Privacy, plainly stated.

Ellipsis (“we”, “us”) runs the Ellipsis website, web app and Android app. This policy explains what we collect, why, who helps us, and the choices you have. It applies to all of them.

• Account details: your name, email address, and password (stored only as a secure hash), or the sign-in provider you use instead.
• Google sign-in: if you sign in with Google, Google shares your name, email address and profile picture with us.
• Your content: the pings, notes, tasks, reminders, projects, habits, spaces and calendar links you add, and a profile photo if you upload one.
• Voice captures: the recording is sent for transcription and then discarded. We keep only the text.
• Device and security information: when you sign in, we store your IP address and your browser or device type (user agent) with that session, so you stay signed in and we can spot suspicious activity.
• Usage counts: how many AI actions, questions and voice captures you’ve used each day, so we can apply your plan’s limits, and short-lived counters (keyed to your account, email or IP address) that stop abuse and runaway requests.
• Billing details: if you buy a paid plan, we keep your plan, subscription status, billing period and renewal or end dates, the currency you pay in, and the customer and subscription IDs our payment providers give us. If you redeem a promo code, we keep which code and when. We never receive or store your card number; the payment provider handles it.
• Support reports: when you send feedback or a problem report from the app, we receive your message, name and email, basic account details (such as when you joined, how many items you have and which features are on), and device details like your browser, time zone, language and screen size. We never include the content of your notes or pings.
• Survey answers: if you answer an in-app survey, we keep your answers (or that you chose to skip it).
• Notification settings: if you turn on notifications for a device, we keep the address your browser’s push service gives that device and the keys used to encrypt messages to it, along with your time zone and the briefing times you choose. Turning notifications off, or signing out on that device, removes it.
• Aggregate analytics: we use Vercel Web Analytics to count page views, and Vercel Speed Insights to measure how quickly pages load (performance measurements such as load times, with the page and device type). Neither uses cookies or tracks you across other sites.
• Product analytics: inside the app, we record which features are used, such as a ping or note being created, a question asked, a plan limit reached, a checkout started or a plan cancelled, along with the app page you’re on (without anything after the “?” in its address). We also record where on a page you click and how far you scroll, to see which parts of the app get used and where people get stuck: the kind of element clicked and its position, but not the words on it, so a click on a note is recorded without its title. These events carry your account id and details like the plan or whether a capture was spoken, but never your name, your email address, or anything you write or search for. We don’t record your screen. We use PostHog for this, without cookies or anything stored on your device. You can turn it off in Settings, under Data.

We use your information to run Ellipsis, keep it secure, prevent abuse, fix problems, provide support, and send service messages like sign-in, verification and password emails. We use survey answers and aggregate usage to decide what to improve. We do not sell your personal information or your thoughts, and we don’t use it for advertising.

While you’re getting started, and if you’ve been away for a couple of weeks, we send a few short emails with tips (never more than one a day, and never anything you wrote). Turn them off in Settings, under Notifications, or with the unsubscribe link in any of them. If you join through a friend’s invite link, we record who invited you so we can give you both the reward; they only see how many people joined with their link, not who.

• Contract: most processing is needed to provide the service you signed up for, including taking payment and managing your subscription if you buy a paid plan.
• Legitimate interests: keeping Ellipsis secure, preventing abuse, applying usage limits, and understanding how the app is used and how well it performs, in aggregate.
• Consent: for optional features you turn on, like connecting a calendar, turning on notifications or answering a survey. You can withdraw it at any time by turning the feature off.
• Legal obligation: when the law requires us to keep or disclose information, such as keeping billing and tax records.

What you write in Ellipsis (pings, notes, tasks, project and habit names, and the links and data of calendars you connect) is encrypted with AES-256-GCM before it is saved to our database. The encryption keys are kept separately from the database, so a copy of the database or a backup on its own does not reveal your content.

This is encryption at rest, not end-to-end encryption. Our servers can decrypt your content, because features like connecting related thoughts, expanding notes, Ask and the daily briefing need to read it. Your name and email address are stored unencrypted so we can sign you in and contact you.

When you use a feature that needs it, the relevant content is sent to the service that provides it:

• Google’s Gemini API, for AI features: finding connections between your thoughts and sorting them into threads, expanding notes, answering questions in Ask, writing your daily briefing and digest, suggesting tasks, and transcribing voice captures.
• MET Norway (the Norwegian Meteorological Institute), for weather in your briefing. Your chosen place is kept on your device; only approximate coordinates and your time zone go to our server, which asks MET Norway for the forecast. We don’t save them, and MET Norway doesn’t learn who the forecast is for.
• Photon, a place search run by komoot using OpenStreetMap data, for finding your weather place. It receives what you type into the place search, or approximate coordinates when you use your location, directly from your browser.
• Calendars you connect. For Apple, Outlook and other iCal calendars, we fetch your events using the private link you provide. For Google Calendar, we use the read-only access you grant through Google (see below).
• PostHog, hosted in the EU (Frankfurt), for the product analytics described above and for switching new features on for some people before everyone. It receives those events from our server and, while you use the app, from your browser through our own address.
• Vercel, which hosts and serves the app and provides our aggregate, cookie-free page-view analytics and performance measurements (Speed Insights).
• Neon, which runs our database.
• Lemon Squeezy, our reseller and merchant of record for payments in US dollars, including international purchases. When you buy a plan, it collects your payment and billing details (such as your name, email address, card details and billing address) and your location for tax purposes, and processes them under its own privacy policy. It tells us your plan, subscription status and renewal dates.
• Paystack, which processes payments in Nigerian naira. It collects the payment details you enter at checkout under its own privacy policy and tells us whether your payment and subscription are active.
• Resend, which sends sign-in, verification, password and tips emails, and delivers support reports to us.
• Google, if you choose to sign in with Google.
• Your browser’s push service, if you turn on notifications: Google (Chrome, Android and most other browsers), Apple (Safari), Mozilla (Firefox) or Microsoft (Edge on Windows). It delivers each reminder or briefing to your device. Messages are encrypted for your device before they leave our servers, so the push service can’t read them.

