Privacy Policy from time to time. We will update the “Last updated” date above when changes are made, and material changes will be communicated to users through the app or via email.

If you have questions about this Privacy Policy or how we handle your data, contact us at: