YouSpot Privacy Policy

Updated: October 7, 2026

Introduction

YouSpot, Inc. ("YouSpot", "we", "us") respects your privacy and is committed to protecting it through our compliance with this policy.

This policy describes the information we collect when you visit youspot.com or any of the sites we display it on (our "Website"), when you use the YouSpot application, its browser extension, its API and MCP server, and the apps we publish (together, our "Services"), and how we collect, use, keep, protect, and disclose that information.

This policy applies to information we collect:

On the Website and in the Services, including through the YouSpot browser extension (see Browser Extension below, also published on its own at /privacy/extension).
In email, text messages, and other electronic communication between you and YouSpot.
From accounts and services you choose to connect to YouSpot, including Google (see Google User Data below).

It does not apply to any website, service, or product that does not display or link to this policy or that carries its own privacy notice, including the third-party services you connect to YouSpot, each of which is governed by its own policy.

Please read this policy carefully. If you do not agree with our practices, your choice is not to use the Services. This policy may change from time to time (see Changes to Our Privacy Policy); the date it was last revised is at the top of the page.

Information We Collect

Information You Give Us

Account information. Your name and email address, and the credentials you sign in with. Sign-in is handled by our authentication provider (Clerk); YouSpot never stores your password. If you sign in with a Google account, Google shares only your name, email address, and profile picture with that provider; sign-in grants no access to your mail or calendar.
Profile information. Anything you add to your profile: a headline, a company website, a LinkedIn URL, a location, a Personal Profile document, and the writing-style description described under Google User Data.
Content you add. The people, companies, notes, files, links, and imports you put in your Second Brain, the messages you send to the assistant and to your agents, the instructions you give your agents, and mail you send to your YouSpot inbox address.
Phone number. If you verify a phone number to talk to the assistant over SMS or iMessage, the number and the messages you exchange that way.
Payment information. Payments are handled by Stripe. Card details go directly to Stripe; we receive your email address, the payment method type, and your billing history.
Correspondence. Records and copies of what you send to support@, team@, ideas@, or privacy@youspot.com, and of our replies.

Information From Services You Connect

You may connect Google (Gmail and Calendar), LinkedIn, X, HubSpot, Slack, Substack, and Obsidian to YouSpot. Each connection is made under a grant you approve and can revoke from /user/integrations. We receive the data the service makes available under that grant: for example, your contacts and companies from a HubSpot portal, your posts and connections from LinkedIn and X, the notes you choose to sync from Obsidian, the mail and calendar data described under Google User Data, and the Slack data described under Slack Data. We also store the tokens that keep each connection working, encrypted at rest.

Information We Collect Automatically

As you use the Website and the Services we collect information about your device and your use of them: your IP address, browser and operating system, the pages and features you use and when, referral and campaign parameters, and identifiers set by cookies and similar technologies. We use:

Cookies for sign-in sessions, preferences, and analytics. You can refuse cookies in your browser; parts of the Services then will not work.
Product analytics (Mixpanel, PostHog, and Google Analytics) to understand which features are used, so we know what to improve. These services receive usage events (which feature, when, and counts) tied to your account identifier and, for Mixpanel and PostHog, your account email address. They do not receive the contents of your Second Brain, your chats, or your mail. Session recording is switched off.
Error monitoring (Sentry) to learn when something breaks. Error reports carry technical context; credentials and tokens are removed before a report leaves our servers.

Information From Third Parties

To keep the people and companies in your Second Brain current, and to tell people apart from bulk mailers, we look up public professional profile and company information from enrichment providers (see Disclosure of Your Information), starting from an email address, a LinkedIn URL, or a company domain. When you sign up through a partner, for example through HubSpot, the partner passes us the account details needed to create your account.

How We Use Your Information

We use the information we collect to:

Provide, operate, secure, and support the Services, including answering your questions from your own data and running the agents you create.
Personalize the Services to you, for example by building your Personal Profile and remembering durable facts from your conversations.
Send you the email and messages the Services generate: sign-in links, briefings, agent results, notifications, receipts, and replies to your requests. You can turn product notifications off at /user/notifications.
Tell you about changes to the Services and, where you have agreed, about products and features that may interest you.
Understand how the Services are used and improve them.
Detect, prevent, and investigate abuse, fraud, and security incidents.
Comply with law and enforce our Terms of Use.
Fulfill any other purpose you provide the information for, or that we describe when you provide it, or with your consent.

