Privacy notice

Puffin is made by Puffin Studios, Inc., a Delaware corporation based in California. In this notice, "we" means Puffin Studios, Inc.

Puffin is for people 18 and over. It is not open to people who live in the European Union, Iceland, Liechtenstein, Norway, Switzerland, the United Kingdom, or the state of Washington. When you sign up, Puffin asks your birth month and year and where you live. If you are under 18, or you live where Puffin is not open, Puffin does not create an account and keeps nothing from your answer. If you can sign up, Puffin keeps your year of birth and your age band.

Puffin uses your data to plan your week around your calendar, your work, and your energy. It places your work in time, fixes your plan when something changes, proposes work it finds in your mail and in your calendar, answers you in the assistant and in the Student tutor, and shows you what it has learned about you so you can change it.

Puffin also uses your data to keep your account safe, to fix problems, to learn which parts of Puffin are hard to use, to send you the messages your account needs, and to answer your requests.

Puffin trains no model shared with other people on your data, and no general AI model is trained on your mail or your ring data. Puffin does not work out a health condition from data that is not health data.

Your account. Your email address, the one-time codes Puffin emails you to sign in, your password if your account still has one, your year of birth and age band, your second sign-in step, your signed-in sessions, and the browsers you chose to trust for 30 days. Puffin uses them to sign you in, to keep your account safe, and to check that you are 18 or over, and it keeps each code only until you use it or it expires. If you sign in with Google, Puffin asks Google only for your basic profile: your email address and that Google has verified it, your name, your profile picture, and an identifier for your Google account. Puffin keeps the identifier to know you the next time, and uses the rest to sign you in and to fill in your account. Signing in with Google gives Puffin nothing from your calendar or your mail, and connecting them is a separate step that asks you again.

Your calendar and task lists. The events from calendars you connect or import, the events you add, and the plan Puffin places. Once you say yes to Puffin’s AI, Puffin reads every calendar on an account you connect, your task lists in Google Tasks and Microsoft To Do, and, when you connect, the last 12 months of your calendar, so it can plan around everything and learn your patterns. Only your primary Google calendar and your default Outlook calendar count as your own. Puffin reads every other calendar, a shared or family calendar included, without changing it, and treats its events as free time until you mark that calendar busy. Puffin starts with these off: a calendar that shares only free and busy times, the To Do list of flagged mail, and a list someone else shares with you. A shared or family calendar can hold other people's events, and Puffin uses them only to plan your time. Turn off one calendar or list, or "Use your past 12 months", in Settings, under AI and privacy. When you turn off a calendar or a list, Puffin removes the events and items it read from it that you have not changed, and keeps the ones you changed as your own. When you connect a calendar while you set Puffin up, Puffin guesses your working hours from it, and you can change them. When an event has an address, Puffin looks up where it is, so it can leave time to travel.

Your work. Your objectives, tasks, to-dos, routines, steps, and tags, and what you mark done. Puffin uses them to plan your week and to show your progress.

Your mail, if you connect a mailbox. Puffin reads a message only after it has arrived in your mailbox, and keeps a pointer to it and the work it proposes. Until you say yes to Puffin’s AI, Puffin only adds the calendar invitations your mail brings. Once you say yes to Puffin’s AI, Puffin also reads the mail you send and attachments, flights, hotels, bills, and receipts among them, and, when you connect, the mail already in your mailbox. For that first reading, Puffin checks each message's sender, subject, and type without AI, and its AI reads only the useful ones, such as bookings, bills, invitations, and school mail. It turns a booking into an event with travel time, with Undo. Puffin keeps a sealed copy of each message it reads until 90 days after your mailbox received or sent it, which only your own Puffin AI searches when you ask about your mail. During the private test, a person at Puffin who signed a confidentiality undertaking can open your sealed copies only for one support case you allow in Puffin, and you see each message they open. Withdraw the case, or turn off Staff access, to end it. Puffin deletes every copy at once when you remove the mailbox, and within one day when you turn off Puffin's AI. Turn off "Your mail" to stop the search and delete the copies. Turn off "Read all of your mail", and Puffin deletes the copies of the mail you sent, the copies of the mail that arrived before you connected, and the text it took from attachments. Turn off "Turn bookings into events", and new bookings arrive as proposals while the events already added stay in your plan. Puffin keeps a log of each reading with no message text in it. When Puffin's filter sets an email aside, Puffin keeps its sender and subject for 30 days, so you can still turn it into work. When a sender's mail has become work you accepted before, Puffin adds new work from that sender to your plan as tentative, with Undo. No person at Puffin reads your messages, except in a support case you allow during the private test. To find the work in a message, Puffin sends it to Anthropic, where one AI model reads every new message and a second model reads it again when the first is unsure. Mail from before you connect gets the first reading alone.

