Privacy Policy

1.1 Account Information

To create and maintain your account, we collect:

• •Email address
• •Name (optional, for display purposes)
• •Password (managed securely by our authentication provider, Supabase)
• •Optional profile information

We do not collect social accounts, phone numbers, or third-party contacts.

1.2 Content You Upload

When you use Woxpas, you may submit content via:

• •Documents, PDFs, text files, and notes (direct upload)
• •Audio files (transcribed and extracted)
• •Images containing text (OCR-extracted)
• •URLs (web page content is fetched, saved, and processed)
• •Text entered via the capture surface, Chrome extension, or MCP tools
• •Files imported from Google Drive (beta — access by request)
• •Preference profile data — your communication style, work context, tools, and personal details that you choose to share with connected AI tools (editable anytime from the Preferences page)

We also store file metadata (names, sizes, upload timestamps) and extracted content used to build your personal memory graph. When AI agents execute tasks on your behalf (see Section 2.3), their output is saved to your vault as an agent session log.

1.3 Integrations & Connected Services

Woxpas connects to external tools to help you capture and retrieve memories. Current integrations include:

• •MCP (Model Context Protocol): Any MCP-compatible AI tool (e.g. Claude, Cursor) can read and write to your memory via authenticated connections
• •Chrome extension: Quick Capture lets you save notes from any browser tab
• •Slack: Capture conversations and decisions from Slack channels
• •Google Drive: Import files from your Google Drive (OAuth-connected, beta — access by request)
• •Calendar: Export follow-ups and events via webcal subscription

For all integrations:

• •Connections are authenticated via OAuth — access tokens are stored securely
• •Memory content (files, notes, extractions) is only saved or retrieved when you explicitly request it
• •Your preference profile is shared with connected AI tools at the start of each session to personalise responses. If you enable proactive saving, AI tools may also update your preferences when they detect durable personal facts during conversation
• •You can revoke any integration at any time from Settings

1.4 Information We Do NOT Collect

2.1 To Provide the Service

Your files are used to:

• •Generate summaries and semantic extractions
• •Build your personal memory map
• •Provide search and contextual recall
• •Enable document chat with citations
• •Create clusters and links between ideas
• •Maintain your document library
• •Share your preference profile with connected AI tools to personalise responses
• •Improve relevance and accuracy

Your data is never used to train base models.

2.2 Security and Abuse Prevention

We use minimal metadata to:

• •Protect accounts
• •Rate-limit abusive behaviour
• •Respond to valid legal requests

We do not proactively monitor the contents of your files.

2.3 Automated Vault Scanning (Watcher)

Woxpas includes an automated system called the Watcher that periodically scans your vault to surface actionable suggestions. The Watcher runs automatically on a schedule (currently twice daily) and analyses:

• •Unresolved contradictions between your notes
• •Overdue or stale commitments that may need follow-up
• •Ideas that have been idle and could benefit from research

The Watcher produces suggested actions — it does not execute anything automatically. All suggested actions require your explicit approval before any further processing occurs.

2.4 Agent Dispatch

When you approve a suggested action, Woxpas may dispatch an AI agent to work on it. There are two dispatch methods:

• Built-in Agent

  Uses a trusted AI provider (currently Anthropic Claude) to process the task. Relevant portions of your vault content are sent to the AI provider as context. The agent's output is saved back to your vault as an agent session log. The same data commitments apply — your data is not used to train AI models.

• Webhook (External Agent)

  You may configure your own external agent via a webhook URL in Settings. When dispatched, Woxpas sends the task description and a scoped access token to your webhook endpoint. This token grants the external agent temporary, restricted access to your vault (read access + write access limited to saving session logs). The token expires after 1 hour. You are responsible for the security and behaviour of any external agent you configure.

3.1 Cloud Processing (Beta Only)

All document processing and AI inference occur on our servers. There is no on-device processing in the Beta release.

3.2 Storage

Uploaded content is stored:

• •Within our controlled cloud backend
• •All user data, including uploaded content, database records, and vector databases, is encrypted at rest using AES-256 disk encryption. Data in transit is protected via TLS
• •Our servers are located in Germany (EU). Data is processed globally only when necessary (e.g., AI model API calls)

3.3 Access Controls

• •Staff cannot access your uploaded files unless strictly required to resolve a support request or fulfill a legal obligation
• •Access is logged and restricted to senior engineering personnel
• •We do not manually read or review user documents except when required

3.4 Account Security

We provide security features to protect your account:

• •Two-factor authentication (2FA) is available and recommended
• •Authentication is managed by Supabase, which securely handles password hashing and storage
• •Session tokens expire and can be revoked
• •Integration connections can be revoked anytime from Settings

6.1 File Deletion

When you delete a file:

• •It is removed immediately from our active storage and indexes
• •We do not retain backups of deleted user content in the Beta release

6.2 Account Deletion

When you request account deletion:

• •Your account enters a 30-day grace period
• •During this period, your account is deactivated but data is preserved
• •You can cancel the deletion by logging back in during the grace period
• •After 30 days, all data is permanently deleted: files, memory extractions, preference profile, conversations, vector embeddings, API keys, and auth records
• •A confirmation email is sent at both the start and end of this process
• •We do not retain any user content after hard deletion

6.3 Logs

We maintain only lightweight technical logs required for operation. We do not store full content logs or file copies.