Privacy Policy

Last updated: August 1, 2026

At Tilly ("we," "our," or "us"), we take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our calendar synchronization application and related services (collectively, the "Service").

Please read this Privacy Policy carefully. By using the Service, you agree to the collection and use of information in accordance with this policy.

1. Information We Collect

1.1 Information You Provide

We collect information you provide directly to us, including:

Account Information: When you create an account, we collect your name, email address, and password.
Calendar Data: When you connect calendar accounts, we access your calendar events, including event titles, descriptions, times, locations, attendees, and related metadata.
Tasks and Planning Data: We collect the tasks, lists, categories, notes, reminders, and planning preferences you create in the Service.
Assistant Conversations: If you use Tilly's optional AI assistant, we collect the prompts you submit, the assistant's responses, proposed tasks, events, or focus blocks, and conversation history. Prompts may include calendar, task, or other personal information you choose to provide.
Voice Input: If you choose to use voice input, your recording is sent to our transcription provider to produce editable text. Tilly does not intentionally retain the raw audio recording after transcription. The resulting transcript remains editable before you send it and becomes part of your assistant conversation only if you submit it.
Communications: When you contact us, we collect your email address and the content of your messages.
Waitlist Information: If you join our waitlist, we collect your name and email address.

1.2 Information Collected Automatically

When you use our Service, we automatically collect certain information:

Device Information: Device type, operating system, unique device identifiers, and browser type.
Usage Information: How you interact with our Service, including features used, pages visited, and actions taken.
Log Data: IP address, access times, and referring URLs.

1.3 Information from Third Parties

When you connect third-party calendar services (such as Google Calendar, Microsoft Outlook, or Apple Calendar), we receive calendar data and authentication tokens from those services according to the permissions you grant.

2. How We Use Your Information

We use the information we collect to:

Provide, maintain, and improve our Service
Synchronize your calendar data across connected accounts
Generate assistant responses and editable proposals for tasks, events, and focus blocks you request
Transcribe voice input when you choose to use that feature
Send you technical notices, updates, and support messages
Respond to your comments, questions, and requests
Detect, investigate, and prevent fraudulent transactions and abuse
Comply with legal obligations

3. Calendar Data and Privacy Controls

We understand that calendar data is particularly sensitive. Here's how we handle it:

Your Control: You have full control over what calendar data is synced and how it appears on other calendars. You can choose to share full event details, limited information, or just "busy" status.
Limited Access: We only access the calendar data necessary to provide the synchronization service.
No Selling: We never sell your calendar data to third parties.
Encryption: All calendar data is encrypted in transit and at rest.

4. Data Sharing and Disclosure

We may share your information in the following circumstances:

With Your Consent: When you explicitly authorize us to share information.
Service Providers: With third-party vendors who help us operate our Service, subject to appropriate contractual and confidentiality obligations. These providers include Convex for application hosting and data storage, Anthropic for AI assistant processing, OpenAI for voice transcription, PostHog for product analytics, Sentry for diagnostics and crash reporting, and Resend for email delivery.
Legal Requirements: When required by law, court order, or governmental authority.
Business Transfers: In connection with a merger, acquisition, or sale of assets, with notice to you.

5. Data Retention

We retain your information for as long as your account is active or as needed to provide you with our Service. You can request deletion of your account and data at any time. Some information may be retained as required by law or for legitimate business purposes.

Assistant conversations and their associated proposals are retained until you delete the conversation or your account. Raw voice recordings are processed transiently for transcription and are not intentionally stored by Tilly. A submitted transcript is retained as part of the corresponding assistant conversation. We may retain a minimal email suppression record after account deletion so that an unsubscribe request is not accidentally reversed.

Assistant quality analytics are metadata-only by default. If you explicitly opt in to sharing assistant content, PostHog may receive prompts and responses, including calendar or task details contained in them. PostHog removes full-content AI trace properties after 30 days. Turning this setting off applies to future assistant requests immediately. Deleting your Tilly account also initiates deletion of the unified PostHog person associated with your account.

6. Data Security

We implement appropriate technical and organizational measures to protect your information, including:

Encryption of data in transit (TLS) and at rest
Regular security assessments and audits
Access controls and authentication mechanisms
Secure OAuth integration with calendar providers

However, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

7. Your Rights and Choices

Depending on your location, you may have the following rights:

Access: Request a copy of your personal data.
Correction: Request correction of inaccurate data.
Deletion: Request deletion of your data.
Portability: Request your data in a portable format.
Withdraw Consent: Withdraw consent for data processing.
Opt-Out: Unsubscribe from marketing communications.

To exercise these rights, contact us at privacy@trytilly.com.

8. International Data Transfers

Your information may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place to protect your information in accordance with this Privacy Policy.

9. Children's Privacy

Our Service is not intended for children under 13. We do not knowingly collect personal information from children under 13. If we learn we have collected such information, we will delete it promptly.

10. Cookies and Tracking Technologies

We use cookies and similar technologies to:

Keep you signed in
Remember your preferences
Understand how you use our Service
Improve and personalize your experience

You can control cookies through your browser settings. Note that disabling cookies may affect Service functionality.

11. Third-Party Services and AI Processing

Our Service integrates with third-party calendar providers and uses specialized providers to deliver optional AI and voice features. Information sent to a provider is limited to what is reasonably necessary to deliver the feature you requested. Their processing is also governed by their respective privacy policies:

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. Your continued use of the Service after changes constitutes acceptance of the updated policy.

13. Contact Us

If you have questions about this Privacy Policy or our privacy practices, please contact us at:

Email: privacy@trytilly.com