Sage — Privacy Policy

Last updated: 2026-08-31

Sage is a personal reflection and focus assistant. It is built and operated by a single developer as a personal research project, with a single account holder. This policy describes what data the app collects, why, and how you can remove it.

What we collect

Sage currently collects, when you use the app:

• Captured thoughts — free-text notes you type into the app (your "captures").
• Daily state ratings — your self-reported check-ins (for example happiness and energy scores) and any note attached to a check-in.
• Life areas and priorities — the personal goals and areas of focus you create and organize inside the app.
• Account and sign-in data — your identifier from Sign in with Apple, and, for the developer sign-in path, an email address used to deliver a one-time sign-in code.
• Voice recordings — audio you send to capture a thought by speaking instead of typing, transcribed to text. Voice notes are recorded and delivered through a Telegram chat with the app's bot; see "Third parties that process your data" below.
• Calendar data, if and only if you connect a calendar account — for each event in a moving window around today: its start and end time, duration, all-day flag, busy/free/out-of-office status, privacy level, title, description, organizer's address, the number of guests, your own response, and the joining link of an online meeting. Access is read-only: Sage never creates, edits, or deletes anything in your calendar. The guest list itself is never stored — only how many people were invited.

Event descriptions are stored, because the calendar is kept as a moving window that is rewritten on every sync and a description not saved today cannot be recovered tomorrow. They are never sent to any third party, and in particular never to the AI language model — meeting descriptions are the most likely place for text written by other people to end up, and the model is not given it.

You choose which calendars count. Nothing from a newly connected account is counted until you tick it, including that account's main calendar: accounts arrive carrying birthdays, public holidays and subscriptions to other people's calendars, and counting those would describe a day that is not yours.

Why we collect it

All of the above exists to let the app show you your own thoughts, mood trends, and priorities back to you, to turn spoken notes into text, and to know how full your day already is before it suggests what to do with it. Sage does not sell data, run advertising, or share data for marketing purposes.

Third parties that process your data

• Telegram — the app's bot runs in Telegram, and captures you send there (text and voice) pass through Telegram's infrastructure and remain in that chat's history, which is not end-to-end encrypted. This is a deliberate trade for a recorder that already works everywhere; anything you would rather not leave in a chat should be typed into the app instead.
• Sentry — receives crash and error reports to help fix bugs. Reports are scrubbed of free-text content, tokens, and credentials before being sent; see "How we protect your data" below.
• Anthropic (Claude) — receives the text of your captures, check-ins and life areas to produce reflections and structure. It does not receive raw audio, and does not receive calendar event descriptions.
• OpenAI (Whisper speech-to-text) — receives voice audio to produce a text transcript. It receives no other app data.
• Langfuse (Cloud, EU region) — receives a trace of each AI call, including the full prompt and response, which contain the text of the captures being processed. It exists so that a wrong or expensive answer can be explained after the fact.
• Google and Microsoft — only as the source of the calendar data you asked Sage to read, and only for accounts you connect yourself. Nothing is ever written back to them, and no data from Sage is sent to them beyond what a read request requires.

No other third party receives your data. This page is updated, and its "Last updated" date changed, before any new processor is added.

Google user data and Limited Use

Sage requests two Google scopes, and they are the narrowest pair that covers what it does:

• .../auth/calendar.calendarlist.readonly — to list the calendars in the account, so you can choose which ones count.
• .../auth/calendar.events.readonly — to read the events of the calendars you chose, over a window of the past 7 and next 30 days.

The broader calendar.readonly is deliberately not requested: it would also grant access to calendar settings and sharing permissions, which Sage never reads. No write scope is requested at all.

Sage's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: data obtained from Google Calendar is not used for advertising, is not sold or transferred to anyone, is not used to build profiles for any purpose other than showing you your own schedule's load, and is not read by a human except where you ask for support or where the law requires it.

Calendar event descriptions obtained from Google are never sent to the AI language model or to any other third party.

Audio retention

Recordings are stored in a private object store and served only through short-lived signed URLs — never a public link. Raw audio is automatically deleted 30 days after it is recorded. The text transcript, once produced, is kept as part of your capture like any typed note.

Calendar retention

Calendar events are kept only for a moving window around today — by default the past 7 days and the next 30 — and that window is rewritten on every synchronisation. An event that leaves the window, or that you delete in your calendar, stops existing in Sage at the next sync; nothing older is archived.

What outlives the window is the computed load of a day — how many minutes were occupied, how many meetings, how fragmented the day was — kept without any event titles, so that later reflection can compare this month with the last. Disconnecting a calendar account deletes its access tokens, its calendars and all of their events immediately.

How we protect your data

• All traffic between the app and the server is encrypted (HTTPS/TLS).
• Sensitive fields — tokens, passwords, authorization headers, the free-text content of your captures and check-ins, and calendar event titles, descriptions, organizers and guests — are stripped from application logs and from error reports before they are stored or transmitted to Sentry.
• Access and refresh tokens for a connected calendar are stored encrypted (AES-256-GCM) with a key held only in the server's environment, never in the database. They are never written to logs in any form.
• One-time links and browser session values are stored only as hashes, so a copy of the database contains nothing that can be presented as a credential.

Data retention and deletion

Your data is kept for as long as your account exists. You can permanently delete your account and all associated data — captures, check-ins, life areas, connected calendars with their tokens and events, and session data — at any time from within the app's settings. Deletion is immediate and cannot be undone from the app.

A single calendar account can be disconnected on its own, from the connections page reached through the app's settings, without deleting anything else. You can also revoke Sage's access from your side at any time: for Google at myaccount.google.com/permissions, for Microsoft at myaccount.microsoft.com.

Children

Sage is not directed at children and is not intended for use by anyone under 16.

Changes to this policy

If what Sage collects or how it is processed changes, this page will be updated and the "Last updated" date above will change accordingly.

Contact

Questions about this policy can be sent to the developer at andrey@senpex.com.