Once you say yes to Puffin’s AI, Puffin learns from your mail unless you turn it off. It trains a small model for you alone on the mails you accept and dismiss, so it stops proposing the kinds you always dismiss. You can turn it off in Settings, under AI and privacy, or on your Memory screen. For that model, Puffin keeps words from the sender and subject of those mails, encrypted, for up to 365 days.

Your sleep, readiness, and activity, if you connect a ring. From Oura, Puffin keeps when each sleep started and ended, the day it belongs to, whether it was your main sleep, and your daily readiness and activity. From these nights Puffin estimates your body clock. Puffin's planner uses your ring's data only to estimate your body clock, to keep work out of the hours around your sleep, and to give you a lighter day after a bad night. Puffin's AI never sees anything from your ring. Puffin never advertises on your ring data, never sells it, and never trains a shared model on it.

The sleep times you set. When you set Puffin up, you tell it when you usually sleep and wake. Puffin plans around them, and until you set your own quiet hours, Puffin sends you no notice during them. Unless you turn it off, Puffin's AI also sees these times, and the quiet hours that follow them, so it can help you plan in chat. Turn off "Let Puffin’s AI see the sleep times you set" in Settings, under AI and privacy, and they stay out of every AI request.

Your goals, moods, and wellbeing. The goals you set, the moods you tell Puffin, and, if you agree to it, your answers to the monthly wellbeing questionnaire. Puffin uses them to plan toward your goals, to offer plan choices that fit your mood, and to see how Puffin affects you.

Your location, if you turn it on. Puffin asks first on a screen of its own, "Learn travel times from your location?", and your browser asks too. Once both allow it, Puffin records, while it is open, when you arrive at one of the places you saved, with the time. Puffin keeps no other location. Each arrival is deleted 365 days after it was recorded, and every arrival is deleted when you turn location off.

Your conversations. What you write to Puffin assistant, to the Student tutor, and in the goals conversation, and the replies. Puffin keeps each chat until 365 days after its last message, or until you delete it. So you can search your chats by meaning, Puffin turns each kept message into a search entry, which is deleted with the chat. Once you say yes to Puffin’s AI, Puffin's AI recalls your earlier chats when you write, and Puffin summarizes each chat when it goes quiet and notes what it learns about you on your Memory screen, so it can help without asking you again. A private chat creates nothing Puffin learns from or recalls, and it stays out of chat search. Turn off "Your past chats" in Settings, under AI and privacy, to stop the recall, the summaries, and the notes.

What you bring from another assistant. When you set Puffin up, you can paste what ChatGPT or Claude knows about you, or have a short get-to-know-you chat. Puffin sends it to Anthropic to fill in your profile, keeps the facts on your Memory screen marked as brought in, and keeps them until you delete them. Turn off "Your past chats" and Puffin stops using them.

Pictures and voice. When you send a screenshot or a photo in chat, such as a flyer, a school schedule, or a group chat, Puffin's AI reads it and proposes the events it shows. A picture can show other people, so send only what you may share. Puffin removes a picture's location and camera details before it keeps it or sends it to Anthropic. Puffin deletes a picture with its chat, and every picture when you turn off "Pictures and voice". A picture you add but never send is deleted after one day. When you speak a message, your browser’s own speech service turns it into words. That service may send the audio to the browser’s maker: Chrome sends it to Google, and Safari may process it on your device. Puffin keeps only the words you send, and never a recording. Turn off "Pictures and voice" in Settings, under AI and privacy.

What Puffin learns about you. The preferences Puffin learns from how you use it, the notes it keeps about you on your Memory screen, and the standing instructions you give. Puffin uses what it learns from your first day. To check that learning helps, about one plan in ten uses Puffin's defaults instead. Your Memory screen lists every learned entry, where you can change or delete each one or reset them all. Turn off "Use what Puffin learns" and Puffin plans from its defaults, keeping what it learned until you turn it back on. Once you say yes to Puffin’s AI, Puffin learns from moods and health topics you mention unless you turn off sensitive topics.

