Consumer health data policy

Puffin treats the data below as health data.

Your sleep, readiness, and activity, if you connect a ring. From Oura, Puffin keeps when each sleep started and ended, the day it belongs to, whether it was your main sleep, and your daily readiness and activity. Puffin's planner uses them only to estimate your body clock, to keep work out of the hours around your sleep, and to give you a lighter day after a bad night. Puffin's AI never sees anything from your ring. Puffin keeps each day in full for eight weeks, then a reduced form until 12 months after the day, and deletes your ring's data at once when you remove the connection.

Your body clock and what Puffin learns from health data. The estimate of your body clock, every other preference Puffin learns from your health data, any value you set for one of them yourself, and the learning records behind them. Puffin uses them from your first day to place work at the hours that suit you, unless you turn off "Use what Puffin learns" on your Memory screen. Puffin keeps a learned preference until 365 days after the last record behind it, a value you set until you delete it or hand it back to learning, and each learning record for 365 days from the day it was made. Removing the Oura connection deletes the estimate of your body clock at once, and resetting your memory deletes every learned preference.

What you tell Puffin about your sleep. The sleep window you choose when you set Puffin up and, if you pick one, the body clock type you choose. Puffin uses them to plan around your sleep. Unless you turn it off, Puffin's AI also sees the sleep times you set, and the quiet hours that follow them, so it can help you plan in chat. Puffin keeps them until you change them or delete your account.

Your goals in the Health and Mind habitats. Puffin uses them to plan toward those goals and to propose work that serves them. Puffin keeps each one until you delete it, reset your memory, or delete your account.

Your moods. The moods you tell Puffin, such as tired or stressed. Puffin uses a mood to offer plan choices that fit how you feel, and, once you say yes to Puffin's AI and unless you turn off sensitive topics, learns from the moods and health topics you mention. While sensitive topics is on, and unless you turn off "Your profile and your week", each message to Puffin assistant carries your moods of the last 7 days, so it can plan with how your week has gone. Puffin keeps each mood until you delete it or reset your memory.

Your wellbeing questionnaire answers, if you agree to the questionnaire. Once a month, Puffin can ask five questions about how you have been feeling and ask you to rate up to three of your goals. Puffin uses your answers to see how Puffin affects you, and it shows you no score or judgment. Puffin keeps each answer for 365 days, and deletes your answers within one day when you stop.

Puffin's working records about your plan. Because your plan is built around your sleep, these records can describe it. They are the inputs Puffin's planner read for each run, which Puffin keeps for 14 days from the run so it can check the run. They are also the reasons Puffin gives for where it placed your work and why some work did not fit, which Puffin keeps with your plan until you delete the work or your account. And they are the evidence behind a suggestion, which Puffin keeps until you accept or remove the suggestion, and at most 365 days after its last change.

From you: your goals, your moods, your sleep window and body clock type, the values you set for what Puffin learns, and your questionnaire answers.

From Oura, when you connect your ring.

From Puffin's own work: the estimate of your body clock and the other preferences Puffin learns, and the planner's working records.

Our hosting provider. Amazon Web Services stores all of Puffin's health data and runs Puffin's service in the United States, in Oregon.

Our AI provider. Anthropic makes the AI model behind Puffin assistant, the Student tutor, and the goals conversation, and receives the health data a request to one of them carries. Anthropic processes it for Puffin, as Puffin's service provider, only to answer you. That can be your goals in the Health and Mind habitats, which join your profile in each message only while sensitive topics is on, today's mood and your moods of the last 7 days while sensitive topics is on, a health goal or a mood you mention in those conversations, the learning records behind what Puffin learns, and the reasons behind your plan and its suggestions, except any your ring informed. Turn off "Your profile and your week" in Settings, under AI and privacy, to keep the profile and the moods of the week out of each message. The paragraph about you that Puffin writes each night never uses your moods or your health.

The sleep times you set. Unless you turn it off, each request to Puffin assistant carries the sleep times you set, and the quiet hours that follow them, so the assistant can help you plan in chat around when you sleep. To stop it, turn off "Let Puffin’s AI see the sleep times you set" in Settings, under AI and privacy. The rest of Puffin's AI keeps working.

Nothing from your ring reaches Anthropic. That covers your nights, your readiness, your activity, and everything Puffin learns from them, such as the estimate of your body clock.

Once a day at most, while sensitive topics is on, Puffin also sends Anthropic your Health and Mind goals, so a model can look for work that serves your goals. Anthropic deletes what it receives within 30 days, keeps flagged content for up to two years and its safety scores for up to seven, and trains no model on it.

Where you direct it. Puffin sends your data to another company when you direct it to. A change you make to an event that belongs to your Google or Outlook calendar goes to Google or Microsoft, and a calendar you subscribe to your Puffin feed reads your calendar through the feed's secret address.

Nobody else. Puffin sends your health data to no other company. Crash reports carry no sleep figure, and Puffin's service logs carry no personal data. Puffin does not sell your health data and does not train a model shared with other people on it. No general AI model is trained on your ring data. Puffin never advertises on your ring data.

People at Puffin. Only people who have signed a confidentiality undertaking can open your health data.

During the private test, Puffin's support team can open your account to fix problems, which you accept with the tester notice. Your health data opens only to people who signed the confidentiality undertaking. Turn off Staff access in Settings, under AI and privacy, to stop it.

Otherwise nobody at Puffin opens the rest of your health data unless you ask us to for one support case, we are fixing a failure in one of your conversations, or the law requires it. Every such access is logged, and you can read each one under Staff access in your settings.

See it. You can see your goals and moods in Puffin, and what Puffin learned on your Memory screen. "Export my data" in settings gives you a copy of everything you entered, with what Puffin learned about you in its own file, learned.json.

Delete it. You can delete a goal or a mood where you see it. Removing the Oura connection deletes your nights and the estimate of your body clock. Turning off the wellbeing questionnaire deletes your answers within one day. "Delete account" in settings deletes all of it, and if you cannot sign in, the deletion request page sends a link to your email address. When Puffin deletes health data, it leaves our live systems at once, and copies in backups are gone within 90 days.

Turn a use off. Settings, under AI and privacy, has an off switch for Puffin's AI, your profile and your week, the sleep times you set, and, during the private test, staff access. Your Memory screen has "Use what Puffin learns" and "Include sensitive topics". Puffin stops a use within one day of you turning it off.

Ask us. We answer a request to see, correct, delete, or export your health data within 30 days.

Appeal. If we refuse a request, our answer says why, and you can appeal by replying to it. The head of the company decides the appeal within 60 days and writes to you with the decision. If you disagree with the decision, you can contact your state's attorney general.

Puffin collects health data only to do what you ask it to do, or after you agree. Before you connect Oura, a screen says what Puffin reads, what it keeps and for how long, how Puffin's planner uses your readiness, what it never does with the data, and what disconnecting deletes. One yes, when you first use Puffin's AI, covers sharing your profile with your Health and Mind goals and your moods of the week, and the sleep times you set, with its AI provider, and learning from sensitive topics, and each keeps its own off switch. Puffin also asks before the wellbeing questionnaire.

Puffin encrypts the health data in this policy inside its service, with keys kept apart from the data, so a copy taken from a database or a backup cannot be read without those keys. Only people bound by a confidentiality undertaking can open any kind of health data in this policy.

If someone gets your health data without permission in a form they can read, we tell you within 60 days of finding out.

When we change this policy, we publish the new version with the date it takes effect. If a new version would use health data you already gave us in a new way, we ask you before we do it.

Write to team@puffincalendar.com with any question about your health data or to make a request. Inside Puffin, you can also use the feedback control on any screen.