Privacy Policy

YouCraft Solutions Inc., a corporation registered in British Columbia, Canada, doing business as Scribbles (“Scribbles,” “we,” “us,” or “our”), provides an AI agent for your whole life: you send it anything, over the web or by text message, and it turns what you send into records, research, reminders, and drafts. This Privacy Policy describes how we process personal information collected through our website, web and mobile applications, messaging channels, and related services that link to this policy (together, the “Service”).

We are a Canadian company, and this policy is written to meet Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and British Columbia's Personal Information Protection Act. If you live in the United States, the European Economic Area, or the United Kingdom, additional information about your rights is in the U.S. state privacy rights and Notice to European users sections below.

One note up front: Scribbles is a young product built by a small team. We would rather tell you plainly what we do today than hide behind legal language. If anything here is unclear, email us and we will give you a straight answer.

Personal information we collect

Information you provide to us

Contact and account data, such as your name, email address, password (stored hashed), phone number if you verify one, profile photo, and workspace names.

Your content. Everything you send to or create in the Service: text messages, notes, links, photos, voice notes, files, documents, and the structured records the AI agent builds from them (for example, a Recipe, a Person, or a Task). This may include personal information about other people that you choose to include, such as a contact's details. Please only share information about others that you have the right to share.

Communications data, such as messages you exchange with the AI agent, questions it asks you and your answers, actions you approve or reject, and your emails to our support address.

Transactional and payment data. Subscription plan, billing history, and credit usage. Payment card details are collected and processed directly by our payment processor, Stripe, under its privacy policy. We never see your full card number. If you subscribe through the iOS app, Apple processes the payment under its own terms and we receive only the subscription status and a transaction identifier, never your payment details.

Marketing preferences, such as whether you joined our waitlist or unsubscribed from our emails.

Information from services you connect

Sign-in providers. If you sign in with Google or Microsoft, we receive your name, email address, and profile picture from that provider. If you sign in with Apple, we receive your name and email address from Apple; if you choose Hide My Email, we receive the private relay address Apple creates instead of your real one.

Connected accounts. If you connect a third-party account, we receive the data that service makes available under the permissions you grant. Today that can include Gmail (read-only access to messages you choose to bring into Scribbles), Instagram (reels, posts, and messages you send to your Scribbles connection), and X (your bookmarks). You can disconnect any of these in Settings at any time. Disconnecting stops new data from flowing but does not delete what you already saved in your workspace.

Scribbles' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Gmail data only to provide features you request, we do not use it for advertising, and no human reads it except with your permission, for security purposes, or as required by law.

Public content you point us at. When you send a link (for example, an Instagram or TikTok URL), we fetch the publicly available page, caption, media, and metadata behind it so the AI agent can structure it. We use a third-party data collection service (Apify) to retrieve some of this content.

Information collected automatically

Device and usage data, such as your IP address, browser and operating system, device type, language settings, general location inferred from your IP address (city or region, never precise location), the pages and screens you view, the features you use, error reports, access times, and the page you came from. We collect this through server logs and the analytics tools described in the next section.

Messaging metadata, such as the phone number you message us from, the channel (SMS or WhatsApp), and delivery status.

Cookies and tracking technologies

We use cookies and similar technologies for a small number of purposes. We do not use advertising cookies, and we do not allow third parties to track you across other sites for advertising.

• Essential. Cookies that keep you signed in, protect against cross-site request forgery, and remember your cookie choice. The Service does not work without them.
• Analytics. We use PostHog to understand how the Service is used: which pages are visited, which features are used, and where errors occur. On our marketing website, analytics runs only if you accept it in the cookie banner, and you can change your choice by clearing your browser's site data for usescribbles.com. Inside the signed-in application, we collect product analytics tied to your account so we can fix what is broken and see what is used.

Most browsers let you block or delete cookies. Blocking essential cookies will stop you from signing in. Some browsers send “Do Not Track” or Global Privacy Control signals. Because we do not sell personal information or use it for targeted advertising, there is nothing for those signals to opt you out of, but where the law treats them as an opt-out request we honour them.

How we use your personal information

To provide the Service. To create and secure your account, receive what you send us on any channel, run the AI agent over your content (reading, structuring, researching, drafting, reminding), carry out actions you approve, sync your workspace across devices, and respond to your support requests.

To communicate with you. To send service announcements, security alerts, verification codes, receipts, and replies from the AI agent.

