Last updated: May 30, 2026
This document is provided for informational purposes. Professional legal review is recommended.
Your trust is the foundation of Shannon. Shannon is provided by Cluesmith LLC ('we,' 'us,' 'our'). This policy explains what data we collect, why, what we do with it, and what we will never do with it. We wrote it to be read by humans, not lawyers.
Account Information. Your name and email address when you create an account.
Connected Service Data. When you connect services (including but not limited to Gmail, Google Calendar, Google Drive, WhatsApp), Shannon accesses the data you explicitly authorize via OAuth. You choose which services to connect, and you can disconnect any service at any time. When you disconnect a service, Shannon stops accessing that data immediately.
Conversation Data. Your conversations with Shannon, including questions, requests, and Shannon's responses.
Derived Data. Information Shannon creates based on your data. This includes task lists, contact profiles, project summaries, and morning briefings. This data belongs to you.
Usage Data. Technical information about how you use Shannon: device type, session duration, features used, and error logs. This does not include the content of your emails, messages, or conversations.
Information About Third Parties. Shannon may encounter information about other people in your emails, messages, and calendar entries — including family members, friends, colleagues, and others who communicate with you. Shannon may also build context about these individuals within your account to provide its services — for example, remembering a colleague's contact details, a friend's birthday, or a child's school and dietary needs. This context exists solely within your account, under your control, and is deleted when you delete your account or when you ask Shannon to remove it. Shannon does not contact third parties directly and does not use third-party information for any purpose other than assisting you. We treat all third-party information with the same security and deletion protections described in this policy. If you have concerns about third-party information that Shannon has processed, you can ask Shannon to remove it at any time.
We use your data for the following specific purposes:
| Purpose | Data Used | Legal Basis |
|---|---|---|
| Deliver Shannon's core services (email scanning, calendar management, task tracking, briefings) | Connected service data, conversation data, derived data | Contract performance |
| Respond to your support requests | Account info, conversation data | Contract performance |
| Send you service communications (briefings, alerts) | Account info, connected service data | Contract performance |
| Detect and prevent fraud or abuse | Account info, usage data | Legitimate interest |
| Improve Shannon's reliability and fix bugs | Usage data, error logs (not personal content) | Legitimate interest |
| Improve Shannon's features and user experience | Anonymized, aggregated usage patterns only | Legitimate interest (with opt-out available) |
Shannon works with a small number of service providers to deliver your experience. Each is held to strict privacy and security standards.
| Provider | Purpose | Data Shared |
|---|---|---|
| Anthropic | AI language model that powers Shannon's responses | Your conversations and connected data are sent to Anthropic's API to generate responses. Anthropic's commercial API terms prohibit use of customer data for model training. When you delete your Shannon account, we stop sending data to Anthropic. Data previously processed by Anthropic is subject to Anthropic's own data retention practices. See Anthropic's commercial customer privacy policy for current data handling details. |
| Fly.io | Cloud hosting infrastructure | All Shannon data is hosted on Fly.io's US infrastructure. See Fly.io's security practices for current certifications and encryption details. |
| Resend | Email delivery (briefings, alerts) | Your email address and briefing content. See Resend's privacy policy and DPA. |
| Composio | Service integrations (OAuth connections) | OAuth tokens for connected services. Composio facilitates the secure connection between Shannon and your services (Gmail, Google Calendar, etc.) but does not access or store the content of those services. See Composio's privacy policy. |
| PostHog | Product analytics | Usage patterns, feature interactions, session data. Does not include personal content. See PostHog's privacy policy. |
We select service providers that meet our security and privacy standards. We may add service providers as Shannon develops. If we add a new provider that handles your personal data, we will update this policy. Providers' specific practices may change over time. We link to their current policies above rather than restating them, so you always have the most up-to-date information. We review our service providers' privacy practices periodically. If we become aware of changes that materially reduce protection of your data, we will evaluate alternatives.
We take this seriously. Here is exactly how it works:
We want to be transparent about this because it matters.
We treat 'training the AI model' and 'improving the product' as separate things, with separate rules.
What we use without asking: Anonymized, aggregated usage patterns — for example, "40% of users set up morning briefings in their first week" or "email scanning takes an average of 3 seconds." This data cannot be traced back to any individual.