AI Processing

YouSpot answers questions and runs agents with large language models operated by third-party AI providers. When you ask something, the relevant content (your message, the parts of your Second Brain that match, attached files, and anything a tool fetched for that request, such as a message from a connected mailbox) is sent to the provider that generates the response. Providers process it only to produce your answer, under commercial terms that do not permit them to train their models on it. Our long-term memory feature sends your conversations to a memory service that extracts durable facts; you can review and delete them at /user/memories. Some decisions are made by a classification model rather than a language model: which skill a message needs, whether incoming mail is spam, which of your emails belong in a daily briefing, and how the columns of a spreadsheet you import map to fields. That model receives only the text it is deciding about, returns a choice, and writes nothing. The current list of AI providers is in the subprocessor table at /terms#subprocessors.

YouSpot does not use your data to train generalized artificial intelligence or machine learning models.

Browser Extension

YouSpot publishes a browser extension for Google Chrome. This section describes everything the extension collects, why it collects it, where that data is kept, how long we keep it, and every party it is shared with. It applies in addition to the YouSpot Privacy Policy; where the two differ, this section governs data handled by the extension.

Its Single Purpose

The extension exists to do one thing: let you save a page you are looking at into your own YouSpot Second Brain, and show you what you have already saved. Every permission it requests and every piece of data described below serves that purpose. It is not an advertising, tracking, or analytics product; it does not follow you around the web; and it does not alter the pages you visit.

What It Collects, and When

The address and title of the tab you are on. Read only while you have the YouSpot side panel open, so the panel can show you the current page and tell you what kind of thing it is: a person, a company, a link. The address and title are sent to YouSpot to make that determination. The text of the page is not sent for this.
The contents of a page you choose to save. When, and only when, you press Save, the extension reads the page in the active tab and sends to YouSpot its address, title, main article text, a structured summary of that text, and any note you typed. That becomes an item in your Second Brain. Until you press Save, nothing on the page is read or transmitted.
Pages captured automatically, if you switch that on. The extension offers an auto-capture switch for individual sites we support (today, LinkedIn). It is off by default, it is presented to you per site, and switching it on is what grants the extension the ability to read that site. While it is on, the profiles and posts you scroll past on that site are saved to your Second Brain as though you had pressed Save on each. For a profile, the publicly displayed name, headline, location, and profile address; for a post, the author, the text, and the engagement counts. Switching it off takes effect immediately and withdraws the extension's access to that site. It never applies to any site other than the one you switched it on for.
Your YouSpot sign-in. A YouSpot access token, the email address on your account, and the address of your avatar image, so that you stay signed in between browser sessions.
A record that a feature was used. The extension tells YouSpot when a sign-in or a save happens, and how many items a batch contained, so we can support you and see which features get used. These records identify your account, not the pages you visited.

What It Does Not Collect

It does not collect your browsing history and does not report the pages you visit. A page you do not save, on a site where you have not switched on auto-capture, is never read and never leaves your computer.
It does not read passwords, form fields, keystrokes, clipboard contents, cookies, or payment details.
It does not run on browser system pages, on other extensions' pages, or on the Chrome Web Store.
It does not modify, inject content into, or change the appearance of the pages you visit.
It does not collect health, financial, location, or personal-communications data.

Where It Is Stored

On your own computer, in the browser's extension storage: your access token, your email address and avatar address, your per-site auto-capture switches, and any captures still waiting to be sent. A capture leaves that queue as soon as it is delivered. Uninstalling the extension deletes all of it.
On YouSpot's servers, in your account: the items you saved, held in the same infrastructure as the rest of your Second Brain and visible only to you and to the YouSpot personnel who need access to operate and support the service. Traffic between the extension and YouSpot is encrypted in transit using TLS.

Who It Is Shared With

We do not sell or rent data collected by the extension. We do not transfer it for advertising, for building profiles for third parties, for credit assessment or lending, or for any purpose unrelated to the extension's single purpose. We do not use it to develop, improve, or train generalized artificial intelligence or machine learning models.

It is shared only with the service providers that operate YouSpot on our behalf, each of which is named, along with the data it touches, in the subprocessor list at /terms#subprocessors. For a saved page, those are: our application hosting and database providers (DigitalOcean and Supabase), which run the service and store the item; our AI providers (Anthropic, OpenAI, OpenRouter, TypeSafe, and Mem0), which receive the item's text in order to summarize it, suggest tags for it, index it for search, and answer the questions you ask about it; and, for a saved LinkedIn profile or company page, our enrichment provider (Fiber), which receives that profile or company address. Beyond those providers, we disclose it only in the circumstances described under Disclosure of Your Information.

