Privacy Policy.

One MemoryBank for everyday life

Doolai brings documents, notes, voice memories, reminders, shopping lists and receipt-based expenses into one personal memory experience. We use the information you add to organise your MemoryBank, read and summarise content, answer questions, support reminders and provide the sharing features you choose.

The homepage describes privacy, encrypted storage and trusted sharing. These protections apply differently to encrypted stored files, information used by AI and separately stored facts. The sections below explain those differences.

What we collect

Your account

Your name, your email address and how you sign in (Google, Apple or email and password). If you link WhatsApp, your WhatsApp phone number. Registration does not require your date of birth. If you choose to set up a Pulse reading, we store the birth date you provide and any optional birth time and birth place for that feature.

What you add

The files, photos, scans, voice recordings and notes you put in your MemoryBank, and what you type or say to the assistant.

What the app works out

From what you add, the app works out things like the type of document, a title, dates, names, amounts, document numbers, reminders and tasks. Useful facts from your conversations can be saved so the assistant remembers them next time.

Accounts you connect

Only if you choose to connect them:

• Gmail and Outlook mail: we read your messages to find what matters, such as bills, deadlines and documents, save the attachments you want into your MemoryBank and write draft replies. We only send an email when you confirm it.
• Google Drive and Dropbox: we read your files so you can bring them into your MemoryBank.
• Google Calendar and Outlook calendar: we read your events.
• WhatsApp: we receive the messages and files you send to the Doolai number.

Phone permissions

Only when you allow them:

• Camera: to scan documents.
• Photos: on Android, only photos you select through the system picker are imported. On iOS, with your permission, automatic import checks photos on your phone for likely documents such as receipts, bills and letters, and uploads likely documents. You can turn automatic import off.
• Folders: Android imports only files or folders you select through system pickers. It does not request all-files access. Selected files are uploaded for AI processing and stored in your MemoryBank.
• Microphone and speech recognition: to record voice memories and talk to the assistant. Your phone's built in speech recognition service turns your speech into text.
• Contacts: if you invite people from your contacts, we only receive the people you pick. We never upload your contact list.
• Notifications: to remind you. We keep a notification token for your device.
• Fingerprint or face unlock: handled entirely by your phone. We never receive your biometric data.

Receipts (optional)

If you turn on Receipts, the receipts you scan are stored readable, not encrypted with your key, so we can show your spending and answer questions about it.

Your Trust List and sharing choices

The trusted contacts you select, the memories, documents or folders you share, and the permissions you set. We use these choices to provide access to the selected content and to let you review or stop sharing.

Usage and technical data

How much AI work your account uses (to apply your credits and limits), the plan you are on, and basic technical logs that keep the service secure and help us fix problems.

Cryptographic privacy by design

Account sign-in and file decryption have separate roles. Signing in verifies your identity. Your Brain Key provides the keys that unlock your encrypted stored MemoryBank files and document text; your login password alone does not open those copies.

• Everything travels over encrypted connections.
• Files and document text in your MemoryBank are stored encrypted with AES-256-GCM, using keys made from your Brain Key. The stored copies cannot be opened without your key. If you lose your Brain Key and every device you are signed in on, we cannot open those files for you.
• Information kept without your key (the facts and dates the app finds, titles, reminders, tasks, receipts and account details) is stored on our servers, protected by access controls and encryption at rest. Files that are still being processed, and attachments you send by email, can also be held for a while without your key.
• Through the app, only you and the people you choose to share with can reach your data. We only look at your data when we need to keep the service running, when you ask us to fix a problem, or when the law requires it.

AI reading, synthesis and recall

AI can read text from documents and images, transcribe recordings, summarise key ideas and identify useful details such as dates. You can ask questions about your saved content and use it to support reminders and recall.

To read a document, photo, recording or email, to answer a question, or to speak a reply, the app sends the content it needs to our AI providers:

• Google (Gemini) reads documents, photos, recordings and emails, and writes answers.
• OpenAI builds the search index for your memories and turns replies into speech.

They process this content for us under their business terms. They do not use it to train their models, but they may keep it for a short time to detect abuse. Files sent to Google for reading are deleted by Google within 48 hours.

Encryption of stored files does not mean AI can answer without seeing content. The content needed for a request is processed by our providers. Some extracted facts, titles, reminders and tasks are stored separately without your Brain Key so that features such as search and reminders can work.

Reporting an AI answer: use Report below an answer, or hold an answer and choose Report answer. After you confirm, we receive that answer (up to 8,000 characters), your selected reason, account identifier, platform and report time. The answer may contain personal information. Reports are available only to our review team, are not used as conversation context, and are deleted after 90 days or when your account is deleted.

AI can make mistakes. Please check important dates, amounts and details against the original document. A recalled health value or document summary is information from your content, not professional advice.

Google user data: access, use, sharing and deletion

Google sign-in and Google account connectors serve different purposes. Signing in with Google does not by itself give Doolai permission to read Gmail, Google Drive or Google Calendar. Those connections require the separate permissions you approve.

