Your privacy

Madeline is an AI assistant. This page explains the information its app and account service use when you sign in, ask for help, save a memory, or manage a subscription.

Operator: (3:16) Hospitality LLC
Privacy contact: Celeste.garrett.assistant@gmail.com

Your account and subscription

When you sign in with Google, the service receives a Google ID token and verifies its signature and intended audience. It uses your Google account identifier to recognize your account and stores a hashed identifier, your display name, an internal account ID, and a purchase account binding. Session-token hashes and expiry times support sign-in; the server does not store the raw Google ID token.

When you submit a Google Play purchase token, the service sends it to Google Play to verify the subscription for this app. It stores the purchase token, its account binding, plan, verification and expiry times, and subscription status. Google Play handles your payment details; this server does not receive your card information.

Google Play subscription notifications are received through authenticated Google Pub/Sub delivery. The service keeps encrypted purchase-processing jobs to verify changes and retry acknowledgements even when the app is closed. Unmatched receipts remain queued until a trusted account association can be established. Notification delivery identifiers, hashes, type and timestamps are kept for duplicate detection, normally for 30 days; raw notification payloads are not stored.

Messages, saved memories, and photos

Your current message and the memories you explicitly saved are sent to OpenAI to generate a reply. For conversational follow-ups, up to six recent exchanges are kept temporarily in server memory for your current signed-in session and sent as context. This context expires after 15 minutes of inactivity and is discarded on Clear, Stop, sign-out, account or saved-memory deletion, or a server restart. A failed connection can delay clearing until expiry. Ordinary conversations are not written to the database. If you choose a photo for an image request, the selected photo and your prompt are also sent to OpenAI; the server does not retain the photo. If you submit a report, its text and reason are stored.

Saved memories are stored until you remove them or delete your account. You control what you save; assistant replies do not automatically create memories. OpenAI processes the inputs it receives under the applicable provider settings and policies. The server requests that generated responses not be stored through the API, but this does not promise zero retention by the provider.

Voice features on your device

Device notes, profile details, setup and access preferences are encrypted locally and separated by the signed-in Madeline account. Signed-out guest data remains separate and is not automatically imported into an account. Switching accounts closes unfinished drafts and actions. These local records are not automatically uploaded to the account service.

Speech recognition and spoken replies use Android’s selected recognition and text-to-speech services. Depending on your device settings and provider, these services may use a network connection and process audio or text outside your device. Review those providers’ settings and privacy information.

The optional foreground voice loop takes turns listening and speaking, ends after 20 turns or 5 minutes, and stops when muted, stopped, backgrounded, or interrupted by an error. It is not a cloud Realtime voice service. Listening and speaking durations for the current UTC month are stored encrypted on your device separately for an account or guest. These local counters are not uploaded to the server and do not measure provider charges.

Optional live voice

When live voice is configured and you explicitly enable it, microphone audio passes through Madeline's server to OpenAI for a spoken conversation. Saved customer memories may be included as context. Generated audio returns through the server to your device. The app asks for consent before first use for each account. Voice stops when you stop, mute, leave the app, switch accounts, lose the connection, or reach the five-minute session limit. The server does not save raw conversation audio to disk.

The service stores voice session timing, observed audio durations and provider-reported token counts for your account. These are usage measurements, not a bill or a promised monthly allowance. Missing provider usage is marked incomplete. Local device speech counters remain separate. A live voice request can prepare an email, text or call for native review. The app stops listening before recipient selection and review; sending an email requires a separate Send confirmation, and texts or calls continue in your messaging app or dialer only after approval. A voice request alone does not send a message or place a call.

When you ask live voice to look up current public information, your search query is sent to OpenAI’s web-search service. The answer and source links are shown in the conversation. Following a source link opens that website in your browser, where its own privacy terms apply. Retrieved pages are not authorization to send messages or perform account actions.

Optional linked Gmail

If you connect Gmail, Google asks you to grant inbox reading and email sending access. The server encrypts your linked email address and access/refresh credentials in its database. Solo Light permits one available linked mailbox; Solo Full permits multiple. Inbox messages are fetched when requested and displayed as plain text. The service does not automatically send inbox content to the AI or save it as customer memory.

Sending requires review of the exact sender, recipients, subject and body, followed by an explicit Send confirmation. Draft contents are encrypted temporarily and expire after ten minutes; cleanup runs periodically. Send-status records remain for up to seven days. A delivery result that cannot be confirmed is shown as unknown and is never automatically resent. Sending through Gmail is subject to Google's processing and retention.

Disconnecting removes that mailbox's credentials and draft records from Madeline. Account deletion removes all linked mailbox data from the active database. You can also review or revoke Madeline's permissions in your Google account. Deleting local connection records does not erase mail already held or delivered by Gmail, and a provider request already submitted cannot be recalled.

Optional contact matching

If you choose contact-name matching, the app first explains the use and asks for Android contacts permission. Matching happens on your device, and you review the selected contact endpoint before handing off the action. The matching feature does not upload your contacts to this service or retain a separate contact copy.

Current weather

For U.S. weather, city and state names are matched against a local U.S. Census Bureau place list. The place's public reference coordinates are sent to NOAA's National Weather Service to find nearby station observations. If the international Open-Meteo service is configured instead, your requested place name and its coordinates are sent to Open-Meteo for model-estimated current conditions. The service does not automatically upload your profile city or precise device location. Results identify their source and data time; station results also name the station and its distance from the city reference point. Conditions at your exact location may differ. Non-personal location and weather results may be cached briefly for reliability.

Security and operational records

Display names, saved memories, report contents, billing snapshots, linked mailbox credentials, and email draft contents are encrypted at rest with AES-256-GCM. The service can decrypt this content to operate; end-to-end encryption is not provided. Account identifiers, session-token hashes, usage counters, and timestamps are also held in the service database.

The service records daily request counts and temporary rate-limit records to enforce usage limits and protect availability. Sign-in rate limiting uses a hash of the connection’s IP address. Account records, saved memories, reports, usage records, and stored billing records remain in the active database until removed through the supported controls or account deletion.

Access and deletion

You can review and remove saved memories in the app. To request account deletion, use the account controls in the app or visit Delete your Madeline account and sign in with the same Google account.

Account deletion removes the account, its sessions, saved memories, reports, usage records, owned billing details, and associated queued purchase tokens from the active service database. Minimal one-way purchase-token and account-binding hashes are retained without automatic expiry to prevent delayed notifications from rebuilding deleted access. These security markers contain no name, account ID, raw purchase token or timestamp. They do not permit sign-in or access to your deleted memories. A later explicit, authenticated purchase restore can restore that verified purchase.

Deletion does not automatically erase deployment backups, device-held copies, temporary rate-limit records, notification duplicate-detection metadata, or information already processed by Google, OpenAI, or speech providers. A provider request already sent cannot be recalled. Backup retention and other operator-managed records should be confirmed with the privacy contact above.

Deleting your Madeline account does not cancel a Google Play subscription. Manage or cancel the subscription separately in Google Play. Signing in again can create a new Madeline account.