Privacy Policy — Yuwi
Last updated: 22 August 2026
This policy covers Yuwi (wtf.yuwi.assistant), the assistant app.
It does not cover Yuwi Agent (wtf.yuwi.agent), which is a separate
application with a separate policy. Yuwi Agent can operate your phone on your
behalf; Yuwi cannot, and contains no ability to do so — there is no
accessibility service anywhere in the app, it never sees your screen, and it
never taps anything.
1. Who we are
Yuwi is operated by Shubh Ketan Agarwal Family Office LLP ("we", "us").
Contact: yuwi.developer@gmail.com
2. What Yuwi does, in one paragraph
Yuwi is an assistant that answers questions about your own Google account — your mail, calendar, files and contacts — and acts on them when you ask. To do that it needs access to that data, and it keeps a searchable copy of it on our servers so that questions about your history can be answered without asking Google for everything every time. This policy explains exactly what is held, where, and how to get rid of it.
3. Google user data we access
When you connect your Google account, Yuwi requests these scopes:
| Scope | What it allows | What Yuwi uses it for |
|---|---|---|
https://mail.google.com/ |
Full Gmail access, including sending and permanent deletion | Answering questions about your mail, searching your history, and performing mail actions you confirm (reply, forward, archive, label, delete, filters, vacation responder) |
calendar.readonly, calendar.events |
Read and write calendar events | Answering calendar questions; creating, changing and deleting events you confirm |
drive.readonly |
Read your Drive files | Searching your documents, and reading spreadsheets to calculate answers |
drive.file |
Write only to files this app created | Writing meeting-prep documents into your own Drive |
contacts |
Read and write Google Contacts | Creating and updating contacts you confirm |
Every action that writes, sends or deletes is shown to you first and runs only after you confirm it. Reading is not separately confirmed — that is what you connected the account for.
We request the full Gmail scope rather than a read-only one because the app sends replies, archives, labels and deletes mail on your instruction. If you only ever ask questions, nothing is written.
4. What we store, and where
This is the part most privacy policies are vague about, so it is set out in full.
On our servers:
- A search index of your Gmail, Calendar and Drive. Extracted text, sender and recipient addresses, subjects, filenames, dates and links back to the original item. This is a copy, it is durable, and it is what makes "find the lease Parth sent me" answerable. Each connected account has its own index directory, not a shared one with a user column.
- A Google refresh token, so the index can keep itself up to date when you are not using the app. It is encrypted at rest and never leaves our servers.
- Assistant memory — facts you tell it or it infers ("my landlord is Rajesh"), deadlines, lists, and commitments read out of your mail.
- Mail triage verdicts — for each new message, how urgent we judged it and why, so the app can show you what it decided not to interrupt you about.
- Your conversation with the assistant, and a record of actions it took.
- Generated analysis code for spreadsheet questions, so an identical question next week can reuse it.
- Your device notification token, timezone and settings.
On your device only:
- The wake word, and the offline speech model used to detect it. Wake-word detection runs entirely on your device and sends nothing anywhere. Audio is not recorded, not uploaded and not stored.
Never stored by us: your Google password, and payment details (we take no payments).
5. Who else sees your data
- Google (Gemini API) — the assistant's intelligence. Content relevant to your question — passages from your mail or documents, your question, your memory — is sent to Gemini to compose an answer. Spreadsheet calculations run as generated code inside Google's sandbox, not on our machines.
- Google (Gmail, Calendar, Drive, People APIs) — your own account.
- Deepgram — only if you use voice input. Audio you dictate is transcribed to text. This does not apply to the wake word, which never leaves the device.
- Firebase (Google) — sign-in, notifications and storage.
We do not sell, rent or trade your data, and we do not use it for advertising.
6. Limited Use
Yuwi's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically, and without exception:
- We do not use your Google data to train, fine-tune or improve any generalized AI or machine-learning model — ours or anyone else's.
- We do not use it for advertising, and we do not sell it.
- Humans do not read your Google data, except with your explicit permission for a support issue you raised, or where required by law.
7. Deleting your data
In the app: Settings → Your data → Delete.
- Everything stops immediately: syncing halts, the app stops answering, and background processing leaves your account alone.
- Your data is then deleted after 30 days. That window exists so an accidental deletion can be undone — not so we can keep using your data, which we do not.
- Restore is available in Settings throughout those 30 days.
- Choosing delete now skips the window.
Deletion removes, one by one: your search index and its backups, your stored Google token (which is also revoked at Google), your memory, commitments, deadlines and lists, your conversations, triage records, scheduled tasks and reminders, prep routines, stored analysis code, notification tokens and your profile.
If your Google connection stops working, we mark the account inactive, tell you once, and stop syncing. That is not a deletion and does not start the clock.
You can also revoke Yuwi's access at any time at myaccount.google.com/permissions. Doing so stops all access immediately; use the in-app deletion to remove what was already stored.
8. Security
Data is encrypted in transit (HTTPS) and encrypted at rest. The Google refresh token — the most sensitive thing we hold — carries a second layer of encryption on top of that, under a key kept separately from the data it protects.
We are a small operation. We do not hold a SOC 2 report or an ISO certification, and we would rather say so than imply otherwise.
9. Children
Yuwi is not intended for anyone under 16, and we do not knowingly collect their data.
10. Changes
Material changes will be announced in the app before they take effect. The date at the top always reflects the current version.
11. Contact
Shubh Ketan Agarwal Family Office LLP — yuwi.developer@gmail.com