Your reasons and your changes. After you drag, skip, or delay work, or dismiss a proposal, Puffin can offer one-tap reasons, such as later, tired, or not needed. Puffin keeps your reasons, how long and how hard work turned out to be, your rest time, and the before and after of each edit to your work and to the AI's drafts, of each AI action you undid or declined, and of each meeting moved outside Puffin. It learns your patterns from them and keeps each record for 365 days. Turn off "Reasons" or "Corrections" on your Memory screen.

Your studies, if you use the Student module. Your terms, courses, assessed items, study blocks, grades, and study sets. Puffin keeps each file you upload for a course, with its text, until the course's term ends or you remove the course, and only that course's tutor and study material generator read it. Both run on Anthropic's AI models, so a file's text goes to Anthropic when either one reads it.

What you publish. During the private test, a post on the idea board shows the board name you chose.

Your feedback. The message you send with the feedback control and any screenshot you add go to Puffin's operators and to no one else. Puffin keeps them for 365 days. A feedback message includes the conversation you are looking at only while Product improvement is on. When you report a reply from Puffin assistant or the tutor, the report always carries that chat.

Reports from your browser. When a screen fails, your browser sends us a crash report, and it sends us how long screens took to load. Neither one carries a title, a subject, a sleep figure, or an identifier from the page you were on. We send crash reports on to Sentry so we can fix them. Puffin keeps the load times for 30 days.

How you use Puffin. Once you say yes to Puffin’s AI, and unless you turn off Usage events in Settings, Puffin records what you open, that you searched and which result you opened, the details you reopen, the notices you tap, and when you open the digest or the brief, so we can find what is hard to use. These events carry no content you wrote, never the words of a search, no health data, and nothing from your mail. Puffin keeps them for 365 days.

Messages. Your email address, so Puffin can send you the messages your account needs, and, if you allow browser notifications, a record of your browser so Puffin can reach it.

Our hosting provider. Amazon Web Services stores Puffin's data and runs Puffin's service in the United States, in Oregon. It also sends Puffin's emails, looks up event addresses, and builds the search entries for your chats.

Our AI provider. What you type to the assistant, the Student tutor, and the goals conversation goes to Anthropic, together with the words of a task you add and of work a module or your mailbox brings in, so Puffin can guess its length, its effort, and its habitat. When the assistant searches the web for you, the search it writes from your words reaches a search index through Anthropic. Anthropic deletes it within 30 days, keeps flagged content for up to two years and its safety scores for up to seven, and trains no model on it. Anthropic handles all of this for Puffin, as Puffin's service provider, and only to answer you.

Each request to Puffin assistant also carries your standing instructions, your profile and settings, what Puffin has learned about you that is in force, the notes Puffin keeps about you, and, while sensitive topics is on, today's mood. Unless you turn it off, it also carries the sleep times you set and the quiet hours that follow them, so Puffin assistant can help you plan in chat. Unless you turn off "Your profile and your week", each message also carries a profile of you, with your life structure, commitments, goals, routines, and places by name only, and a short paragraph about you that Puffin's AI writes each night through Anthropic, together with your next 7 days and the work you did, skipped, and moved last week. Your goals in the Health and Mind habitats and your moods of the last 7 days join the profile only while sensitive topics is also on. Puffin writes the paragraph only from what you and Puffin wrote, never from your notes, your mail, text brought in from elsewhere, your moods, or your health. Puffin keeps the latest paragraph, which you can read and delete on your Memory screen, and turning off "Your profile and your week", or Puffin's AI, deletes it within one day. Unless you turn off "Your past chats", it carries what Puffin recalls from your earlier chats. Nothing from your ring, and nothing Puffin learned from it, ever reaches Anthropic.

To answer you, Puffin assistant reads your records, and what it reads goes to Anthropic. That can be your events, tasks, to-dos, and routines with their notes, descriptions, places, people, and files, your rituals and tags, your proposals and suggestions, your goals, your studies, the history of your changes, the items you point the assistant at, the lines your mailbox brings in, the sealed copies of your mail when you ask about it, and the pictures you send.

Anthropic also reads each message Puffin reads in a mailbox you connect, its attachments among them, to find the work and the bookings in it.

