Privacy policy
Last updated: October 8, 2026
This English version is provided for convenience. The French version prevails.
Samy is built to keep your work with you. Your board is stored on your computer and your voice never leaves it. This page explains what goes through our servers, why, and for how long.
Data controller
Steven Freville EI (bonjoursamy.com), 25 Mail Marcel Cachin, 38600 Fontaine, France. Contact: hello@bonjoursamy.com.
What stays on your computer
- Your board: tasks, notes, projects and your day diary, in the app’s folder (
%APPDATA%\Samy). We have no copy of it. - Your voice: it is turned into text on your computer. No audio recording is sent.
- Your calendar: events read from Google Calendar are copied to your computer, and the access token is encrypted there.
What goes through our servers
| Data | Why | Legal basis | How long |
|---|---|---|---|
| Account: email address, sign-up date, end of trial, subscription status | Create and run your account | Contract | As long as the account exists. An account unused for 3 years is deleted. |
| Sign-in session (hashed id, dates) | Keep you signed in | Contract | Until you sign out |
| Email sign-in link (address, hashed link) | Sign you in without a password | Contract | 24 hours |
| What you send the assistant: your thoughts, your messages and the parts of your board it needs (tasks, projects, notes, title and time of your meetings) | Sort a thought, draft your day, answer you | Contract | Not kept by our servers. Our AI providers delete it within 30 days at most. |
| Text of replies read aloud | Produce Samy’s voice | Contract | Not kept by our servers. Deleted by the provider within 30 days at most. |
| Usage: estimated cost of your requests per month | Apply your plan’s allowance | Contract | As long as the account exists |
| Billing: Stripe customer id, subscription status and dates, invoices | Charge the subscription, issue invoices | Contract, legal obligation | Invoices: 10 years (French Commercial Code, article L123-22) |
| Feature ideas: your text, app version, language, system | Improve Samy | Legitimate interest | 3 years |
| Download link request on the website: email address | Send you the link | Your request | The address is not kept. A one-way hash is kept for 24 hours to prevent abuse. |
Your card details are entered at Stripe. We never see them. Our AI providers don’t use your content to train their models.
Google Calendar and Google sign-in
If you connect Google Calendar, Samy asks for read-only access to your events. It reads them to plan your day around your meetings. Events are copied to your computer, never to our servers. When you ask Samy to draft your day or talk to it, the title and time of the relevant meetings are sent to the assistant with your request, only to answer you.
Samy never writes to your calendar, doesn’t sell this data, doesn’t use it for advertising and doesn’t use it to train AI models. Samy’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
If you sign in to your Samy account with Google, we only receive your email address. You can remove this access anytime in Samy’s settings or at myaccount.google.com/permissions.
Our providers
- Cloudflare: hosting for the website, the server and the account database (stored in the EU), incoming email.
- Stripe: payments and invoices.
- Resend: sign-in and download link emails, sent from the EU.
- Anthropic: the assistant (sorting thoughts, drafting your day, replies).
- OpenAI: the voice of Samy’s replies.
- Google: Google sign-in and Google Calendar, if you use them.
Some of them are based in the United States. These transfers are covered by the safeguards the GDPR provides for: the European Commission’s standard contractual clauses or the EU-US Data Privacy Framework, depending on the provider.
Cookies
The website uses no advertising cookies and no analytics. It keeps your language choice in your browser. During an email sign-in, our server sets a short-lived technical cookie that ties the link you receive to the browser that asked for it. These are needed for the service and don’t require consent.
Security
All connections are encrypted (HTTPS). Session tokens are stored hashed on our servers and encrypted on your computer. Sign-in links work once and expire after 15 minutes.
Your rights
You can access, correct, erase, restrict, object to or take a copy of your data. Write to hello@bonjoursamy.com and we’ll answer within a month. To delete your account, write to us from the account’s address. Your board stays on your computer: uninstall Samy, then delete the %APPDATA%\Samy folder to erase it.
If you think your rights aren’t respected, you can complain to the CNIL, the French data protection authority (www.cnil.fr).
Changes
If this policy changes in a meaningful way, we’ll tell you by email or in the app before the change applies.