To send marketing you asked for. If you joined our waitlist or opted in, we send occasional emails about Scribbles, such as launch news and letters from the founder. In line with Canada's Anti-Spam Legislation, we send these only with your consent, every one includes an unsubscribe link, and we do not send marketing text messages.

To improve the Service. To understand how the Service is used, diagnose problems, and decide what to build next. We may create aggregated or de-identified data from personal information for this purpose and will not attempt to re-identify it.

To process payments and manage subscriptions, credits, and billing.

For compliance and protection. To comply with applicable laws and lawful requests, enforce our Terms, protect the rights, safety, and property of you, us, and others, and to prevent, investigate, and deter fraud, abuse, and security incidents.

How the AI agent processes your content

The AI agent is built on large language models from third-party providers (currently Google). When it works on your content, the relevant content is sent to the provider for processing and returned to us. Our providers process your content under terms that prohibit them from using it to train or improve their models. We do not use your content to train AI models either.

The AI agent makes suggestions and proposes actions, and you review them. We do not use your personal information for automated decision-making or profiling that produces legal or similarly significant effects on you.

How we share your personal information

We do not sell your personal information, and we do not share it with third parties for their own marketing. We share it only as follows.

Service providers. Companies that process personal information on our behalf and under our instructions to help us run the Service. Today these include AI model providers (Google), cloud hosting and storage (Railway and Amazon Web Services), messaging (Twilio, and Meta for WhatsApp), email delivery (Resend), payments (Stripe), product analytics (PostHog), and web content retrieval (Apify). Each is bound by a contract that limits what it can do with your information.

Services you connect and people you share with. When you connect a third-party service, approve an action that writes to one (for example, sending an email), invite someone into a workspace, publish a page, or connect an external AI agent or tool to your workspace, we share the relevant information with that service or person at your direction. What they do with it is governed by their own practices.

Professional advisors, such as lawyers, accountants, and insurers, in the course of the services they provide to us.

Authorities and others. Law enforcement, government authorities, and private parties where we believe in good faith it is necessary to comply with law, respond to legal process, or protect rights, safety, or property. Where permitted, we will tell you before we disclose your information in response to a legal request.

Business transfers. In connection with a financing, merger, acquisition, sale of assets, or similar transaction, or in an insolvency, personal information may be disclosed to prospective counterparties and transferred to a successor, subject to this policy.

Retention

We keep your personal information for as long as your account is active and as needed to provide the Service. When you delete content in the Service, it disappears from your workspace immediately and is removed from our active systems on our routine cleanup cycle. When you delete your account, your sign-in identity is deleted right away and the content in every workspace you solely own is deleted with it. Copies may persist in encrypted backups for a limited period before they are overwritten. We keep billing records and some log data for as long as tax, accounting, security, and legal obligations require.

Security

We use technical, organizational, and physical safeguards designed to protect your personal information, including encryption in transit, encrypted storage with our hosting providers, access controls, and least-privilege access for the small team that operates the Service. No system is perfectly secure and we will not pretend ours is. If we learn of a breach that creates a real risk of significant harm to you, we will notify you and the relevant regulators as the law requires.

Where your information is stored and processed

We are headquartered in British Columbia, Canada. Our servers and most of our service providers are located in the United States, so your personal information is stored and processed there and may be processed in other countries where our providers operate. While it is outside Canada, it is subject to the laws of those countries and may be accessible to their courts, law enforcement, and national security authorities. We use contractual and other safeguards to require a comparable level of protection wherever your information is processed. Contact our Privacy Officer if you have questions about our practices for transfers outside Canada.

Children

The Service is not intended for anyone under 18 years of age, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

Your rights and choices

Access and correct. You can review and update your account information in Settings, and edit or delete any record in your workspace. You can also ask us for a copy of the personal information we hold about you and to correct anything inaccurate.

Export. Email us and we will send you an export of your workspace. A self-serve export is on the way.

Delete. On the web, open Settings, choose Profile, then Delete account. In the mobile app, open the Profile tab and choose Delete Account. Either way, this permanently deletes your account and every workspace you solely own, as described under Retention. You can also email us to request deletion.

Withdraw consent. You can disconnect any connected service in Settings, remove your phone number to stop text messages (or reply STOP), unsubscribe from marketing emails using the link in any email, and decline analytics cookies on our website. Withdrawing consent may mean we cannot provide parts of the Service.

