Privacy Policy
Effective date: 28 October 2026
This policy explains what information YomanAI collects, what it does with it, who else handles it, how long it is kept, and how you can control or delete it. It covers people who sign in to YomanAI and people who are invited to a meeting through it.
Google user data and Limited Use. YomanAI's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of information received from Google Workspace scopes will adhere to the Google Workspace API User Data and Developer Policy, including the Limited Use requirements.
1. Who we are
YomanAI is a meeting-scheduling assistant available at https://yomanai.app. It is operated by Gal Gorodeisky, an individual ("we", "us"), who is responsible for the personal information described here. You can contact us at any time; the address is in section 14.
2. The short version
- You sign in with a 6-digit code that we email to your address. No password, and no Google account is needed to sign in. We receive your name and email address.
- Only if you choose to connect a Google calendar, and with your permission, YomanAI reads only whether you are busy or free in your Google Calendar, to suggest meeting times, and creates events on your own calendar, for meetings you ask it to arrange.
- You may instead, or as well, connect a Microsoft Outlook calendar. Microsoft offers no narrower permission than "read and write your calendars", so that is what YomanAI asks for, but it uses it only to read whether you are busy or free and to create, update and cancel the meetings you ask it to arrange (section 4.1).
- We never read the titles, descriptions, attendees or locations of your existing calendar events.
- Only if you also allow it, when you ask YomanAI to arrange a meeting with someone without giving their address, YomanAI searches your Google contacts for that name and shows you the matches. With a connected Outlook calendar, it searches your Outlook contacts and the people you communicate with the same way (section 4.1). Nothing is sent to anyone until you confirm the address.
- YomanAI has no access to your Gmail and does not request any Gmail permission. Messages to the people you invite are sent from YomanAI's own address at yomanai.app.
- Scheduling conversations are processed by AI models running on Amazon Bedrock in AWS's European Union regions. Your data is not used to train AI models — not by us, not by AWS, and it is not sent to the company that makes the model.
- We do not sell your data or use it for advertising. Our website uses Google Ads conversion tracking to measure how well our own ads work (section 3.5).
- You can disconnect a calendar from YomanAI at any time, in the app or from your Google or Microsoft account, and you can delete your account and everything in it yourself, in the app, or email us to do it for you.
3. What we collect
3.1 When you sign in, and from your Google account if you connect a calendar
You sign in with a code that we email to your address. An account can hold several email addresses, which you add in Settings, each confirmed with a code emailed to it.
| What | Why |
|---|---|
| Your name and your email address, and any further addresses you add | To create your account, show you who is signed in, recognise mail from you, and address messages we send you |
| The sign-in code we email you, which is valid only briefly | To check that the address is really yours |
Google is used only if you choose to connect a calendar. You can connect more than one Google account's calendar, and, when connecting, you may also allow YomanAI to search that account's contacts (section 4). Then we also receive:
| What | Why |
|---|---|
Your name and email address on the Google account (Google permissions userinfo.profile, userinfo.email, openid) |
To tell which Google account a connected calendar belongs to |
| Your Google account ID | To recognise that account the next time you connect it |
| Whether Google has verified the email address | To make sure the calendar belongs to the account it says |
| OAuth access and refresh tokens | To call Google Calendar (and, if you allowed it, search your contacts) on your behalf, as described in section 4, including while you are not using the website — for example when a meeting you asked for is agreed |
If you choose to connect a Microsoft Outlook calendar instead, or as well, Microsoft is used in the same way, and we receive your name and the email address of the Microsoft account, its Microsoft account ID, and OAuth access and refresh tokens, for the same purposes (section 4.1).
3.2 From your calendar
See section 4 for exactly what we access and what we don't.
3.3 What you give YomanAI when you schedule a meeting
The details of the meetings you ask YomanAI to arrange: the subject, duration, the times you offer, the names and email addresses of the people you want to meet, and the messages you exchange with the assistant.
3.4 About people you invite
YomanAI contacts the people you invite by email. They do not sign in and do not give YomanAI any access to their Google accounts or calendars. For each invited person we hold the name and email address you gave us, the messages they send the assistant about the meeting, and the times they say work for them. Only you, the person who organised the meeting, see an invitee's answers; other invitees never do.
YomanAI also remembers a few things about each person you invite, for you alone: their language, their time zone, how they are addressed (for example, as "he" or "she"), and how you asked to be introduced to them. It uses them in your next meetings with that person, so you need not say them again. No other user's meetings use them.
3.5 Technical information
When you sign in or ask for a code we record the time, your IP address and your browser's user-agent string, for
security (detecting misuse of an account) and troubleshooting. YomanAI uses two cookies, both
strictly necessary for the service: session_token, which keeps you signed in and expires after 30
days without use, and oauth_state, which protects the step of connecting a Google calendar against forgery and expires after
10 minutes.
