Privacy Policy

How WeekHaven handles your data — and what we never do with it.

Last updated: 2026-11-04

1. Who We Are

WeekHaven LLC is the data controller for personal data collected through this service. We are incorporated in the United States and can be reached at support@weekhaven.ai .

2. Information We Collect

We collect the following categories of personal data:

Account data: Your name, email address, and authentication credentials when you create an account or sign in via a third-party OAuth provider.
Email metadata: Sender, recipient, subject line, date, and a short preview (up to 200 characters) of message body for emails in connected Gmail or Outlook accounts. We do not store full email bodies.
Calendar metadata: Event titles, start and end times, attendees, and meeting links from connected Google Calendar or Microsoft calendar accounts. Calendar body/description text is not stored.
Usage data: Pages visited, feature usage, and error logs collected to operate and improve the service.
Security event records: When your account is created, when you sign in or sign out, when a signed-in session is renewed or ended, and when something else security-relevant happens to your account — your password is changed or you ask to reset it, your email address is changed, a two-factor authentication method is added or removed, or you complete two-factor authentication while signing in — we record what type of event it was and when it happened, together with your network address (IP address) and device and browser information. We email you when your account is changed; we do not email you when you sign in or sign out, including a routine two-factor sign-in.
Action items and follow-ups: generated from your email and calendar data.
Captured photo and file records: When you use the capture button to photograph a document or choose a PDF, we send it to our AI provider to find the deadlines and tasks it contains, retrying automatically a few times if a read fails. We don't store the photo or file on our servers, and we don't keep a transcript of the page. What we keep is a record of the capture itself: when it happened, whether it was a photo or a PDF, its size, the draft items we offered you, which of those became items, and the processing counters we use to measure what the feature costs us to run.

3. How We Use Your Data

Building your weekly review: We read your connected email and calendars, the items you add and the photos and files you capture to find what needs your attention and build your weekly review. Your review lives in WeekHaven; the weekly email only tells you it's ready.
Service operation: Account data is used to authenticate you and manage your subscription.
Product improvement: Aggregated, anonymized usage data helps us understand how the product is used and prioritize improvements.
Account security: Security event records are used for account security and for the detection of unauthorized access — so that you are told when your account changes, and so that a security question can be answered afterwards. Where GDPR applies, we process this data on the basis of our legitimate interest in securing user accounts.
No selling, advertising or AI training: We don't sell your data, share it with advertisers or use it to train AI models.

Google user data

WeekHaven's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We don't use the email, calendar and capture data we process — including what we receive from Google APIs (Gmail and Google Calendar) — or anything we make from it to develop, improve or train AI or machine-learning models, generalized or personalized, and Anthropic's terms don't allow it to train its models on that data either. We use it only to provide and improve the features you see in WeekHaven, to keep the service secure and to comply with the law, and we never sell it or use it for advertising.

4. Processors and Sub-processors

We share data with the following categories of sub-processors:

Database / infrastructure (Supabase): Stores your account data, connected account tokens (encrypted), and weekly review summaries.
AI provider (Anthropic): Anthropic, the company that makes the Claude AI models, does the reading that builds your review. What we send it includes:
- for each email we read, the sender, subject line, date and up to 8,000 characters of its text, with quoted earlier replies removed where we can recognize them;
- to put your review together, the short summaries we wrote of your recent emails, details of the items we're ranking for you (including the titles and times of calendar events, but not their descriptions), the titles and descriptions of items you add yourself or capture, the titles of items you recently marked done, and your own email address;
- to check the finished review, the review itself;
- when you use capture, the photo you took (resized if it's large) or the PDF you chose (up to its first 15 pages).
Anthropic's terms require it to protect the data we send, to use it only to provide its service to us, and not to train its models on it. Its commercial terms with WeekHaven say: “Anthropic may not train models on Customer Content from Services.” How long Anthropic keeps what we send is set by Anthropic's standard terms, not by us. Most of the email we send goes through Anthropic's batch service, which keeps the requests and its answers for up to 29 days after the batch is created, unless the law requires it to keep them longer; we don't currently ask Anthropic to delete them sooner. If Anthropic's safety systems flag something for review, Anthropic may keep it for up to 2 years.
Payments (Stripe): Processes subscription payments. We do not store payment card data ourselves.

