Privacy Policy

Who we are

All Things is operated by a sole proprietor based in Ontario, Canada ("we", "us"). We are responsible for the personal information described in this policy.

What we collect

Account information: your email address and, if you sign up with a password, the password (our authentication provider stores only a secure hash of it). If you sign in with Google or Apple, we receive your name, email address and an account identifier from that provider. If you choose Apple's Hide My Email, we receive a relay address instead of your real email.

Your records: the Events, people, pets, places, things and Facts you or your connected AI agents save, the avatars you choose, and your time zone.

AI agent connections: which AI agents you have connected, when each was last used, and a log of the changes made by you or by your agents, so you can see who changed what.

Technical information: our hosting providers keep standard request logs, such as IP address, browser type and time of request, for security and troubleshooting. Our own logs of agent requests record only which tool was called and whether it succeeded, not what you asked or what was returned.

We do not use advertising or analytics trackers. We set one cookie to keep you signed in, and your browser remembers your light or dark theme.

How we use it

We use your information only to provide and secure All Things: to sign you in, store and show your records, search them, let the AI agents you connect read and write them, and contact you about your account (for example confirmation and password reset emails).

We do not sell your information, show you ads, or share your records with anyone except the service providers below and the AI agents you connect.

Service providers

We rely on the following providers to run All Things. Each processes your information only to provide its service to us.

Supabase: database, sign-in and file storage. Your records are stored in Supabase's data centre in Virginia, United States.

Vercel: hosts the website and the API, in the United States.

OpenAI: to make search work by meaning and not just keywords, the text of your Events and Facts is sent to OpenAI to compute search embeddings.

Google and Apple: only if you choose to sign in with them.

Cloudflare: our domain name and DNS.

Account emails, such as sign-up confirmation and password reset, are sent through Supabase or an email delivery service working for us.

Because these providers are in the United States, your information is stored and processed outside Canada and may be accessible to authorities there under United States law.

AI agents you connect

When you connect an AI agent (such as Claude, ChatGPT or Gemini) to All Things, you authorize it to read and change your records. Whatever the agent reads is returned to it in plain text and is then handled by that agent's provider under its own terms and privacy policy, not ours.

Connected agents currently have full read and write access. You can disconnect an agent at any time on the Agent connectivity page; it loses access immediately.

How we protect it

Connections use HTTPS, and your data is encrypted at rest by our providers. Each account's records are isolated from every other account at the database level.

All Things is not end-to-end encrypted. We can technically access the data stored on our servers; we do so only when needed to operate and support the service, or when required by law.

How long we keep it

We keep your information for as long as you have an account. Deleting an Event or an entry in People & things removes it from your view, but it is kept so it can be restored; permanent deletion is not yet available in the app.

To delete your account and all of your records, or to get a copy of your data, email us at the address below. We will complete deletion within 30 days. Backups, where they exist, are kept for up to 7 days and then expire.

Your choices and rights

You can see and change most of your information in the app. You can also ask us to access, correct or delete your personal information, or withdraw your consent, by emailing us. If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada.

Children

All Things is not intended for children under 13, and we do not knowingly collect their personal information.

Changes to this policy

If we change this policy, we will update the date at the top. If a change is significant, we will also tell you by email or in the app before it takes effect.

Contact us

Questions or requests about your privacy: support@getallthings.com