Privacy Policy

Effective October 9, 2026

Outfitter (ai-outfitter.com) is an AI assistant and a set of apps for people's work, run by Unsupervised ("we", "us"). This policy explains what we collect, why, who else sees it, and the choices you have.

What we collect

Account. When you sign in with Google or GitHub we receive your name, email address and profile image, and we store the provider's account ID and the OAuth tokens we are issued, encrypted. Where enabled you can instead sign up with an email and password. We also keep your organization memberships, and some organizations sign in through single sign-on (SAML).

Content. Your chat messages, files and images you upload to chats (stored in Cloudflare R2), your projects, and the workflow and app data you create or that apps in your organization create.

Homepage chat without an account. Anyone can chat on the homepage without signing up, for up to 9 messages. We keep the transcript on our servers for about 7 days, tied to a cookie in your browser. If you sign up, the transcript moves into your account. In that chat you may choose to share a website, an email address, or a city or ZIP code. If you share a website we fetch that public page once to tailor suggestions. If you share an email we may look up the mail-host domain (MX record) of that address.

Logs. Like most web services, our hosting provider records request details such as IP address, browser and the page requested, which we use for security, debugging and abuse prevention.

Usage and cookies. We use cookies for your sign-in session, for the anonymous chat token, and for a database read-consistency cookie that keeps what you see up to date. We use PostHog for product analytics and session replay. Session replay masks all text, inputs and images, so what you type and read on the page is not recorded.

Google user data (Gmail and Calendar)

This section applies only if you choose to connect Gmail and/or Google Calendar. We ask for two read-only scopes: gmail.readonly and calendar.readonly.

We use that access to:

• show you recurring tasks we find in your recent email: for up to about 20 messages from the last 30 days we read the sender, subject, date and a snippet;
• show your upcoming calendar events; and
• answer your own questions in chat, by searching and reading your messages and listing your events when you ask.

Your Google tokens are encrypted at rest. Mail and event content that we read in order to answer you is sent to our AI model provider to generate that reply. Outfitter does not store that content itself; what stays in your chat is the reply and, for task suggestions, a one-line note of what in your mail or calendar suggested each task. Outfitter never sends, modifies or deletes anything in your Gmail or Calendar.

You can disconnect at any time at /connectors/google, and you can revoke access from Google at myaccount.google.com/permissions.

Limited Use. Outfitter's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We use Google user data only to provide or improve the user-facing features you asked for.
• We do not transfer it to others except as needed to provide those features, for security, to comply with law, or as part of a merger or acquisition with notice to you.
• We do not use it for advertising, and we do not sell it.
• We do not use it to train or improve generalized AI or machine-learning models.
• Our people do not read it, except with your affirmative consent for specific messages, for security purposes, to comply with law, or when it is aggregated and anonymized for internal operations.

AI model providers

To reply to you, we send your chat content, and any Google data you asked about, to the inference provider configured for the service. The provider processes it to return a response. Outfitter does not use customer content to train models.

Who processes data for us

• Cloudflare: hosting, database and file storage.
• Google and GitHub: sign-in, and Gmail and Calendar if you connect them.
• PostHog: analytics and masked session replay.
• AI model providers: generating replies.

We are based in the United States, and our providers may process data in the United States and other countries. We do not sell personal information.

How long we keep it

• Account data is kept while your account exists.
• Anonymous homepage chats are kept for about 7 days unless you sign up and they are moved into your account.
• You can delete your chats yourself, and you can ask us to delete your account by email.
• Disconnecting Gmail or Calendar deletes that connection and its tokens. If you granted Gmail or Calendar while signing up with Google, your Google sign-in also holds that grant until you revoke it at myaccount.google.com/permissions or delete your account; we use it only to set up the connection you asked for.
• Request logs are kept by our hosting provider for a limited time.

Security

We encrypt sign-in tokens and connector tokens at rest, and traffic to the service uses HTTPS. No system is perfectly secure, so we cannot promise absolute security.

Children

Outfitter is not directed to children and is not for anyone under 13. If you believe a child has given us personal information, contact us and we will delete it.

Changes to this policy

We may update this policy. We will change the effective date above and, for material changes, tell signed-in users in the product or by email.

Contact

Questions or requests about privacy: privacy@ai-outfitter.com.

Terms of Service