If you use the Student module, Anthropic reads the calendar and the syllabus you upload while Puffin drafts your term and your course from them. It also reads your courses when Puffin writes your study sets, and the files you upload for a course when that course's tutor or study material generator reads them.

Once a day at most, Puffin sends Anthropic your goals, what it has learned about you outside health, the titles of your open work and proposals, and, while sensitive topics is on, your Health and Mind goals and the notes it keeps about you. A model then proposes work that serves your goals.

Our error and log services. Sentry receives the errors from every part of Puffin's service and the crash reports described above, and keeps backups of them for 90 days. Datadog receives Puffin's service logs and measurements, which carry no personal data, and keeps them for 15 days.

Services you connect. Google, Microsoft, and Oura send Puffin the data you connect them for. When you change an event that belongs to your Google or Outlook calendar, Puffin sends that change back to Google or Microsoft. If you sign in with Google, Google confirms who you are.

Services that deliver to you. Your browser's push service delivers Puffin's browser notifications. Your own mail provider receives the emails Puffin sends you. A calendar you subscribe to your Puffin feed reads your calendar through the feed's secret address.

Other users. During the private test, other users see only your idea board posts, with your board name.

People at Puffin. Every person at Puffin who can open your data has signed a confidentiality undertaking. Only those people can open your health data and the pointers that link a proposal to its message. During the private test, they can open a sealed copy of your mail only for one support case you allow, and you see each message they open.

Puffin's operators see your entry on the waiting list and the invitation they sent you. They also read what you send to Puffin yourself, without asking you first, because you sent it to us: your feedback and its screenshot, your messages to team@puffincalendar.com, a report you send on a reply with its chat, a request you make about your data, and a request to reset your second sign-in step. Puffin records each time an operator opens a feedback message, and keeps that record for 365 days for its own review. Your settings show only the accesses described next.

During the private test, Puffin's support team can open your account to fix problems, such as your calendar, your work, and your chats, which you accept with the tester notice. Turn off Staff access in Settings, under AI and privacy, to stop it. Otherwise nobody at Puffin opens the rest of your data unless you ask us to for one support case, we are fixing a failure in one of your conversations, or the law requires it. Every such access is logged, and you can read each one under Staff access.

When the law requires it. When the law requires us to open your data, the head of the company approves it in writing first, and we tell you within one day where the law allows us to.

The full list. We name the kinds of parties here. Use "Ask for the full list of parties or the retention schedule" under Privacy in settings to get every party by name, with what each one sees, or the full list of how long Puffin keeps each kind of data. We’ll answer within ten days.

Puffin keeps most of your data while your account exists, until you delete it. Some data leaves sooner on its own:

Your nights, readiness, and activity in full for eight weeks, then a reduced form until 12 months after each day. Arrivals at saved places for 365 days. The sealed copy of each message Puffin read until 90 days after your mailbox received or sent it. The paragraph Puffin writes about you until the next night replaces it or you delete it. Usage events for 365 days. Chats, with their summaries and pictures, until 365 days after their last message, or until you delete them. Reasons and correction records for 365 days. Calendar history older than eight weeks until you turn off "Use your past 12 months". Feedback for 365 days. Emails the filter set aside for 30 days. A mail pointer until you decide its proposal or remove the mailbox. A learned entry returns to its default 365 days after the last record behind it. Wellbeing answers for 365 days. Screen load times for 30 days. Service logs for 15 days.

When you confirm "Delete my account" in settings, Puffin deletes your account at once and signs you out.

Your data leaves our live systems now. Copies in backups are gone within 90 days.

What stays: any record a law requires us to keep and any open dispute.

The record of each logged access to your data also stays, for 365 days after that access, because it is the evidence that each access was allowed.

See and change. You can see and change everything you enter on its own screen, and everything Puffin learned on your Memory screen.

Export. "Export my data" in settings prepares a file of everything you entered. We email you a link that works for seven days, and the same link appears in Puffin. Your calendar is a calendar file. What Puffin learned is in learned.json and on your Memory screen.

Delete. "Delete account" in settings deletes your account with one confirmation. If you cannot sign in, the deletion request page sends a link to your email address, which works once and for one hour. When you delete a health record or remove a health source, Puffin removes it from its live systems at once, and its backup copies are gone within 90 days.