Limited Use

YouSpot's collection and use of information through the extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

Retention and Removal

We keep a saved item for as long as it is in your Second Brain. You can delete any item at any time, and doing so removes it.

Uninstalling the extension from your browser's extensions page erases everything it stored on your computer, including your access token, and ends all collection. Deleting your YouSpot account at /user/settings/account removes the saved items themselves. You may also ask us to delete them at any time by writing to privacy@youspot.com.

Google User Data

Connecting a Google account to YouSpot is optional. If you do connect one, this section describes exactly what we access, why, what we keep and for how long, who else processes it, and how to revoke it. It applies in addition to the rest of this policy; where the two differ, this section governs data obtained through Google APIs.

What We Access and Why

When you connect a Google account from /user/integrations/gmail, we request two permissions and no others:

Read your Gmail messages (https://www.googleapis.com/auth/gmail.readonly). We read message headers, subjects, Google's short snippets, labels, and message bodies from the mailboxes you connect, live from Google's API at the moment a request needs them, so that YouSpot can answer your questions about your mail, retrieve a message you ask for, build the list of people you correspond with (from headers alone), run the agents you create that react to new mail, and describe your writing style from mail you have sent. This permission is read-only: it grants no ability to send, alter, or delete mail. Older grants that carried broader permissions were revoked on September 18, 2026, so no connected mailbox holds them.
Read and edit events on your calendars (https://www.googleapis.com/auth/calendar.events). We read events (title, time, attendees, location, description) to answer your questions and to tell you what needs attention, and we create or edit an event only when you ask us to or approve an event we suggest. We never delete events.

We do not request access to Google Drive, Google Contacts, or your Google account settings. Accounts connected before September 2026 may hold broader permissions granted at the time (for example, the ability to save a draft or archive a message on your behalf); those features work only on such accounts, and disconnecting removes them.

What We Store

We do not copy your mailbox or your calendar. Messages and events are read from Google when a request needs them and are not kept as such. What we do keep is:

The connection itself. The OAuth access and refresh tokens for each connected account (encrypted at rest), the address of the mailbox, the permissions Google reports as granted, the number of messages, threads, and calendar events counted when you connect, and the sync cursor Google gives us so that your agents can notice new mail.
Contact records derived from message headers. For the people you have written to and received mail from: their email address, display name, and email domain, how many messages you have exchanged, and the date of the most recent one. These become the people in your Second Brain.
Mail-arrival records for your agents. If you run an agent that reacts to new mail, each new inbound message is recorded as an event carrying the sender, the recipients, the subject, Google's short snippet, the date, whether it was starred, and the Gmail message id, so that the agent can run and you can see what triggered it. If you have no such agent, we do not poll your mailbox and nothing is recorded.
Conversation history. When the assistant or an agent reads your mail or calendar for you, the request it made and up to 4,000 characters of what came back (which can include headers, snippets, event details, or an excerpt of a message body) are stored with that conversation so that you can see it again.
Your writing style. When you connect a mailbox we read up to 40 of your recent sent messages, and an AI model describes how you write. The description, a few traits, and up to three short quotes from your own messages are kept in your Personal Profile, where you can edit or remove them; the sampled messages themselves are not kept.
Records you or your agents choose to keep. A note, an interaction, a follow-up, a calendar event you approve, or a daily briefing created from your mail or calendar is stored in your Second Brain like anything else you save there.
Activity records. The type and time of each mail or calendar action (a search, a message read, an event edit) and the opaque Google id involved, kept for support and abuse investigation. We do not record your search terms, subjects, titles, or message content there.

How We Protect It

Traffic between you and YouSpot, between YouSpot and Google's APIs, and between our servers and our database is encrypted in transit using TLS.
The OAuth tokens for your connected accounts are encrypted at rest with a key that is held in our secrets manager and never stored in source control, in addition to the encryption of the database itself.
We request the narrowest set of permissions that supports the features we offer, and we do not ask for scopes we have no feature for.
Every call to Google is made with the credentials of the account you connected and is scoped to your user. One user's credentials cannot be used to reach another user's mail or calendar.
Access to the production systems holding these credentials is limited to personnel who need it to operate and support the service, each using multi-factor authentication.
You can withdraw our access at any time, and we act on it immediately. See Retention, Revocation, and Deletion below.