These providers process data on our behalf under their own data processing terms. Your use of a sign-in provider, connected calendar or payment provider is also covered by that provider’s own privacy policy. We don’t use advertising trackers, and we don’t sell your information. We may disclose information if the law requires it, or to protect people’s safety or the security of Ellipsis.

Our database is in the European Union (Frankfurt, Germany). The app itself runs on servers in the United States and the EU, and some of our providers (like Vercel, Resend and Google) process data in the United States. When data moves outside the EU or UK, it’s protected by our providers’ standard contractual clauses and data processing terms.

Connecting Google Calendar is optional and only happens when you choose it in Ellipsis. We ask Google for read-only access to your calendars (the calendar.readonly permission). Ellipsis never creates, changes or deletes anything in your Google Calendar.

• What we read: the names of your calendars, so you can pick which ones to show, and, for the calendars you pick only, each event’s title, location, start and end time, and whether you declined it. We don’t read event descriptions, guest lists, attachments or meeting links.
• How we use it: to show your events next to your tasks in Calendar, to mention your day’s events in your daily briefing, and to answer your questions in Ask. For the briefing and Ask, the titles and times of the relevant events are sent to Google’s Gemini API to write that response for you.
• How we store it: to keep views fast, we keep a copy of events from roughly the past five weeks to the next six months, refreshed about every 15 minutes. This copy and your Google access tokens are encrypted at rest, as described above.
• Removing it: disconnecting a calendar in Ellipsis deletes our copy of its events, and deleting your account deletes all of it. You can also revoke Ellipsis’s access at any time from your Google Account permissions.

We don’t sell Google Calendar data, use it for advertising, or use it to train AI or machine-learning models. People at Ellipsis don’t read it, except with your permission, when needed for security, or when required by law. Ellipsis’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Some things are kept only in your browser: your weather place, units and display preferences, a short-lived copy of your latest briefing, and anything you capture while offline until it syncs. Signing out clears the personal items and any captures still waiting to sync.

If you arrive from one of our posts or ads, the link carries a short label naming that post (like ?ref=campus-news). Your browser keeps it for that tab only, and if you sign up, we record it with your sign-up so we know which posts bring people who find Ellipsis useful.

Notifications show on your screen, and can show on your lock screen, depending on your device’s settings. They include a reminder’s title and a short summary of your day. If you set an app PIN, they don’t include anything you wrote.

If you share your tasks to another calendar, that calendar receives them through a private link. You can replace or turn off that link at any time in Calendar.

We only use cookies that are strictly necessary for Ellipsis to work, so we don’t show a cookie banner:

• Sign-in session (better-auth.session_token), which keeps you signed in.
• Sign-in state, a short-lived cookie used only while you sign in with Google, to protect that step.
• App lock (ellipsis-unlock), if you set a PIN, which remembers that this device is unlocked for up to 12 hours.
• Active space (ellipsis-space), which remembers the space you last opened.

We don’t use advertising, analytics or tracking cookies. Preferences and offline data kept in your browser’s storage are described above.

• Your account and content: until you delete them or your account. Deleting your account removes everything from our live database immediately, except billing records we must keep (see below). Our database provider keeps short-term backups for recovery, and those roll off within about 30 days.
• Sessions: signing out ends that session. A session you don’t use expires after 7 days.
• Security counters and logs: short-lived. Rate-limit counters reset within minutes to an hour, and server logs are kept only briefly by our hosting provider.
• Daily usage counts and survey answers: kept with your account and deleted with it.
• Product analytics: kept by PostHog for up to a year. Once your account is deleted, the events carry an id that no longer belongs to anyone. Email us if you’d like them deleted sooner.
• Billing records: kept for as long as tax and accounting laws require (usually several years), even after you delete your account. We keep only what those laws need, such as your plan, payment dates and amounts, and the provider’s references, never your card number.
• Support emails: kept as long as we need them to help you and follow up.

Wherever you live, you can:

• Access and export your data. Use Export my data in Settings to download everything in your account as a file.
• Correct your details in the app, or ask us to.
• Delete your account and everything in it from Settings. This is permanent.
• Turn off product analytics in Settings, under Data. Nothing more is sent from then on.
• Object to or restrict some processing, and withdraw consent for optional features by turning them off.
• Complain to your local data protection authority if you think we’ve handled your data wrongly. We’d appreciate the chance to fix it first.

If you live in California, you have the right to know what personal information we collect, and to ask us to delete or correct it. We don’t sell your personal information or share it for cross-context behavioral advertising, and we won’t treat you differently for using your rights.

For anything you can’t do in the app, email us at the address below. We may need to confirm it’s really you before acting on a request.

Ellipsis is only for people 18 and older, and isn’t directed at children. If we learn that an account belongs to someone under 18, we’ll delete it. If you think that’s happened, please let us know.

Besides encrypting your content, we use HTTPS everywhere, hash passwords, encrypt sign-in tokens for connected accounts, and limit how often sensitive actions can be tried. No service can promise perfect security, but we work to protect your data and will tell you if a breach affects you, as the law requires.

If we make a material change, we’ll let you know by email or in the app before it takes effect. The date at the top shows when this policy last changed.

Questions about privacy can be sent to support@mail.tryellipsis.space.