All sub-processors are contractually bound to process data only as instructed and to maintain appropriate security measures.

5. Data Retention

Email metadata: retained for up to 60 days, then automatically and permanently deleted
Calendar metadata: retained for up to 60 days after we read it, then automatically and permanently deleted
Action items and follow-ups: kept while active, and for 60 days after you mark one done or dismiss it — then automatically and permanently deleted.
Weekly review summaries: until account deletion. These are the reviews we generate for you (the product output you return to), not the raw inbox/calendar data we read to produce them — that input data is deleted on the 60-day schedule above.
Security event records: the full record — including your network address (IP address) and device and browser information — is retained for 90 days. At 90 days the network address and the device and browser information are erased, leaving a minimized record of which account, what type of event, and when, with no network identifiers. That minimized record is kept until 13 months after the event, then automatically and permanently deleted.
Captured photo and file records: retained for 180 days, then automatically and permanently deleted. The photo or file itself is never stored on our servers: we send it to our AI provider to be read, and our servers drop it as soon as reading ends. No transcript of the page is kept. The 180-day record is the capture's details, the draft items, and our own processing counters. Items you chose to keep are action items or awareness items (Family / Don't Forget), and follow the 60-day rule above once you mark them done or dismiss them.
Connected account tokens (encrypted): until you disconnect that account
Account data: until you delete your account or request erasure
All security event records for an account are deleted when that account is deleted.
Separately, Supabase, our database and sign-in provider, keeps its own operational logs of sign-in activity — including failed sign-in attempts and the network address (IP address) each one came from — for a period Supabase sets for our plan. Those logs expire on Supabase's schedule; they are not deleted early when an account is deleted.

6. Your Rights

Depending on your jurisdiction (including under GDPR and CCPA), you have the right to:

Access the personal data we hold about you
Request correction of inaccurate data
Request erasure of your data ("right to be forgotten")
Request portability of your data in a machine-readable format
Withdraw consent or object to processing at any time

To exercise any of these rights, email us at support@weekhaven.ai . We will respond within 30 days.

7. Contact

For privacy questions or data requests, contact: support@weekhaven.ai .

2. Information We Collect

We collect the following categories of personal data:

Account data: Your name, email address, and authentication credentials when you create an account or sign in via a third-party OAuth provider.

Email metadata: Sender, recipient, subject line, date, and a short preview (up to 200 characters) of message body for emails in connected Gmail or Outlook accounts. We do not store full email bodies.

Calendar metadata: Event titles, start and end times, attendees, and meeting links from connected Google Calendar or Microsoft calendar accounts. Calendar body/description text is not stored.

Usage data: Pages visited, feature usage, and error logs collected to operate and improve the service.

Security event records: When your account is created, when you sign in or sign out, when a signed-in session is renewed or ended, and when something else security-relevant happens to your account — your password is changed or you ask to reset it, your email address is changed, a two-factor authentication method is added or removed, or you complete two-factor authentication while signing in — we record what type of event it was and when it happened, together with your network address (IP address) and device and browser information. We email you when your account is changed; we do not email you when you sign in or sign out, including a routine two-factor sign-in.

Action items and follow-ups: generated from your email and calendar data.

Captured photo and file records: When you use the capture button to photograph a document or choose a PDF, we send it to our AI provider to find the deadlines and tasks it contains, retrying automatically a few times if a read fails. We don't store the photo or file on our servers, and we don't keep a transcript of the page. What we keep is a record of the capture itself: when it happened, whether it was a photo or a PDF, its size, the draft items we offered you, which of those became items, and the processing counters we use to measure what the feature costs us to run.

3. How We Use Your Data

Building your weekly review: We read your connected email and calendars, the items you add and the photos and files you capture to find what needs your attention and build your weekly review. Your review lives in WeekHaven; the weekly email only tells you it's ready.