Your switches. Settings, under AI and privacy, has an off switch for each use in this notice that you did not ask for one by one: Puffin's AI, your profile and your week, the sleep times you set, your past chats, your mail for the AI, pictures and voice, reading all of your mail, learning from your mail, bookings, work from senders you accepted, each calendar and task list, your past 12 months, usage events, and, during the private test, staff access. Your Memory screen has "Use what Puffin learns", "Include sensitive topics", "Learn from your mail", and a switch for each kind of record Puffin learns from, "Reasons" and "Corrections" among them. Location has its own switch, and a private chat keeps one chat out of memory. Puffin stops a use within one day of you turning it off.

Product improvement. One switch in settings, off until you turn it on. It covers feedback you send that quotes a conversation. It never covers what Puffin learns about you, or any model shared with others.

Requests. We answer a request to see, correct, delete, or export your data within 30 days.

Puffin asks you once before its AI starts. That one yes covers every use this notice says starts once you say yes: your words, your profile, your week, the sleep times you set, your past chats, all of your mail, learning from your mail for you alone, every calendar and task list with a year of history, sensitive topics, your reasons and changes, pictures and voice, and usage events. The yes and the no carry equal weight, and each use keeps its own off switch. Puffin asks on a screen of its own before it reads your location, and your browser asks too. Puffin asks again before each connection and before the monthly wellbeing questionnaire. Puffin records each agreement with its wording, its version, and the time.

You can turn a use off in Settings, and Puffin stops it within one day. Puffin does not take away a feature you already have until you agree to something new.

Puffin sets these cookies of its own, each to make Puffin work. None of them shows you advertising or follows you on other sites. Because Puffin does not follow you on other sites, it treats a browser's Do Not Track signal the same as no signal.

• puffin_session keeps you signed in. It lasts until your session ends, at most 30 days, and ends after 14 days without use.
• puffin_attempt holds a sign-in between its first step and the code Puffin sends you, for 10 minutes.
• A cookie whose name starts with puffin_oauth_state protects a sign-in or a connection you start with Google, Microsoft, or Oura, for 10 minutes.
• When you choose to trust a browser, a cookie remembers that choice for 30 days.
• puffin_onboarding_started remembers when you started setting Puffin up, for 30 days.
• puffin_module_setup lets a module's setup open the calendar while you set Puffin up, for one day.
• puffin_first_week_line keeps the calendar's first-week line for seven days after you finish setting Puffin up.
• puffin_age_refused remembers that the age check refused a sign-up on this device, with no birth date in it, for 400 days. Only the waiting list page reads it.
• puffin_device_zone holds your device's time zone, so a device you come back on sees the time zone question on its first screen. Every page writes it, and it lasts a year from the last time your device's time zone changed. It stays with Puffin's web app, and Puffin's service never receives it.

Puffin encrypts the data that Nevada and Connecticut treat as health data, the credentials it holds for your connections, your mail pointers, and the sealed copies of your mail inside its service, with keys kept apart from the data. A copy taken from a database or a backup cannot be read without those keys.

If someone gets your data without permission in a form they can read, we tell you within 30 days of finding out, and within 60 days for health data.

Some of your data is health data. Puffin's health data policy lists it, and says where each kind comes from, why Puffin uses it, who receives it, and how you use your rights over it. The policy is linked from Puffin's home page.

Nevada and Connecticut treat this data as health data: your sleep, readiness, and activity from your ring, the estimate of your body clock and what else Puffin learns from your health data, the sleep window and body clock type you choose, your goals in the Health and Mind habitats, your moods, your wellbeing questionnaire answers, and Puffin's working records about your plan.

Puffin's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. Puffin does not use data from Google Workspace APIs to develop, improve, or train non-personalized AI or machine learning models. The only model trained on it is your own mail filter, for you alone, once you agree. Puffin uses your Google data only for the features this notice describes, and never sells it or uses it for advertising. No person at Puffin reads your Google data, except in a support case you allow during the private test, for security, or when the law requires it.

While Puffin is in its private test, the tester notice says what is different during the test. It changes no promise in this notice.

Puffin keeps every version of this notice with its date. "Versions" under Privacy lists each one and shows the version you accepted. If a new version would use data you already gave us in a new way, we ask you before we do it.

Write to team@puffincalendar.com with any question about your data or to make a request. Inside Puffin, you can also use the feedback control on any screen. To report a security problem, use the security address on Puffin's website.