Privacy Policy
We are Nicolai Schmid and offer June, a personal agent that runs in web chat, the June mobile app, Slack, and connected tools such as Google Drive and GitHub.
To provide that service, we process personal data ranging from account details and session data to conversation content, attachments, and connector metadata. This page explains what we process, why we process it, which providers are involved, and what rights you have under the GDPR.
If you have questions about this policy, contact team@nicool.ai.
1. Data protection at a glance
Who is responsible for data collection?
Data processing on this website and within the June application is carried out by:
Nicolai Schmid
Viertelkamp 44
23611 Bad Schwartau
Germany
Email: team@nicool.ai
How do we collect your data?
We collect data when you register, sign in, connect a service, send messages, upload files, enable notifications, or interact with June through the web app, the mobile app, or Slack. Technical request data and product analytics events are also collected automatically when you use the site or the app.
What do we use your data for?
We use personal data to run the service, maintain account and session state, process messages and files, operate connected tools, respond to support requests, secure the platform, and improve reliability.
What rights do you have?
You can request access, correction, deletion, restriction, portability, objection, or withdrawal of consent at any time. The full list appears in section 12 below.
2. Personal data categories overview
| Category | Examples | Shared with |
|---|---|---|
| Profile and contact details | Name, email address, profile image, and account identifiers. | WorkOS, Convex, Vercel, PostHog (user id, email, and name once you sign in). |
| Account and authentication data | Sign-in credentials handled by WorkOS AuthKit, session cookies and tokens, login timestamps, and verification state. | WorkOS, Convex, Vercel. |
| Conversation and memory data | Messages, attachments, conversation titles, runtime context, and contact memory. | Convex; a Redis instance for in-flight streaming state; and, when needed to answer a request, the AI model provider behind your connected inference account (OpenAI or Anthropic) or the Vercel AI Gateway. |
| Inference account data | Encrypted OAuth tokens for the ChatGPT/Codex or Claude account you connect, the provider account identifier, and quota state. | Convex, OpenAI, Anthropic. |
| Connected service data | Slack workspace, user, and bot identifiers and message payloads; Google Drive OAuth tokens and mounted file metadata; Gmail OAuth tokens; Microsoft 365 OAuth tokens held by the Executor credential vault and the account's sign-in name from health checks; GitHub OAuth tokens and the account login they act as; X account identifiers and OAuth tokens; Notion workspace identifiers and OAuth tokens; Google Search Console OAuth tokens and the number of properties the account sees from health checks; Google Calendar OAuth tokens and the name of the account's main calendar from health checks; Google Contacts OAuth tokens and the number of contacts the account holds from health checks; ownCloud server URL, username, and app password; IMAP mailbox host, username, and app password, plus the addresses and domains you declare for it; Tailscale auth keys and node state; MCP server URLs and bearer tokens; SMTP credentials for outbound email. Mail, Teams messages, calendar entries, contact details and file contents June reads from a connected mailbox, Microsoft 365 account, Google Calendar or Google Contacts during a turn become part of that conversation: they are sent to the inference provider that answers it, stay in June's execution log with the rest of that turn's tool results, may be distilled into June's memory by the background memory review, and may reach the Vercel AI Gateway through embeddings and auxiliary model calls. Data read in a turn may therefore persist in the execution log and in memory; June does not mirror or sync your mailbox, Microsoft 365 account, calendar or contacts. | Slack, Google, Microsoft, GitHub, X, Notion, Convex, the inference provider and the Vercel AI Gateway for mail, Microsoft 365, Google Calendar and Google Contacts data read during a turn, and the ownCloud server, IMAP mail server, Tailscale tailnet, MCP servers, and SMTP server you configure. |
| Device and notification data | Expo push tokens, web push subscription endpoints and keys, platform, app variant, installation identifiers, and delivery status. | Convex, Expo, and your browser or operating system push service. |
| Technical and usage data | Browser type, operating system, request timestamps, referrer URL, basic error logs, product analytics events, error reports, and masked session replays. | Vercel, Convex, PostHog. |
3. Hosting and infrastructure
Vercel
We use Vercel to host the public website and application frontend. This includes request metadata and technical data needed to deliver the site securely.
Provider: Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA.
Convex
We use Convex for database, realtime state, and file storage. Account data, conversations, connector state, encrypted credentials, and attachments may be stored there.
Provider: Convex, Inc., San Francisco, CA, USA.
Redis
We use a managed Redis instance for short-lived state: streaming responses while they are generated and Slack conversation state.
Turso
We use Turso (libSQL) databases for data workspaces and for the registry that holds connected-integration state used by June's tools.
Vercel Sandbox
When June runs code or works with files on your behalf, that work happens in an isolated Vercel Sandbox. Files and context needed for the task are transferred into the sandbox for the duration of the run.
PostHog
We use PostHog for product analytics, error reporting, in-product support conversations, and session replay on the website, the dashboard, and the mobile app. We use PostHog's EU cloud region. Session replays mask all inputs and exclude chat content, attachments, and request URLs; on mobile, replay is enabled for a small sample and masks all text and images.
