Privacy Policy

This policy applies to the Fibly website, web application, waitlist, support channels and related services. It does not replace the privacy policies of services you choose to connect, such as Google, Spotify or Stripe. The individual operator is responsible for Fibly's privacy practices and acts as the privacy contact.

Information you provide

• Account: name, email address, account identifier, avatar and authentication method.
• Workspace content: tasks, recurring tasks, projects, milestones, notes, folders, links, note images, habits, check-ins, reminders, plans, calendar imports, focus sessions and dashboard items.
• AI content: prompts, Agent conversations, voice transcripts, generated responses, proposed actions, confirmations, action history and feedback.
• Preferences: themes, layouts, focus and notification settings, AI Memory preference and integration settings.
• Support and feedback: messages, contact details and diagnostic context you submit, such as the current page, browser, viewport, language and time zone.
• Billing: plan, subscription status, Stripe customer and transaction references, renewal period and checkout-consent evidence. When store subscriptions are enabled, Apple or Google processes payment and RevenueCat verifies store transactions using your Fibly account identifier, purchase references, product, store, renewal and cancellation status. Payment providers process full payment details; Fibly does not directly store them.

Information collected automatically

• IP address, browser and device information, language, time zone, request time, referring URL, route and application version.
• Feature usage, task and habit activity, focus duration, AI usage, error events, security events and billing status.
• Browser-storage identifiers and settings described in the Cookie & Device Storage Notice.
• Latest account access time and approximate connection country, region and city supplied by Vercel from authenticated requests. This account insight stores the latest observation, not raw IP addresses, GPS coordinates or location history. VPNs and network routing can affect accuracy.

Information from connected services

• Google identity information when you sign in with Google.
• Read-only Google Calendar account labels and selected event data when connected.
• Spotify account, playlist, playback and device information when connected.
• Events from iCalendar files or feed URLs you import.
• Payment, subscription, fraud and tax information from Stripe.
• When you use an enabled store subscription, purchase and renewal information verified by RevenueCat from Apple or Google. Store subscription management and cancellation remain with the store.

Fibly does not require health, financial, religious, political, sexual, biometric, government-identification or similarly sensitive information. Free-form tasks, notes, habits, calendars, images, voice and prompts can still contain sensitive or confidential information. Use care, do not submit passwords or full payment-card details, and do not upload information you are not authorized to process.

• Provide, synchronize and secure accounts and workspace features.
• Run requested AI, voice, memory, calendar, music, notification and import features.
• Process subscriptions, provide receipts, prevent fraud and maintain contract evidence.
• Generate personal productivity views and usage limits.
• Understand aggregate geographic usage and support account administration using approximate connection locations and latest access times.
• Diagnose errors, prevent abuse, maintain reliability and respond to support.
• Send authentication, security, service and billing communications, and marketing only where permitted.
• Comply with law, enforce the Terms and protect users, Fibly and others.

Where consent is required, it must be meaningful and can be withdrawn subject to legal or contractual limits. Core processing that is necessary to provide a requested feature cannot be disabled while continuing to use that feature. Optional features can be left disconnected or turned off.

Fibly uses OpenAI's API for AI generation, embeddings and audio transcription. Depending on the feature, Fibly sends your prompt, submitted audio and relevant workspace context to OpenAI to return the result you requested.

• Workspace AI Memory is optional and must be turned on from Settings before eligible workspace content is indexed.
• Eligible memory sources include notes, tasks, habits, habit check-ins, focus sessions and projects.
• Google Calendar event data is not persisted in Workspace AI Memory. Imported calendars, uploaded audio, billing data and account credentials are also excluded from the reviewed memory index.
• Turning AI Memory off disables retrieval and deletes derived memory index data, jobs and related search telemetry. It does not delete the original workspace records.
• OpenAI does not use API inputs or outputs to train its models by default. Provider abuse monitoring may retain API data for up to 30 days unless different approved controls apply.
• Fibly sends applicable Responses API requests with store: false. Provider abuse-monitoring retention may still apply.
• Raw voice audio is not intentionally retained by Fibly after transcription. The transcript can be saved in the feature where you used it.

Read the AI Transparency & Safety page before using AI with sensitive or consequential material.