What we will never use without your explicit consent: Your actual emails, messages, conversations, calendar entries, or any personal content. If we ever want to use personal content to improve Shannon (for example, to fine-tune how Shannon prioritizes emails), we will ask you first with a clear explanation of what, why, and how. You can say no, and it will not affect your service.
Technical safeguards: Before any data enters an analytics or improvement pipeline, it passes through an anonymization process that strips all personal identifiers. We use aggregation thresholds to ensure no individual's data can be reverse-engineered from aggregate statistics.
Shannon accesses Google user data (Gmail, Google Calendar, Google Drive) through authorized OAuth connections. Our use and transfer of information received from Google APIs to any other app will adhere to Google API Services User Data Policy, including the Limited Use requirements. Specifically: we only use Google API data to provide and improve Shannon's services to you; we do not use Google API data for serving advertisements; and we do not transfer Google API data to third parties except as necessary to provide Shannon's services, as required by law, or with your explicit consent. The use of 'improve' in this section refers to operational improvements to Shannon's services. See Section 6 for our separate rules on how data may or may not be used for AI training or product development.
Interim Integration Note: Google API connections are currently brokered securely via our infrastructure partner, Composio. The following scope table describes the direct-authorization model currently being rolled out across our platform.
Google scopes Shannon requests and what each one powers:
| Scope | What Shannon does with it |
|---|---|
| gmail.send | Send emails on your behalf when you ask (you review and approve each draft first). |
| gmail.readonly | Summarize incoming mail and surface what needs your attention in your briefing. |
| gmail.modify | Apply labels, archive, and mark read when you ask Shannon to organize your inbox (never permanent delete). |
| calendar.events | Create, update, and look up calendar events you ask about. |
| contacts.readonly | Resolve names you mention ("email Sarah") to the right saved Google contact. |
| contacts.other.readonly | Also resolve people you've corresponded with but never explicitly saved (Google "Other contacts"). |
| drive.file | Save files Shannon creates at your request and list those app-created files — never your existing Drive. |
| drive.readonly | When you reference a Drive file, find and read it — including extracting text from uploaded documents (PDF / Word / Excel) — so Shannon can summarize, search, or answer questions about it. |
Human Review Restrictions: There is no human review of Google API data by our personnel, except under the strict internal access controls and troubleshooting protocols described in Section 5 of this policy.
You have the following rights over your data, regardless of where you live.
To exercise any of these rights, contact us at [email protected].
Shannon uses session cookies to keep you logged in and analytics cookies via PostHog to understand how people use Shannon. We use PostHog to track usage patterns such as features used, session length, and navigation flows. PostHog does not track your personal content (emails, messages, calendar entries). We do not use advertising cookies or share analytics data with advertisers. By using Shannon, you consent to the use of session and analytics cookies as described above.
Shannon is designed for adults and we do not knowingly allow anyone under 18 to create an account. However, Shannon may process information about children when it appears in a user's emails, messages, or calendar entries, for example, school communications, medical appointments, or messages from family members. Shannon may also build context about children within a user's account to provide its services, for example, remembering a child's school, doctor, or dietary needs. This context exists solely within the account holder's control, is subject to the same security and deletion protections described in this policy, and is permanently deleted when the account holder deletes their account.
Shannon's infrastructure is hosted in the United States via Fly.io. If you are located outside the United States, your data will be transferred to and processed in the US. For users in the European Economic Area or UK, we will put appropriate transfer mechanisms in place, including Standard Contractual Clauses, as required by applicable law.
If you are a California resident, you have additional rights under the California Consumer Privacy Act:
If you are in the European Economic Area or UK:
This Privacy Policy is governed by the laws of the State of California, United States. Any disputes arising from this policy will be resolved in the state or federal courts located in California. This choice of law does not limit your statutory privacy rights under GDPR, CCPA, or other applicable local laws.
We may update this policy from time to time. Changes will be posted on our website with an updated effective date. For material changes that affect how we collect, use, or share your personal data, we will notify you by email at least 7 days before the change takes effect. Your continued use of Shannon after the effective date constitutes acceptance of the updated policy. We will never retroactively reduce your privacy protections without your consent.
For any privacy questions or requests:
Email: [email protected]