Provider: PostHog, Inc., San Francisco, CA, USA.
4. Authentication and account creation
June uses WorkOS AuthKit for sign-in. WorkOS hosts the sign-in flow and issues the session tokens that our Convex backend verifies.
When you create an account or sign in, we process your name, email address, profile image when provided, verification state, session data, and login timestamps. WorkOS handles sign-in credentials such as passwords; we do not store them.
Provider: WorkOS, Inc., San Francisco, CA, USA.
We also use technically necessary cookies or equivalent session state so authenticated areas such as the dashboard can function.
5. Our service — personal agent runtime
We process messages, conversation metadata, attachments, and contact memory to provide continuity across chats and channels. This may include user-supplied files and context derived from prior conversations.
To generate responses, relevant message content, context, and selected attachments are sent to the AI model provider behind the inference account you connect: OpenAI when you connect ChatGPT or Codex; Anthropic when you connect Claude. The OAuth tokens for that account are stored encrypted. If you have not connected an account, the same content goes to the default model served through the Vercel AI Gateway, which is currently an OpenAI model. Embeddings for memory recall and auxiliary model calls also go through the Vercel AI Gateway. We do this only to operate the service you requested.
If you connect one of the services listed in section 6, we process the identifiers, OAuth data or credentials, and content needed to complete the action you asked for. Credentials are stored encrypted. Without an explicit connection, June should not act in that system.
If you install the June mobile app or enable notifications in the browser, we store the device and notification data listed in section 2 and use it to notify you when a run finishes or a scheduled job runs. Mobile notifications are delivered through Expo's push service; browser notifications through your browser vendor's push service. You can disable notifications per device.
We keep data for as long as it is needed to operate your account and the service, unless legal obligations require longer retention. You can request deletion of your account and associated data by contacting us.
6. External processors and integrations
Depending on which channel or connector you use, personal data may be transmitted to third-party providers that are necessary to deliver the service.
These include Slack for workspace-linked conversations; Google for Drive files, Gmail, Search Console, Calendar and Contacts data; Microsoft for Outlook mail, calendar, Teams chats and OneDrive or SharePoint files; GitHub for repository access as the account you authorize; Notion for the pages and databases you share with June when you connect a workspace; X for account access and, on the Spark onboarding page, for reading the public posts of the account you connect; OpenAI and Anthropic for the inference account you connect and for the default model behind the AI Gateway; Vercel for the AI Gateway and sandboxes; Expo for mobile push delivery and app update checks on launch; PostHog for analytics and support; and the ownCloud server, IMAP mail server, Tailscale tailnet, MCP servers, and SMTP server you configure yourself. Mail, Teams messages, calendar entries, contact details and files June reads from a connected mailbox, Microsoft 365 account, Google Calendar or Google Contacts during a turn are handled like the rest of that conversation: they are sent to the inference provider answering the turn, stay in June's execution log with that turn's other tool results, may be distilled into June's memory, and may pass through the Vercel AI Gateway for embeddings and auxiliary model calls. Data read in a turn may therefore persist in the execution log and in memory.
Those providers process data under their own privacy terms in addition to ours.
7. Cookies
We use technically necessary cookies or equivalent session mechanisms required for authentication and secure operation of the application.
PostHog also stores an identifier in your browser and in the mobile app to attribute analytics events, error reports, and session replays to a device. Once you sign in, those events are attributed to your account (user id, email, and name).
We do not currently describe any advertising or marketing cookie use on June in this policy.
8. Server log files
Our infrastructure providers may automatically process technical log data such as request time, browser type, operating system, referrer URL, and similar operational metadata needed to keep the service stable and secure.
9. International data transfers
Where providers are based outside the EU/EEA, we rely on appropriate safeguards such as EU Standard Contractual Clauses, encryption in transit, data minimization, and provider contractual commitments where available.
10. Security
- Encryption of data transmission via TLS.
- Signature verification for inbound Slack webhooks.
- Connector and inference credentials encrypted at rest with versioned keys.
- Scoped account linking and role-based access control in runtime flows.
- Fail-closed access checks when role resolution or grants are missing.
- Concise operational logging for failures and denied access events.
- Secrets and tokens stored server-side and not exposed in client responses.
11. No automated decision-making
We do not use automated decision-making within the meaning of Art. 22 GDPR that has legal effect on you or similarly significant effect.
12. Your rights
- Right to information (Art. 15 GDPR)
- Right to rectification (Art. 16 GDPR)
- Right to erasure (Art. 17 GDPR)
- Right to restriction of processing (Art. 18 GDPR)
- Right to data portability (Art. 20 GDPR)
- Right to object (Art. 21 GDPR)
- Right to revoke consent at any time with future effect (Art. 7(3) GDPR)
To exercise your rights, contact team@nicool.ai. You also have the right to lodge a complaint with a competent data protection supervisory authority.
13. Changes to this privacy policy
We may update this privacy policy to reflect legal requirements, changes to June, or new integrations and processors. The latest version is always published at /privacy.
Last updated: 1 October 2026