My Ace™ Privacy Policy

Effective October 2, 2026

My Ace™ is operated by Chris Burns ("My Ace™", "we", "us"), based in Florida, USA. Questions about this policy or your data: chris@thechrisburns.com.

This policy explains how My Ace™ (https://ace.thechrisburns.com) collects, uses, stores, shares and deletes your information, including Google user data from Gmail and Google Calendar if you choose to connect a Google account. See "Google user data" below.

My Ace™ is a personal agent app. You build a "hand" of AI agents ("cards") that help with your inbox, calendar, errands, money questions and creative work. My Ace™ is powered by Claude, a model made by Anthropic. My Ace™ is not an Anthropic product.

How My Ace™ handles Google user data

This section explains exactly how My Ace™ accesses, uses, stores, shares and deletes Google user data. It applies only if you choose to connect a Google account. On Google's consent screen, My Ace™ appears under the name "Ace".

Data Accessed

When you connect Google, you choose to grant My Ace™ these permissions:

• Gmail, read (gmail.readonly): the messages in your inbox, so your cards can find what needs you, summarize threads, and spot bills, renewals, receipts and follow-ups.
• Gmail, compose and send (gmail.compose): creating drafts in your Gmail and, only after your approval, sending email you asked for.
• Google Calendar events (calendar.events): reading your events, and adding an event when you ask and approve it.
• Your Google email address (openid, email): to show you which account is connected.

My Ace™ doesn't access your contacts, Drive files, photos or any other Google data.

Data Usage

• Only to do what you ask, or what a routine you set up asks. For example: "what in my inbox needs me today", "draft a reply to Dana", "what's on my calendar Thursday".
• Sending an email and creating an event follow your approval rules. By default, My Ace™ asks you first.
• We don't use Google user data for advertising, we don't sell it, and we don't use it to develop, improve or train AI or machine learning models, ours or anyone else's.
• My Ace™ does not use data obtained through Google Workspace APIs to develop, improve or train generalized or non-personalized AI or machine learning models. Anthropic processes the specific content only to produce the response you asked for, and does not train its models on it.
• People at My Ace™ don't read your Google data, except with your explicit permission for a specific message (for example, to fix a problem you report), when needed for security or abuse investigations, or when the law requires it.

Data Sharing

• Anthropic, which runs the AI model, receives the specific email or event content a card is working on, only to produce the answer you asked for. Under Anthropic's commercial terms it may not train on that content.
• No one else. We don't share, sell or transfer Google user data to third parties, except as needed to provide the features you use, to comply with the law, or as part of a merger or acquisition with notice to you.

Data Storage and Protection

• Your Google access and refresh tokens are encrypted at rest in our database and used only on our servers.
• My Ace™ doesn't keep a copy of your mailbox or calendar. Messages and events are fetched when a card needs them, used to produce the answer, and not stored by My Ace™, except the text of a reply or summary a card shows you in your conversation, and any fact you ask a card to remember.
• All data travels encrypted (HTTPS/TLS).

Data Retention and Deletion

• Encrypted Google tokens are kept until you disconnect Google or delete your account.
• Disconnect Google anytime in Settings, Email and calendar, Disconnect. My Ace™ revokes its access with Google immediately and deletes the tokens. You can also remove it at https://myaccount.google.com/permissions, where Google lists it as "Ace".
• Deleting your account deletes everything, including any conversation text that came from your Google data.
• We keep Google user data only as long as needed to provide the features you use, unless the law requires a longer period. When that period ends, we delete it. You can ask us to delete your data anytime at chris@thechrisburns.com.

Limited Use Disclosure

My Ace™'s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

What we collect

Microsoft Outlook data

If you connect a Microsoft account (Outlook.com or Microsoft 365), My Ace™ uses Microsoft Graph with the permissions you grant (read and write mail, send mail, read and write calendar events, and your basic profile) in exactly the same way as Google data above: only to do what you ask, sending and booking follow your approval rules, tokens are encrypted at rest, nothing is used for advertising or AI training, and disconnecting in Settings deletes the tokens.

Files

Files you upload and files your cards save for you are stored privately in our database provider's storage (Supabase), in a folder only your account can reach. They're deleted when you delete them or your account.

Your data and AI training

Your conversations with your cards are never used to train AI models. We don't train models, and Anthropic's commercial terms say it may not train its models on the content we send it.

Who processes your data

These providers process data only to run their part of My Ace™:

• Anthropic runs the AI model and holds each card's working sessions and your long-term notes.
• Privy handles sign-in (email codes, passkeys and Google sign-in).
• Supabase hosts our database and file storage in the United States.
• Microsoft provides Outlook mail and calendar, only if you connect it.
• Mailgun sends My Ace™'s emails to you (sign-up confirmations and invitations).
• Netlify hosts the app.
• Google provides Gmail and Calendar, only if you connect them.
• Stripe handles payments.
• Twilio sends text messages, only if you link a phone number.
• Telegram carries messages, only if you link Telegram.
• OpenAI turns voice recordings into text when you use the microphone. We don't keep the audio.
• Your browser's push service (for example Apple, Google or Mozilla) delivers notifications.

We don't sell your personal information, and we don't share it for cross-context behavioral advertising.

Text messages (SMS)

If you link a phone number for My Ace™ text alerts, we use it only to send the texts you signed up for: approval requests, alerts from your routines, and replies from your cards. How you opt in, how often we text and what it costs are on the My Ace™ text alerts page.

• We don't sell, rent or share your mobile phone number, or your text messaging opt-in data and consent, with third parties or affiliates for marketing or promotional purposes. We share them only with Twilio, our messaging provider, to deliver your texts.
• Reply STOP anytime and we stop texting and unlink your number right away. Reply HELP for help.

What your cards will and won't do

• Your cards treat the content of emails and web pages as information, never as instructions.
• My Ace™ never completes a purchase or moves money. For a purchase, a card can only hand you a checkout link after you approve.

How long we keep it

We keep your account data until you delete your account. Early-access signups are kept until My Ace™ launches and we've told you, or until you ask us to remove you.

Deleting your account, in Settings, then Delete account:

• cancels any active subscription
• revokes My Ace™'s access to your Google account
• deletes your account, cards, messages, approvals, routines, usage records and linked channels from our database right away
• deletes your cards' conversations and your long-term notes at Anthropic
• deletes your sign-in at Privy

Our database provider keeps routine backups that may hold deleted data for a short time before they roll off. Anthropic may keep content flagged by its safety systems for longer, as its own policies describe.

Your rights

You can access, correct, export or delete your data. Delete your account yourself anytime in Settings, or email chris@thechrisburns.com for anything else, and we'll respond within 30 days. Depending on where you live, you may have further rights under local law, and we'll honor them.

Children

My Ace™ isn't for anyone under 18, and we don't knowingly collect data from children.

Security

We protect your data with encryption in transit, encryption at rest for Google access tokens, access controls on every database table, and approval gates on risky actions. No system is perfectly secure, so please tell us at chris@thechrisburns.com if you think something is wrong.

Changes

If we change this policy, we'll post the new version here with a new effective date, and tell you in the app before any material change takes effect.