RobotchiSecurity
Robotchi gets access to your work. This is what we do to keep that access small, verifiable and revocable.
As few permissions as possible
- You sign in with your Google account. We never see your password.
- The connection to Gmail and Calendar is read-only. Robotchi cannot send, delete or change mail and cannot change events.
- We ask for write permissions only when you choose a feature that needs them, and separately.
- Your assistant gets a fixed, limited set of tools. What is not on that list, the assistant cannot do.
One assistant per person
- Every user gets their own isolated assistant with its own memory. Data of different users is never mixed.
- New assistants are always created from a clean base, never copied from an existing one.
In transit and at rest
- All traffic between you, Robotchi and our partners is encrypted (TLS). Our servers accept no unencrypted connections.
- Access keys for Google are managed by our integration partner and are never shown to the app or in logs.
- Our own servers are in the EU (Germany). Edge logs contain no query parameters, so one-time links and OAuth responses never end up in logs.
Revoke and delete
- You disconnect connections yourself, in Robotchi or in your Google account. The effect is immediate.
- We delete your entire account and all data on request within 30 days. See the privacy policy.
Payments
Card details go directly to our payment partner. We do not store them and do not see them.
Reporting a vulnerability
Found something? Email marnixgeerkens@gmail.com. We reply within two working days and publish no details before the issue is fixed.