What Google data we access and why

• Google sign-in: your Google account identifier, name, email address and profile picture, where provided, to authenticate you and display your account.
• Gmail, when connected: email headers (including sender, recipients, subject and dates), message bodies and supported attachments, to import documents, find dates and obligations, build email history, answer your questions and prepare replies. The optional inbox watcher processes mail in the background only after you enable it. Sending a reply requires your confirmation and the appropriate Google permission.
• Google Drive, when connected: file names, identifiers, types and the contents of documents you select for import, to add them to your MemoryBank and answer questions about them.
• Google Calendar, when connected: event details, such as titles, dates, times and locations, to show your schedule. Any calendar action offered by the inbox watcher requires the permissions and confirmation for that action.
• Connection credentials: OAuth access and refresh tokens, where needed, to maintain the Google connections you enable. We do not ask for or store your Google password.

How Google data is used and shared

We use Google user data only to provide the Doolai features you choose. Content required for document reading, email analysis, answers and recall may be processed by Google Gemini and OpenAI as described in AI processing. Supabase provides our authentication, database and file storage. If you explicitly share imported content through your Trust List, the selected recipients receive the access you permit. We do not transfer Google user data to third parties for unrelated purposes.

We do not sell Google user data or use it for advertising, creditworthiness or lending decisions. Google Workspace API data is not used to develop, improve or train non-personalised or general-purpose AI or machine-learning models. Human access is limited to the support, security and legal circumstances described in this policy.

How Google data is protected

Transfers to our service use HTTPS. Imported MemoryBank files and document text are encrypted using keys derived from your Brain Key. Extracted information, reminders, connection credentials and background inbox processing have separate server-side storage and access controls; they are not all protected by your Brain Key. The encryption and AI processing sections explain these differences.

Retention, disconnection and deletion

Disconnect a Google account in Connectors to stop future access through that connection. You can also revoke Doolai access in your Google Account connections. Disconnection does not automatically erase documents and information you previously imported. Imported content remains until you delete it or your Doolai account, subject to the retention and deletion rules. To request deletion or assistance, email hello@doolai.fyi or use our account deletion page.

Doolai's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Trust List sharing

You can share selected memories, documents or folders with people in your Trust List. Recipients can ask about the content you share. You choose whether to allow access to original files; where enabled, recipients can view and download those originals.

You can review access and stop sharing through Doolai. Stopping access cannot remove copies a recipient has already downloaded, saved or sent elsewhere. Choose recipients and original-file permissions carefully, especially for personal or health documents.

Sharing requires us to process the selected content and access permissions to deliver it to the people you choose. Adding a contact to your Trust List does not make your entire MemoryBank public.

Imports and duplicate handling

We use content fingerprints and import identifiers to recognise repeat content through supported import paths within your account:

• Folder imports: a content fingerprint identifies a repeat file so that the same file is not saved or charged twice through that import path.
• Gmail history imports: identical attachments from different emails are linked to the same imported document, avoiding another extraction of that document.

Files you choose to import from a device, email, WhatsApp or a drive can be brought together in your MemoryBank. Duplicate handling depends on the import path. It does not automatically remove existing copies from your device, email, WhatsApp, Google Drive or Dropbox.

References to less digital waste describe avoiding unnecessary repeat imports, processing or sending. They are not a claim of a measured reduction in hardware waste or emissions.

Services that help us run Doolai

We only share data with services that help us run Doolai, and only what they need:

• Supabase: our servers, database, file storage and sign in. Our servers are in Mumbai, India.
• Google: Gemini AI, Google sign in and notifications. Gmail, Google Drive and Google Calendar only if you connect them.
• OpenAI: the search index and spoken replies.
• Apple: sign in, if you use it.
• Microsoft: Outlook, if you connect it.
• Dropbox: if you connect it.
• Meta: WhatsApp, if you use it.
• Cloudflare: hosts this website.

People in your Trust List receive access to the selected content and permissions you choose to share with them. We may disclose data when the law requires it, or to protect someone from harm. If Doolai is ever sold or merged, your data would move with it, and we would tell you first. We never sell your data.

Where your data is processed

Our main servers are in India. Our AI and service providers may process data in other countries, including the United States. When your data leaves the country where it was collected, we rely on our providers' data protection terms to keep it protected.

How long we keep it

• Your MemoryBank, facts, reminders and tasks: until you delete them or your account.
• Deleting your account: choose immediate deletion, or scheduled deletion with 30 days to change your mind. After the selected deletion takes effect, your account and associated data, including stored files, are erased. Any copies in backups are removed on our backup schedule. You can also request account deletion without the app.
• Receipts: turning Receipts off stops new scans but keeps the receipts you already have. They are deleted with your account, or sooner if you email us.
• Connected accounts: disconnecting stops our access straight away.
• Usage records: kept as long as we need them for billing, security and the law.

Your rights

You can ask to see, correct, export or delete your data, or object to how we use it. Email hello@doolai.fyi and we will reply within one month. You can withdraw your consent at any time by disconnecting an account or turning a feature off.

You can also complain to your data protection authority. In the UK that is the Information Commissioner's Office; in India, the Data Protection Board of India.

Our legal basis (UK and EU)

We use your data to provide the service you asked for (contract); for connected accounts, automatic photo import and Receipts, because you turned them on (consent); to keep Doolai secure and prevent abuse (legitimate interests); and where the law requires it (legal obligation).

Children

Doolai is for people aged 18 and over.

This website

This website does not use advertising or tracking cookies. If you sign in on the web, your browser stores your sign in session so you stay signed in.

Changes to this policy

If we change this policy we will update this page. If a change is important, we will also tell you in the app.

Contact

hello@doolai.fyi