Service operation: Account data is used to authenticate you and manage your subscription.

Product improvement: Aggregated, anonymized usage data helps us understand how the product is used and prioritize improvements.

Account security: Security event records are used for account security and for the detection of unauthorized access — so that you are told when your account changes, and so that a security question can be answered afterwards. Where GDPR applies, we process this data on the basis of our legitimate interest in securing user accounts.

No selling, advertising or AI training: We don't sell your data, share it with advertisers or use it to train AI models.

Google user data

WeekHaven's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. Processors and Sub-processors

We share data with the following categories of sub-processors:

Database / infrastructure (Supabase): Stores your account data, connected account tokens (encrypted), and weekly review summaries.

AI provider (Anthropic): Anthropic, the company that makes the Claude AI models, does the reading that builds your review. What we send it includes:

for each email we read, the sender, subject line, date and up to 8,000 characters of its text, with quoted earlier replies removed where we can recognize them;
to put your review together, the short summaries we wrote of your recent emails, details of the items we're ranking for you (including the titles and times of calendar events, but not their descriptions), the titles and descriptions of items you add yourself or capture, the titles of items you recently marked done, and your own email address;
to check the finished review, the review itself;
when you use capture, the photo you took (resized if it's large) or the PDF you chose (up to its first 15 pages).

Anthropic's terms require it to protect the data we send, to use it only to provide its service to us, and not to train its models on it. Its commercial terms with WeekHaven say: “Anthropic may not train models on Customer Content from Services.” How long Anthropic keeps what we send is set by Anthropic's standard terms, not by us. Most of the email we send goes through Anthropic's batch service, which keeps the requests and its answers for up to 29 days after the batch is created, unless the law requires it to keep them longer; we don't currently ask Anthropic to delete them sooner. If Anthropic's safety systems flag something for review, Anthropic may keep it for up to 2 years.

Payments (Stripe): Processes subscription payments. We do not store payment card data ourselves.

All sub-processors are contractually bound to process data only as instructed and to maintain appropriate security measures.

5. Data Retention

Email metadata: retained for up to 60 days, then automatically and permanently deleted

Calendar metadata: retained for up to 60 days after we read it, then automatically and permanently deleted

Action items and follow-ups: kept while active, and for 60 days after you mark one done or dismiss it — then automatically and permanently deleted.

Weekly review summaries: until account deletion. These are the reviews we generate for you (the product output you return to), not the raw inbox/calendar data we read to produce them — that input data is deleted on the 60-day schedule above.

Security event records: the full record — including your network address (IP address) and device and browser information — is retained for 90 days. At 90 days the network address and the device and browser information are erased, leaving a minimized record of which account, what type of event, and when, with no network identifiers. That minimized record is kept until 13 months after the event, then automatically and permanently deleted.

Captured photo and file records: retained for 180 days, then automatically and permanently deleted. The photo or file itself is never stored on our servers: we send it to our AI provider to be read, and our servers drop it as soon as reading ends. No transcript of the page is kept. The 180-day record is the capture's details, the draft items, and our own processing counters. Items you chose to keep are action items or awareness items (Family / Don't Forget), and follow the 60-day rule above once you mark them done or dismiss them.

Connected account tokens (encrypted): until you disconnect that account

Account data: until you delete your account or request erasure

All security event records for an account are deleted when that account is deleted.

Separately, Supabase, our database and sign-in provider, keeps its own operational logs of sign-in activity — including failed sign-in attempts and the network address (IP address) each one came from — for a period Supabase sets for our plan. Those logs expire on Supabase's schedule; they are not deleted early when an account is deleted.

6. Your Rights

Depending on your jurisdiction (including under GDPR and CCPA), you have the right to:

Access the personal data we hold about you

Request correction of inaccurate data

Request erasure of your data ("right to be forgotten")

Request portability of your data in a machine-readable format

Withdraw consent or object to processing at any time

To exercise any of these rights, email us at support@weekhaven.ai . We will respond within 30 days.