Fibly does not sell personal information and does not use it for cross-site behavioural advertising. Information is disclosed only as follows:

• Service providers: Supabase, Vercel, OpenAI, Stripe, RevenueCat for enabled store billing, Apple, Google, Spotify, Sentry, browser push providers and email-delivery infrastructure, as applicable to the feature.
• At your direction: when you connect an integration, import a feed, initiate checkout or otherwise request a disclosure.
• Legal and safety: where reasonably believed necessary to comply with law, lawful process, enforce agreements, investigate fraud or security, or protect rights and safety.
• Business transition: during financing, reorganization, incorporation, sale or transfer, subject to confidentiality and notice where required.

See the current Subprocessor List for provider purposes and links.

Google Calendar

Calendar access is read-only. Fibly displays selected event data and can use it as temporary Agent context, but the reviewed Agent cannot create, edit or delete Google Calendar events. Fibly's use and transfer of Google API data adheres to the Google API Services User Data Policy, including Limited Use requirements.

Spotify

Spotify information supports optional music and playback features. The reviewed Fibly AI tools do not receive Spotify content or personal data. Disconnecting Spotify removes the Fibly connection and initiates removal of stored Spotify connection data; Spotify may retain information under its own policy.

Weather and location

Weather is disabled in this release. Fibly does not request device location or send weather city searches or coordinates to a weather provider. Older device preferences may remain until you clear Fibly device data.

Google Fonts

Fibly currently loads font files from Google Fonts. When a page requests those files, Google can receive your IP address, browser information and ordinary request details under Google's privacy practices.

Notifications

If enabled, Fibly stores a push endpoint and encryption keys and uses browser-vendor push infrastructure. Private notification mode hides task or habit names on the lock screen.

Fibly uses HTTPS, Supabase authentication, access controls, database row-level security, private file storage, signed image links, API authentication, rate limits and monitoring safeguards. Session replay is disabled. These measures reduce risk but no online service can guarantee absolute security. The Security page describes current controls without claiming a certification.

Workspace content and account settings are generally kept while the account is active because they are the service the user asks Fibly to provide. Agent history, images and integration data remain until deleted, disconnected or the account is deleted, subject to operational delays and legal exceptions. The latest connection-location observation is replaced when a new location is available and removed when the account is deleted. AI Memory search telemetry is designed for a 30-day cleanup period; administrative event logs are designed for a 90-day period. Security, billing, tax, consent, dispute and suppression records may be retained longer where reasonably needed or legally required. Backups may persist for a limited recovery period and are not restored for ordinary use after deletion.

• Access and correction: edit workspace information in Fibly or request access/correction by email.
• Deletion: delete your account and associated cloud data in Settings → Account → Delete account. See the account deletion instructions. Contact privacy@fibly.app if you need help accessing your account.
• Export: download a JSON copy of supported local browser data from Settings > Account & Data > Data on this browser. This is not a full account export; cloud account data exports are handled by request.
• Consent: disconnect optional integrations, disable AI Memory or notifications, and withdraw other consent where applicable.
• Complaint: contact Fibly first so the issue can be investigated. Canadian residents may also contact the Office of the Privacy Commissioner of Canada or an applicable provincial regulator.

Requests require reasonable identity verification. Fibly may retain limited information where required for billing, tax, fraud prevention, legal claims, security or compliance, and will explain a refusal where required.

Fibly is operated from Canada, while providers and their subprocessors may process information in the United States and other countries. Information can therefore be subject to the laws and lawful access processes of those places. Fibly assesses providers and uses contractual or other safeguards where required, but does not claim that every item of data remains in Canada.

You must be at least 18 years old to create or use a Fibly account. Fibly is not directed to children and does not knowingly collect personal information from anyone under 18. If you believe a minor has created an account, contact privacy@fibly.app so the account can be investigated and deleted where appropriate.

Fibly sends authentication, security, account, billing and important service messages as needed. Marketing messages will include sender identification and a working unsubscribe method where required. Unsubscribing from marketing does not stop essential account or security communications. Browser notification permission can be revoked in browser or Fibly settings.

The effective date and document version will change when this policy is revised. Material changes will be highlighted by email, in-product notice or another legally appropriate method before they take effect where required. New consent will be requested when the law requires it; continued use is not treated as consent to a materially different optional use of personal information.

Privacy officer/contact: the individual operator of Fibly, Newfoundland and Labrador, Canada. Email privacy@fibly.app. General support: support@fibly.app.