Our website also loads Google's ad tag (Google Ads conversion tracking), which sets Google's cookies in your browser, to measure how well our own ads work: when a visitor who came from one of our ads signs up, or opens the demo email from the homepage, Google counts it as a conversion of that ad. For a sign-up we send Google a random account number, never your name, email address or anything about your meetings or calendar. Google handles this under its own privacy policy, and you can turn off personalised ads at Google's ad settings or block the tag with your browser or an ad blocker; YomanAI works the same without it. We use no other advertising or analytics cookies.
Our homepage is published in English and in Hebrew. If you switch between them, or decline the offer to switch, your browser remembers that one choice in its local storage so that we do not ask again. It records a language and nothing else — no identifier — and it is never sent to us.
4. Google Calendar and contacts: what we access, and what we don't
Everything in this section applies only if you choose to connect a Google calendar; YomanAI works without one. It asks for two Google Calendar permissions, and, if you allow it, two contacts permissions, and we use each one only for the purpose below. If you connect more than one Google account, the same applies to each of them: "your primary calendar" means the primary calendar of each Google account you connect, and your busy times are combined across them.
See your availability (https://www.googleapis.com/auth/calendar.freebusy). This permission
returns only the start and end times of the periods when your primary calendar is busy. It cannot
reveal what those events are. YomanAI uses it, when you ask YomanAI to arrange a meeting, to find
the times when you are free so that it can propose them to the people you invite.
Busy and free times are fetched from Google when they are needed; we never keep a copy of your calendar. When the assistant looks at your busy times to suggest meeting times, the times it looked at, and anything it tells you about them, become part of that scheduling conversation and are kept and deleted with it (section 10). We also store the result of your scheduling: the time windows that were proposed for a meeting and the time that was finally agreed.
Create events on your calendar (https://www.googleapis.com/auth/calendar.events.owned). YomanAI uses
this permission when a meeting you asked YomanAI to arrange has been agreed, to create that meeting
as an event on the primary calendar of the Google account you chose for it (or of your default
one), with the people you invited as guests. Google Calendar then
sends them the invitation, as it does for any event you create yourself. YomanAI may later update or
cancel an event it created, if you change or cancel that meeting.
We store the ID and link of each event YomanAI creates, so it can update that event and show it to you. We do not read, change or delete any other event in your calendar, and we do not access calendars other than your primary calendar.
Find the people you name (https://www.googleapis.com/auth/contacts.other.readonly and
https://www.googleapis.com/auth/contacts.readonly). These permissions are optional: you can leave
them unticked on Google's screen, and your calendar is connected exactly the same. Only when you ask
YomanAI to arrange a meeting with someone without giving their address, YomanAI searches your Google
contacts and your "Other contacts" (the people you have emailed) for that name, and shows you the
matches: their names and email addresses, nothing else about them. Nothing is sent to anyone until
you confirm the address. We never keep a copy of your contacts: the matches are kept only with that
conversation (the assistant's history of it, and the records of what was sent to the AI model and
what it answered) and are deleted with it (section 10). The address you confirm becomes an invitee
of that meeting, like one you typed yourself.
We do not use your Google data for anything else. In particular, we do not use it for advertising, do not sell it, do not use it to build profiles of you, and do not use it to train or improve AI or machine-learning models. YomanAI's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
4.1 Microsoft Outlook calendar
Everything in this subsection applies only if you choose to connect a Microsoft Outlook calendar; it is
separate from, and does not change, what is said above about Google. When you connect, YomanAI asks
Microsoft for permission to read and write your calendars (Calendars.ReadWrite), because Microsoft
offers no narrower permission for creating events, together with the basic permissions that identify
your Microsoft account (openid, profile, email, User.Read) and offline_access, which lets YomanAI
keep working while you are not using the website. It also asks for two permissions to find the people you
name (People.Read and Contacts.Read), described below.
YomanAI uses that access only to read whether you are busy or free, and to create, update and cancel the meetings you ask it to arrange. We never read the titles, descriptions, attendees or locations of your other events, and never change or delete them. We do not keep a copy of your calendar; we store the ID and link of each event YomanAI creates so it can update that event. The rest of this policy, including the promises that we do not sell your data, use it for advertising or use it to train AI models, applies to it equally.
Your Microsoft access and refresh tokens are encrypted before they are stored. When you disconnect the calendar, or delete your account, we delete them immediately. Microsoft offers no way for us to revoke the access on your behalf, so to remove YomanAI's access at Microsoft as well, open your Microsoft account's app permissions (for a personal Microsoft account, account.live.com/consent/Manage); after you disconnect, the app shows you the right link. If your organisation requires it, a Microsoft 365 administrator must approve YomanAI once before anyone in the organisation can connect. Microsoft provides your calendar and your account: it is your own provider, not a company that processes data for us.