Who Else Sees It

To answer a question about your mail or calendar, the relevant content is sent to the third-party AI provider that generates the response, which processes it only to produce your answer and not for its own purposes. To sort your mail, for example to decide which messages belong in your daily briefing or to label the results of a search you ask for, a message's sender, subject, and opening text are sent to a third-party classification model, which returns a label and nothing else. To determine whether a correspondent is a person rather than a bulk mailer, and to enrich the people in your Second Brain, we send only that person's email address to a third-party profile lookup service. Our hosting, database, and monitoring providers process this data in the course of running YouSpot. An internal alert names the address of the mailbox you connected and the permissions it granted, never its contents. Our product analytics receive the type of action taken and counts, never your search terms, subjects, or message content. A current list of every third-party service that processes user data, including our AI providers, is published at /terms#subprocessors. We do not sell your Google data, we do not use it for advertising, and we do not disclose it for any purpose other than providing the features you are using.

Limited Use

YouSpot's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, YouSpot does not use data obtained through Google Workspace APIs to develop, improve, or train generalized artificial intelligence or machine learning models.

Retention, Revocation, and Deletion

The connection record and its tokens are kept for as long as the Google account remains connected to your YouSpot account, and are deleted the moment you disconnect it. The records derived from your mail and calendar (contact records, mail-arrival events, conversation history, your writing profile, and anything saved to your Second Brain) are kept until you delete them or delete your account; we do not currently expire them on a schedule.

You can disconnect a Google account at any time from /user/integrations/gmail. Disconnecting deletes the stored tokens for that account and revokes our grant with Google, which ends all further access. You may also revoke it directly from Google at myaccount.google.com/permissions.

Disconnecting a mailbox does not by itself remove the records already derived from it. You can delete a conversation from its chat, edit or remove your writing profile at /user/profile, delete people and records from your Second Brain, and delete your YouSpot account at /user/settings/account, which revokes every connected Google grant and removes all of the data described in this section. You may also ask us to delete it at any time by writing to privacy@youspot.com.

For a plain-language walkthrough of the Google connection, see /guide/gmail.

Slack Data

Connecting a Slack workspace to YouSpot is optional. If you add the YouSpot app to Slack, this section describes what the app reads, what we keep and for how long, who else processes it, and how to remove it. It applies in addition to the rest of this policy.

What the App Reads

Channels you switch on. The app can only see a channel after someone invites @YouSpot to it, and it saves nothing from that channel until you switch it on at /user/integrations/slack. From then on it receives each new message in that channel: the text, the author, the time, the thread it belongs to, reactions, and the name, type and link of any shared file. Saving a channel's earlier history is a separate choice you make one channel at a time.
Your conversations with the app. The messages you send YouSpot in its Messages tab, and the questions you ask by mentioning @YouSpot in a channel.
Links to YouSpot. When a youspot.com link is posted in a channel the app is in, Slack tells us the link so that we can show a preview of it. We read nothing else from that message.
Workspace details. The workspace name, domain and icon, and the names, titles, profile pictures and email addresses of its members, so that saved messages show a person's name instead of an id and so that a Slack member can be matched to the YouSpot account with the same email address.

The app cannot read a channel it has not been invited to, and it never reads direct messages between other people.

What We Store and For How Long

Saved messages. Each message from a channel you switched on is stored in your Second Brain, visible only to you (or, if you connected Slack from a shared space, to that space's members), and kept until you delete it or delete your account. If several people in one workspace connect the app, each keeps a separate copy of the channels they chose. A file shared in Slack is copied into your Second Brain only when you choose to save it.
Conversations with the assistant. Your questions and its answers are kept with your other YouSpot conversations until you delete them or your account.
Delivery records. Slack sends each event to us as a delivery envelope. We keep the envelope only to avoid saving the same message twice, and delete it seven days after it has been processed.
The workspace directory. The member and channel list is cached for up to 24 hours and then fetched again.
The connection. The bot and user access tokens Slack issues, encrypted at rest, together with the workspace id and name, your Slack member id, and the permissions granted.
Agent triggers. If you create a cloud agent that runs on a Slack message, mention or reaction, the event that started it, with up to 500 characters of the message, is kept with that agent's run history.

How We Use It and Who Else Sees It

We use Slack data only to provide the features you turned on: answering your questions, keeping the messages you chose to save, showing link previews, and running the agents you created. To answer a question, the relevant saved messages are sent to the third-party AI provider that generates the response, which processes them only to produce your answer and not for its own purposes. Answers are written by AI and can be wrong. Our hosting and database providers process this data in the course of running YouSpot; the full list is at /terms#subprocessors. We do not sell Slack data, we do not use it for advertising, and we do not use it to train or fine-tune any artificial intelligence or machine learning model, ours or a provider's.