Complain. If you are not satisfied with how we handle your personal information or your request, you can contact our Privacy Officer at the address below. You also have the right to complain to the Office of the Privacy Commissioner of Canada or the Office of the Information and Privacy Commissioner for British Columbia.

We may need to verify your identity before acting on a request, for example by confirming you control the email address on the account. We respond within the time required by applicable law, and normally within 30 days.

U.S. state privacy rights

This section applies to residents of U.S. states whose privacy laws apply to us and grant the rights described here, including California, Colorado, Connecticut, Virginia, and other states with comprehensive privacy laws (the “State Privacy Laws”). Not every right exists in every state, and we may decline a request where the law permits.

Your rights. Subject to the State Privacy Laws, you may have the right to: know the categories and specific pieces of personal information we have collected, the sources, the purposes, and the categories of third parties we disclose it to; access and obtain a portable copy of your personal information; correct inaccurate personal information; delete personal information we collected from you; opt out of the sale of personal information, of its sharing or processing for targeted advertising, and of profiling that produces legal or similarly significant effects; limit the use of sensitive personal information; appeal a denied request; and exercise these rights without discrimination.

Our practices. We do not sell personal information, we do not share it for cross-context behavioural or targeted advertising, and we do not use it for profiling with legal or similarly significant effects. We do not use sensitive personal information to infer characteristics about you. We do not have actual knowledge that we collect or sell the personal information of anyone under 16. Because we do not sell or share personal information, there is no sale to opt out of; where the law requires, we treat Global Privacy Control signals as opt-out requests.

How to exercise your rights. Use the tools described under Your rights and choices, or email contact@usescribbles.com with “Privacy request” in the subject line. We verify requests by confirming you control the email address on the account, and may ask for more information where needed. An authorized agent may submit a request on your behalf; we may require proof of the agent's authority and confirmation from you.

Categories of personal information. The table below maps what we collect to the categories in the California Consumer Privacy Act. It describes our practices currently and over the past 12 months. We disclose each category to the service providers listed under How we share your personal information, for the purposes described under How we use your personal information. We do not sell or share any category.

California Shine the Light. We do not disclose personal information to third parties for their own direct marketing purposes. California residents may request confirmation of this by emailing contact@usescribbles.com with “Shine the Light Request” in the subject line.

Nevada. We do not sell personal information as defined by Nevada law. Nevada residents who wish to register an opt-out request against any future sale may email contact@usescribbles.com.

Notice to European users

This section applies only to individuals located in the European Economic Area or the United Kingdom (“Europe”). References to “personal information” in this policy include “personal data” as defined in the EU General Data Protection Regulation and the UK GDPR (together, the “GDPR”).

Controller. YouCraft Solutions Inc. is the controller of your personal information under the GDPR. Our contact details are under Contact us below. We do not have an establishment in Europe.

Legal bases. We rely on the following legal bases for the purposes described in this policy.

Your rights. You may ask us to give you access to your personal information, correct it, delete it, restrict its processing, or transfer a machine-readable copy to you or a third party. You may object to processing based on legitimate interests, and to direct marketing at any time. Where we rely on consent, you may withdraw it at any time. To exercise these rights, email contact@usescribbles.com. If you are not satisfied with our response, you may complain to the data protection authority in your country of residence. In the UK, that is the Information Commissioner's Office.

Transfers outside Europe. Canada has been recognized by the European Commission and the UK as providing adequate protection for personal information handled by commercial organizations under PIPEDA. However, your personal information is stored and processed by our service providers in the United States, which does not have a general adequacy decision. For those transfers we rely on the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum in our agreements with providers, or on providers' certification under the EU-U.S. Data Privacy Framework and its UK extension. You may request a copy of the relevant safeguards by emailing us.

Sensitive information. Please do not send us special categories of personal information (such as health, religious, political, or biometric data) about yourself or others unless you want the AI agent to work with it. By including it in your content, you consent to our processing it as described in this policy.

Changes to this policy

We will update this policy as the product evolves. If we make material changes, we will tell you by email or in the Service before they take effect, not just quietly bump the date. The “Last updated” date at the top shows when this page was last revised. Your use of the Service after the effective date of a revised policy means the revised policy applies.

Contact us

Our Privacy Officer is responsible for our compliance with this policy and with privacy law. For questions, requests, or complaints, email contact@usescribbles.com.

See also our Terms of Service.