Find the people you name in Outlook (People.Read and Contacts.Read). Only when you ask YomanAI to
arrange a meeting with someone without giving their address, YomanAI searches your Outlook contacts and
the people you communicate with (Microsoft's list of the people most relevant to you) for that name, and
shows you the matches: their names and email addresses, nothing else about them. Microsoft offers no way to
search Outlook contacts by name, so for that search YomanAI reads the names and email addresses in your
contact list during that search only, and keeps none of it. Nothing is sent to anyone until you confirm the
address. As with Google, the matches are kept only with that conversation and are deleted with it
(section 10), and the address you confirm becomes an invitee of that meeting, like one you typed yourself.
5. How we use information
We use the information above only to:
- run the scheduling features you use — proposing times, contacting the people you invite, collecting their answers, reporting back to you, and putting agreed meetings on your calendar;
- keep your account secure and prevent abuse of the service;
- find and fix problems when something goes wrong; and
- meet our legal obligations.
We send you emails about your meetings and your account (for example, if your calendar connection stops working). We do not send marketing email.
6. AI processing and the companies that help us
6.1 How the AI assistant works
YomanAI's assistant is powered by large language models (Anthropic's Claude models) that we access through Amazon Bedrock, a service of Amazon Web Services (AWS). When you or someone you invited writes to the assistant, the text of that message and the details of the meeting it concerns are sent to Amazon Bedrock so the model can understand the message and write a reply. When YomanAI proposes times based on your calendar, the free and busy periods it uses may be part of that request, and so may the names and addresses it found when it searched your contacts for someone you named. Each person's conversation with the assistant is handled separately, and the assistant never passes one invitee's messages on to another invitee.
We use Amazon Bedrock's European Union cross-region processing, which keeps processing within AWS regions in the EU.
6.2 No AI training
Your data — including anything received from Google — is not used to create, train or improve any AI or machine-learning model, by us or by anyone else. Under AWS's terms for Amazon Bedrock, AWS does not use the prompts and responses to train models, and the model provider (Anthropic) has no access to them.
6.3 Who we share information with
We share personal information only with the following, and only as needed to run YomanAI:
| Who | What they do | What they receive |
|---|---|---|
| Amazon Web Services (EU regions) | Hosts our servers and database, delivers the website, and runs the AI models (Amazon Bedrock) | Everything YomanAI stores, and the content of scheduling conversations for processing |
| Resend (United States), our email delivery provider | Sends YomanAI's emails and receives the replies; we fetch each reply from Resend | The email addresses and content of every email YomanAI sends and receives. Resend keeps a copy of each, addresses included, for 30 days in the United States |
| Your calendar | The events YomanAI creates on your calendar, including the guests' email addresses | |
| Google Ads | Measures our own ads (section 3.5) | Through its tag on our website: Google's cookies, and for a sign-up a random account number |
| The people you invite | Receive messages about your meeting | Your name, the meeting's subject and duration, the times on offer, and the names of the other invitees. Invitees' contact details and the final invitation are shared the same way any calendar invitation shares them |
These providers act on our instructions and may not use the information for their own purposes, except Google Ads, which handles its cookies under its own privacy policy (section 3.5). We will also disclose information if the law requires it, or where necessary to investigate security problems or abuse. If YomanAI is ever transferred to someone else, we will ask for your consent before any Google user data is transferred.
We never sell or rent personal information, and we never transfer Google user data to advertising platforms, data brokers or information resellers, or use it to decide credit-worthiness or for lending.
7. Who can see your data
Your data is processed automatically. We (the operator) can view meeting records and scheduling conversations only when needed to provide support you ask for, to investigate a bug, security incident or abuse, or to comply with the law. We do not look at your Google Calendar data unless you explicitly ask us to in order to help you, or it is necessary for security reasons or required by law.
8. Your choices and controls
- Stop your assistant. On your Settings page, choose Stop my assistant. Nothing is sent and nothing is answered until you choose Resume; then everything held goes ahead.
- Disconnect a calendar. On your Settings page, next to the calendar, choose Disconnect. This revokes YomanAI's access at Google for that calendar and deletes the access tokens we store for it. You stay signed in. After that YomanAI cannot read that calendar's availability or create events in it until you connect it again. For a Microsoft Outlook calendar, we delete the tokens, and the app then shows you where to remove YomanAI's access at Microsoft too (section 4.1).
- Remove access from Google. You can also remove YomanAI at any time from your Google Account at myaccount.google.com/permissions. YomanAI will notice and stop using its stored tokens.
