What we collect, what we read, what we do.

• Subjects, participants, dates, and the text of each message (without the earlier messages a reply quotes), plus the text of PDF, Word and plain text attachments. Images and other attachments are not downloaded.
• Anything that looks like a card number or a credential is replaced before it is stored. Only accounts we add as test users can connect it while the app is in Google's Testing mode and verification has not been submitted.

• File names, types, owners, the last person to modify each file, modification times, and the text of Docs, Sheets (every sheet), Slides, PDFs, Word and plain text files, so an answer can quote the file it came from.
• Images, video and files over 10 MB are not read, and each one is listed as left out. Revision history is never read. Same Testing-mode limitation as Gmail.

Event titles, times and attendees. Same Testing-mode limitation as Gmail.

Campaigns and each closed day's spend and results; business locations, their public reviews and the names reviewers show. Neither reads until Google approves access for our project.

• Outlook mail: subjects, participants, dates, and the text of each message (without the earlier messages a reply quotes). Anything that looks like a card number or a credential is replaced before it is stored.
• Attachments are not read, and each message that has them is listed as left out.
• OneDrive and SharePoint: file names, the people who created and last edited each file, modification times, and the text of Word files, workbooks (every sheet), PDFs and plain text files, so an answer can quote the file it came from.
• Images, video, presentations and files over 10 MB are not read, and each one is listed as left out. Calendar events and attendees; the contacts folder.
• Nothing is written back, and who in your workspace reads a message or a file follows who Microsoft says can open it.

Page posts, comments and reviews with the names Meta shows; Instagram business media and comments; ad campaigns and each closed day's spend and results. Until Meta's App Review passes, only accounts with a role on our app can connect them.

Contact, company, lead and account records and the state of deals and opportunities. Nothing is written back to either.

Customer records, invoices and payments, with amounts and due dates. Real companies connect once Intuit's app review is passed; until then only sandbox companies do.

Exactly the fields your workspace mapped when it set the source up: from an API you point us at, a file you upload, one SELECT against a Postgres database, or records your system sends with a token for that one source.

Messages exchanged with your customers on channels you connect, and the phone number, chat id or visitor identity they arrive with.

• An assistant a member connects (Claude, ChatGPT, Cursor and others) reads the Brain with the scopes on that member's key, and what it reads goes to that assistant's vendor under the member's own account with them.
• If the key allows writing, it can add only memories that name an existing entity and carry evidence. An owner or admin can see every call and switch every assistant off.

Nothing. A source that is not connected is not read, and there is no discovery of systems you did not name.

At myaccount.google.com/permissions, remove OnDuty. Google stops honoring our access at once, and the connection shows as needing to be reconnected.

• From Brain, Sources, an owner, admin or operator disconnects it and chooses to keep what was learned. We tell Google to revoke OnDuty's access, delete the stored credential and the sync state at once, and nothing more is read.
• If Google cannot be reached, the credential is deleted anyway and the page says the revocation did not go through.
• When one Google account is connected as more than one source (Gmail and Drive, say), Google's permission is revoked when the last of them is disconnected.
• Microsoft gives an app no way to revoke its own access, so for Outlook, OneDrive and SharePoint the credential is deleted and the page tells you to remove OnDuty at myapps.microsoft.com or ask your Microsoft 365 admin.
• Records already derived from it stay in the workspace, marked as no longer connected, until you erase them with the next option.

• From the same button, an owner or the person who connected the source chooses to erase.
• We do everything above and also delete the source's documents and passages, its numbers, the record of who may read what, and the memories, signals, insights and people that only that source supports.
• A record another source also supports stays and loses only this source's mark. A large source is erased in the background, and the page shows the final count of what was deleted.
• The activity log and the audit trail keep a record that it happened, with those counts and none of what was erased.

• Write to daniel@alwaysonduty.io from the account that connected the source, naming the source or saying all of them, if you cannot sign in or want something the buttons do not do.
• We erase the records, memories and search entries derived from it, or all of your Google data, and confirm by email within thirty days, usually much sooner. Erasing a person from their entity page is also available to owners.

Everything the Brain holds about a person or company is on that entity's page, with the source of each record.

• Tells the provider to end OnDuty's access where the provider allows that, and deletes the credential and the sync state at once.
• You choose whether the knowledge already derived stays, attributed to that source and marked as no longer connected so a conclusion never loses its provenance, or is erased with it, with a count of what was deleted.

• A member can be removed by an owner or admin.
• An owner can delete the workspace, which closes it at once to its members and to the assistants they connected, revokes each connected source at its provider, and erases in the background what those sources brought in, the Brain's records and the customer conversations.
• The workspace record, its members, the activity log, the audit trail and the billing record are kept until you ask us to erase them.

• From a person's entity page, an owner can download everything the Brain holds about them, or erase it. A customer is matched on phone or email, never on name.
• Erasure takes their conversations with it, and the documents, passages, numbers and chat messages that connected sources stored about them: a document is theirs when they are the only person it is linked to, and one that names several people stays whole without them on its list.
• It keeps the activity log and the audit trail, and says so.

From your sessions list, any device, at any time.

For a copy, a correction or a deletion of anything about you that the workspace cannot do itself, write to us. We answer within thirty days and usually much sooner.