Removing Slack Data

Switching a channel off stops new messages from that channel at once. Disconnecting a workspace at /user/integrations/slack deletes your tokens for it, and when the last YouSpot user in that workspace disconnects, the app's access is revoked with Slack. Messages you already saved stay in your Second Brain until you delete them there. Deleting your YouSpot account at /user/settings/account removes all of it: saved messages, conversations, and tokens. To ask for a copy of your Slack data or for its deletion, write to privacy@youspot.com.

Disclosure of Your Information

We may disclose aggregated information about our users, and information that does not identify any individual, without restriction.

We disclose personal information that we collect or you provide:

To the service providers we use to run YouSpot: hosting, database, authentication, payments, email delivery, AI providers, enrichment providers, analytics, error monitoring, and our own customer records. Each is bound to use the information only to provide its service to us. The full list, with what each one does and the data it touches, is published at /terms#subprocessors and is updated whenever a provider is added or dropped.
To the people you choose to share with: for example, when you share a Second Brain space, publish a page, or send email through the Services.
To a buyer or successor in the event of a merger, acquisition, or sale of all or part of YouSpot's assets, in which case this policy continues to apply to your information.
To comply with any court order, law, or legal process, including a government or regulatory request.
When we believe disclosure is necessary to protect the rights, property, or safety of YouSpot, our users, or others.
For any other purpose disclosed when you provide the information, or with your consent.

Mobile information: No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent are not shared with any third party.

Data Retention

We keep your account information and the contents of your Second Brain for as long as your account exists. Conversations are kept until you delete them or your account. Mail you send to our team addresses is kept as part of the support record until you delete your account. Server logs and error reports are kept for a limited operational period by the providers that hold them. When you delete your account, every record keyed to it, including uploaded files and the tokens of connected services, is removed from our database in one operation, and any Google grant is revoked; copies in database backups are deleted within 30 days. We keep a short record that the deletion happened: its date, what was removed, and a one-way keyed hash of your email address (never the address itself), so we can show that we honoured your request.

Security

All traffic to and from the Services is encrypted with TLS. Sign-in is delegated to Clerk, and sessions can be revoked. The tokens of connected services are encrypted at rest with a key held in our secrets manager. Access to production systems is limited to the people who operate the service, each using multi-factor authentication. No method of transmission or storage is completely secure; if you believe your account has been compromised, contact us right away. Security researchers can find our vulnerability disclosure policy at /security.

Your Choices and Rights

Access and correction. You can review and edit your profile at /user/profile and your account settings at /user/settings/account.
Connected services. Disconnect any service at /user/integrations.
Memories and notifications. Review or delete the assistant's memories at /user/memories; turn product email off at /user/notifications.
Deletion. Delete your account at /user/settings/account.
Cookies. You can set your browser to refuse cookies or to alert you when a cookie is set; parts of the Services then may not work.
Requests. To exercise any right you have under applicable privacy law, including a request for a copy of your data, write to privacy@youspot.com. We may ask you to verify your identity before acting on a request.

Children Under the Age of 16

The Services are not intended for children under 16 years of age, and no one under 16 may provide personal information to us. We do not knowingly collect personal information from children under 16. If we learn we have collected personal information from a child under 16 without verification of parental consent, we will delete it. If you believe we might have any information from or about a child under 16, please contact us at privacy@youspot.com.

International Users

YouSpot is operated from the United States, and the information we collect is processed and stored there and in the countries where our service providers operate. If you use the Services from outside the United States, you understand that your information is transferred to and processed in the United States, where privacy laws may differ from those of your country. If you are a business customer subject to the UK or EU GDPR, our Data Processing Addendum applies to the personal data you bring into YouSpot, with the EU Standard Contractual Clauses and the UK Addendum covering transfers.

Changes to Our Privacy Policy

We post any changes to this policy on this page and update the date at the top. If we make material changes to how we treat your personal information, we will notify you by email at the primary address on your account. You are responsible for keeping that address current and for checking this page periodically.

Contact Information

To ask questions or comment about this policy and our privacy practices, or to make a request about your data, email privacy@youspot.com. Every message to that address opens a tracked request that our team reads and answers. You can also write to YouSpot, Inc., Two Canal Park, Cambridge, MA 02141, USA, Attn: Privacy.