- Delete your account. On your Settings page, choose Delete my account. This revokes YomanAI's access at Google (for a Microsoft Outlook calendar, it deletes the tokens; see section 4.1) and deletes your account, your tokens, and your meeting records and conversations immediately. It can't be undone, and the people you invited are not notified. Or email us from the address you sign in with and ask us to delete your account; we will delete the same things within 30 days and confirm when it is done. Either way, meetings other people invited you to stay theirs, with your details removed from them.
- Access or correct your data. Email us and we will send you a copy of the personal information we hold about you, or correct it.
- If you were invited to a meeting and want your information removed, email us from the address YomanAI wrote to, and we will delete it within 30 days.
Depending on where you live (for example in the European Economic Area or the United Kingdom), you may have further rights, including to object to or restrict our processing, to data portability, and to complain to your local data protection authority. We rely on the following legal grounds: for account holders, providing the service you asked for; for the Google Calendar access, the permission you give on Google's consent screen, which you can withdraw at any time as described above; and for people you invite, our legitimate interest in arranging the meeting you asked us to arrange.
9. Security
- All connections to YomanAI use HTTPS.
- Google and Microsoft access and refresh tokens are encrypted before they are stored, and the encryption key is held in AWS's managed secrets service, separately from the database.
- Our database is hosted by AWS and encrypted at rest.
- The AI models never receive your Google or Microsoft tokens and cannot call Google or Microsoft on their own; only the part of YomanAI that manages your account talks to them, and only in the ways described in section 4.
No system is perfectly secure. If a security incident affects your personal information, we will tell you without undue delay.
10. How long we keep information
| Information | How long |
|---|---|
| Your account (name, email addresses) | Until you delete your account in the app (deleted immediately) or ask us to by email (deleted within 30 days) |
| Google account ID, and Google access and refresh tokens | Until you disconnect that calendar, remove YomanAI from your Google Account, or delete your account; then deleted immediately |
| Microsoft account ID, and Microsoft access and refresh tokens | Until you disconnect that calendar or delete your account; then deleted immediately |
| Busy and free times from your calendar | No copy of your calendar is kept. Busy times the assistant looked at while arranging a meeting are part of that meeting's scheduling conversation, and are kept and deleted with it |
| Names and addresses found in your Google or Outlook contacts | No copy of your contacts is kept. The matches a search found are part of your conversation with the assistant, and are kept and deleted with it |
| IDs and links of events YomanAI created | As long as the meeting record they belong to |
| The words of scheduling conversations: the messages you, your invitees and the assistant wrote, the assistant's history of each conversation, and records of what was sent to the AI model and what it answered | While the meeting is being arranged, then deleted 30 days after its conversations close. They close when the meeting is cancelled or expires, or a day after a booked meeting ends. A message still waiting to be sent is kept until it has gone |
| Your own conversation with the assistant, where you set up meetings | Deleted after 30 days with no new message from you, once every meeting set up in it has closed |
| Meeting records: subject, participants' names and email addresses, time, status, the times offered and each invitee's answers, and the log of emails sent | Deleted 90 days after the meeting is scheduled, cancelled or abandoned |
| Reports that an email bounced or was marked as spam | The subject is removed after 30 days; the report is deleted after 90 days |
| What YomanAI remembers about the people you invite (section 3.4) | Until you delete your account, or that person asks us to delete their information |
| A one-way code (a hash) of each address that bounced, complained or unsubscribed, never the address itself | Kept, so that YomanAI never writes to that address again |
| Sign-in records (time, IP address, browser) | 90 days |
| Server logs | 14 days |
| Backups | Deleted information may remain in encrypted backups for up to 35 days before it is overwritten |
| Copies of emails, addresses included, held by our email delivery provider, Resend | 30 days, in the United States, then deleted by Resend |
Events YomanAI created on your Google Calendar stay there until you delete them; they are part of your calendar, not our database.
11. Where your data is stored
YomanAI's servers, database and AI processing are in AWS regions in the European Union. The website is delivered through AWS's global content-delivery network, so your connection may pass through AWS locations outside the EU on its way to our servers. Our email delivery provider, Resend, is the exception: it keeps a copy of every email YomanAI sends and receives, addresses and content included, for 30 days in the United States, and replies to YomanAI are fetched from there. For that transfer we rely on appropriate safeguards such as the European Commission's standard contractual clauses.
12. Changes to this policy
If we change this policy, we will update the effective date above. If a change affects how YomanAI uses your Google data, we will tell you and ask for your consent before using your data in the new way.
13. Children
YomanAI is not intended for children and may not be used by anyone under 18.
14. Contact
Questions, requests or complaints about privacy: support@yomanai.app.