NextCue

Privacy Policy

Data We Access

Gmail

NextCue requests read-only Gmail access (gmail.readonly) when you connect your Google account. This permission allows the application to list and read messages you have authorised. We do not send email, delete mail, or change mailbox labels through this permission. The content of messages is used solely for the purpose of extracting tasks, deadlines, meetings, and calendar events.

Google Calendar

NextCue requests Google Calendar event access (calendar.events) when you connect your Google account. This permission allows the application to list, create, update, and delete events on calendars you have authorised. We do not use this permission to change calendar sharing or account settings.

How AI Processing Works

Non-sensitive content submitted for analysis may be sent to configured AI providers for the purpose of extracting tasks, deadlines, meetings, and calendar events from emails and other inputs. A rule-based sensitive-content check runs first, but it can miss information. Calendar writes and task creation still require your explicit approval before anything is persisted.

Third-Party AI Providers

NextCue is configured with AI provider keys that may include OpenAI, Anthropic, Google Gemini, Groq, OpenRouter, or NVIDIA models. The specific provider(s) in use depend on which API keys are set in the environment. No content is sent to any AI provider unless you have explicitly connected your Google account and initiated an analysis or chat request. All API calls are made from the server side; your data is never sent from the browser to third-party providers.

Data Storage and Retention

When you connect your Google account, OAuth tokens are encrypted and stored in your user-specific Supabase database record. These tokens are isolated per-authenticated-user and are not shared across accounts. The following data is retained:

  • OAuth refresh and access tokens for Gmail and Google Calendar, encrypted per user
  • Extracted commitments (tasks, deadlines, meetings, calendar events) stored in your Supabase user account
  • Chat conversation history, if you use the AI assistant, stored in your Supabase user account

Tokens and data remain in your Supabase user account until you revoke access or request deletion. No fixed automatic expiration period is applied.

Revocation and Data Deletion

You can revoke NextCue's access at any time by:

  • Clicking "Disconnect Google Account" in the Settings page, or
  • Revoking access from your Google Account permissions page

When you revoke access:

  • OAuth tokens are revoked and removed from your Supabase user record
  • Encrypted tokens are deleted from your Supabase user record
  • NextCue stops processing any further data from your connected services

Extracted commitments and chat history stored in your Supabase user account are also removed upon revocation.

Contact

If you have questions about this privacy policy or want to exercise your data rights, please contact us at muhamumar465@gmail.com.