This is the pilot's notice. It describes exactly what the system does today.
Only what you connect or send. With your permission, your Gmail and your Google calendars, to find what schools and clubs send about your children. Anything you forward to your household's address or photograph for it. And what you write to it, in the app, on WhatsApp or on Telegram.
Reading your Gmail is one permission. Sending from it is a separate one you may never give. If you do, Toole sends only a reply you approved, or a fixed reply you told it needs no asking.
The dates, deadlines and things to do that it finds, with the words each one came from, so you can see why it is there. The facts you tell it about your children, such as their school. Your messages to it. An email with nothing in it for your family is read and let go: its text is not kept.
Some things are kept only for a while. A form it prepared or a photograph you sent, sixty days. A draft reply, a call's transcript and what was said to a company, thirty days. Pictures of a web page it worked on, fourteen days.
Google, for your own accounts. Our database and hosting providers. The AI models that read your mail, which we reach through OpenRouter and only at providers that keep nothing afterwards (zero data retention) and never train on what they see. Resend, which sends our emails. Meta, if you talk to Toole on WhatsApp, and Telegram, if you use it there: messages on those services pass through them. If you ask it to use a website, Browserbase runs the browser. If you ask it to ring someone, Vapi and the phone network carry the call, and the call opens by saying it is an AI. If you ask it to email someone, the email leaves from your assistant's own address at AgentMail, never from yours, and only after you have read every word and said yes. AgentMail holds that inbox and the answers to it until your household is deleted, and Toole keeps their words for thirty days.
Some companies let an assistant like Toole work with them directly. When you check one, Toole asks the company's website how. When it acts for you there, it says it is an AI acting for one of its users, under an ID it made for that company alone: the company can tell it is the same person each visit, even before you sign in, but the ID means nothing anywhere else, so companies cannot match you up. Signing in links those visits to your account there. You sign in yourself, on the company's own page, and choose what Toole may see or change; Toole never sees your password. Signing out in the app ends that access at once.
It never sells your data, never uses it for advertising, and never lets a model provider train on it. It never signs anything on your behalf and never sees a card number. Nothing is paid without your yes. On a website you pay yourself. A company that works with Toole directly may charge the card it already holds only after your yes, and only once you have set a monthly limit, which starts at nothing: to the exact amount, within that limit, when it states its price first, and otherwise on a card that tells you it may cost money, only at a company that promises to send its price first.
Any adult in the household can ask for everything to be deleted from settings. After a short grace period, so that a mistaken tap can be undone, it is all erased. You can stop it reading at any time with pause.
Write to us by replying to any email we have sent you.