Privacy

How Confetti works

Confetti lets you ask an AI assistant to do work through WhatsApp. Google, GitHub, and Granola accounts are optional cloud connections. Enabling a connection makes its capabilities available to the assistant for your requests, including background work you ask it to perform. Relevant messages, documents, page content, screenshots, and tool results may be sent to the AI services that carry out that work.

Confetti runs in the cloud for enabled accounts. No connected personal computer is required. The desktop app, Chrome extension, and personal computer connections have been retired.

Waitlist

When you join the waitlist, we store your name, email address, and optional message in our hosted database to manage early-access invitations and contact you about Confetti. You can ask us to remove your waitlist details using the contact information below.

Google accounts

You can connect more than one Google account. We use account information such as your name, email address, and profile picture to identify each connection. Depending on the permissions you grant, Confetti can read, compose, send, and organize Gmail messages; view calendars and edit events; create, change, and delete tasks; and work with Drive files, Docs, Sheets, and Slides. Each account has its own credentials and task context. Connecting or removing one account does not merge it with another.

The cloud assistant provides a private Connections page. When you use it to connect Google, Confetti stores encrypted authorization credentials in its hosted database, together with the account identifier, email address, permissions, and connection status. Those credentials remain in the cloud. You choose which Google services to authorize, and can connect or disconnect each account independently. Disconnecting removes the stored authorization credentials; it does not delete previous task results or account records. You can also revoke access in your Google Account settings. Expired or used connection links, signed-out or expired management sessions, and used or expired sign-in flows are removed by routine maintenance.

Relevant Google content can be sent to AI providers to fulfil a request, and answers delivered through WhatsApp are processed and stored by the messaging service. We do not send your whole mailbox when a smaller amount of context will do.

GitHub and Granola

You can also connect GitHub and Granola through the private Connections page. Confetti stores encrypted authorization credentials, account identifiers and labels, granted permissions, and connection status separately for each provider and account. GitHub access lets Confetti read repositories, issues, and pull requests and make changes you request within the permissions you approve. Granola access lets Confetti search and read meeting notes and available transcripts in your active Granola workspace.

Relevant content from these services can be sent to AI providers to fulfil your requests and included in answers delivered through WhatsApp. Credentials remain in the cloud. Disconnecting an account removes its stored authorization credentials, but does not delete prior task results or account records. You can also revoke authorization with the provider.

WhatsApp

Meta delivers your WhatsApp identifier, messages, attachment metadata, and delivery information to Confetti. Our cloud service stores conversation history, account information, task state, derived attachment analysis, and results so requests can continue across cloud restarts. Google requests use the selected account's credentials; connecting another account does not combine their permissions.

If you send an attachment, Confetti may retrieve it from Meta and send it to an AI provider for transcription or extraction. Confetti does not retain the original attachment bytes in its WhatsApp service. Business messages are processed by Meta and Confetti after delivery; they are not private to the devices in the chat. Meta's own terms and privacy policy also apply.

The WhatsApp ingress and delivery service normally removes conversation and delivery records after 30 days, and limited operational audit records after 90 days. Hosted agent sessions, scheduled work, account records and results have separate lifecycles. Contact us to request deletion; deleting account authorization does not erase past results or completed actions. Data held by Meta or other connected services is subject to their own policies.

Cloud execution

Where an isolated hosted workspace is enabled, its files, browser state and task results are held in cloud infrastructure. Task content and tool results may be processed by the AI provider and the services involved in your request. Personal computer access is unavailable. Stopping a connection does not undo completed actions or remove information already sent.

Diagnostics and support

Confetti keeps operational information needed to deliver requests, prevent abuse, and investigate failures. This includes request and task identifiers, connection and delivery status, timing, model usage, and errors. The retired desktop diagnostics collection is no longer used. Account access checks send an opaque account identifier to PostHog; they do not send your phone number, Google email address, or message content.

We use information you choose to share with support to investigate and respond to your request. Avoid including credentials or unrelated private content in support messages.

Why we use information and who receives it

We use information to provide Confetti, keep it safe and reliable, support users, and meet legal obligations. Depending on the purpose and where you live, we rely on providing the service, legitimate interests in operating it, consent where required, or legal obligations.

Providers help us connect Google and WhatsApp, power AI features, host infrastructure, measure product health, and provide support. These include Google, Meta, OpenAI, Vercel, Neon, and PostHog for their respective features. We share information as needed for those purposes or when required by law or to protect users. Providers may process information in other countries; we use appropriate protections where required.

We do not sell personal information or use it for targeted advertising. We do not use your Google data, browser data, messages, files, or screenshots to train shared general-purpose AI models. Human access to Google data is limited to the circumstances permitted by Google's policy, such as your consent to investigate a specific issue, security, or legal requirements. Our use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.

Retention and your choices

In addition to the specific periods above, we keep information only as long as needed for its purpose, security and support needs, or legal requirements. Local app data can remain until you remove it. Disconnecting an account and deleting stored data are separate actions; you can also revoke Google access in your Google Account settings. Contact us for help accessing or deleting data held by Confetti.

Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or receive your personal information, withdraw consent, and complain to a local data protection authority. Withdrawing consent does not affect processing already carried out.

Changes and contact

We will keep this page current as Confetti changes. For changes that meaningfully affect your privacy or rights, we will give reasonable notice and request a choice where required. Contact hey@confetti.so with privacy questions or requests.