1. Who is responsible for your data

The data controller for the account data described below is Jeremy Lightsmith. You can reach us about any privacy matter at jeremy.lightsmith@gmail.com.

When you, as a coach, store information about your own clients in Throughway, you are the controller of that information and we act as a processor on your behalf, processing it only to provide the service to you and only on your instructions.

2. What we collect

Account data. When you sign in with Google we receive your name, email address, and Google account identifier. We use this to create and identify your account.
Content you create. Information you enter into Throughway — clients, sessions, notes, goals, and action items — including any personal details about your clients that you choose to record.
Google Calendar data. With your permission, we read events from the Google Calendar of the Google account you connect from Settings › Connections, so we can match a session to the calendar event it belongs to. Signing in with Google does not by itself give us calendar access. This access is read-only — we never create, change, or delete calendar entries. We store only the identifier of the matched event and the meeting code needed to retrieve its transcript.
Google Meet transcripts. With your permission, and only where transcription was turned on during the meeting, we read the transcript of a Google Meet session you took part in and store it against that session in Throughway so it sits alongside your notes. This access is read-only. We do not access recordings, and we cannot start, stop, or alter a meeting.
Zoom cloud-recording transcripts. With your permission, we read the transcript file of cloud recordings of Zoom meetings you hosted that your calendar matched to a session, and store it against that session in Throughway. This access is read-only: we don't download audio or video, and we can't start, join, or record a meeting. We store your Zoom user ID and email address and the OAuth tokens Zoom issues (encrypted). Removing the Throughway app in Zoom deletes those credentials; transcripts already attached to your sessions stay with your session records.
Gmail data. Sending mail and reading mail are two separate permissions, and signing in with Google gives neither. You grant sending the first time you send an email from Throughway, and reading from Settings › Connections. Sending: we send from your own Gmail account, so the message lands in your Sent folder and threads normally — the message you typed goes to Google to be delivered. There are no tracking pixels and no open or click tracking, and anything you attach travels as a link, not as a copy of the file. Reading: we look at a message's addresses first, and fetch its contents only when one of them matches an address on one of your client records. Drafts are never read. Reading starts at the moment you connect and only moves forward; a catch-up searches for each client address on its own and reaches back twelve months — further only if you ask us to, per client, from that client's Timeline. Older mail outside that catch-up is never listed or read. Delivery-failure notices are read so we can tell you a message bounced, and are never filed. What we keep: for a matched message, its sender and recipients, subject, date and text, shown on that client's Timeline — and its attachments, saved as that client's private files.
Google Drive files you pick. When you attach a file from Google Drive, you pick it in Google's own file picker, and the permission we ask for reaches only the files you picked there — never your whole Drive, and never a file you have not chosen. For a picked file we read its name, type, owner and sharing settings, so the attachment shows correctly and we can tell you whether your client can already open it. We store the file's name and a link to it, and nothing else: we never download, copy, or store the file's contents — the file stays in your Drive. If you press Give viewer access, we ask Google to add your client's email address as a viewer on that one file. That happens only when you press it, only on a file you picked, and it is the only change Throughway ever makes inside your Drive.
Auto supervision. When you choose to run auto supervision on a session, we send that session's transcript and the notes you wrote to Anthropic, which operates the AI model that writes the reflection. We store the conversation against that session from your first message, and the reflection when it arrives — both encrypted at rest and visible only to you. Untick keep, or delete the auto supervision, and both are removed and we store nothing.
Technical data. A session cookie that is strictly necessary to keep you signed in, and basic server logs (such as IP address and timestamps) used for security and to keep the service running reliably.

We do not collect special-category data, we do not use tracking or advertising cookies, and we do not build advertising profiles.

3. Why we use it, and our legal basis

To provide and secure the service and let you sign in — performance of our contract with you and our legitimate interest in keeping the service safe.
To process the client information you enter — on your instructions as our customer (performance of contract), with you as the controller of that data.
To keep minimal security logs and prevent abuse — our legitimate interest in protecting the service and its users.
To run the Google features you connect — sending and filing your mail, and attaching and sharing the Drive files you pick — on your instructions as our customer (performance of our contract with you).

4. Who we share it with

We never sell your personal data, names, email addresses, or any other information, and we never share it for advertising. We share data only with the service providers strictly needed to operate Throughway, and only so they can perform services for us:

Google — for sign-in, and (with your permission) as the source of the Calendar, Meet transcript, Gmail, and Google Drive data described above. Most of that is data we read from Google. What we send: an email you send from Throughway, which goes to Gmail to be delivered from your own account; your client's email address as a search term, when the catch-up looks for their mail; and — when you press Give viewer access — your client's email address again, which we add as a viewer on the one Drive file you picked.
Anthropic — the AI model provider behind auto supervision. Anthropic does not retain the transcript or the report after returning its response, and does not use either to train its models. Content flagged by Anthropic's automated safety systems may be retained by them for up to two years.
Fly.io — our hosting and managed database provider, which stores the application data.

These providers act as our processors under contractual data-protection terms. We may also disclose data if required by law, or to protect the rights, safety, and security of our users and the service.

Throughway's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google Calendar, Google Meet, Gmail, Google Drive, and Zoom data only to provide the features described in this policy. We do not use it for advertising, we do not sell it, we do not transfer it to others except as needed to provide those features or as required by law, and we do not use it to develop, improve, or train generalized artificial intelligence or machine-learning models.

You can withdraw Throughway's access to your Google data at any time from your Google account permissions page. Doing so stops all future calendar, transcript, mail, and Drive access. You can also turn email off on its own from Settings › Connections.

5. International transfers

Our infrastructure is hosted in the United States. Where personal data is transferred outside the EEA or the UK, that transfer is covered by appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK Addendum where applicable).

6. How long we keep it

We keep your account data and content for as long as your account is active. If you ask us to delete your account, we delete your account data and the content you have stored within a reasonable period, except where we are required to retain limited information to comply with a legal obligation. Security logs are kept only for a short period.

Turning email off in Settings › Connections stops Throughway reading or sending your mail and deletes every message that sync filed onto your clients' Timelines. Google keeps listing Throughway's access until you remove it on your Google account permissions page. Emails you sent from Throughway stay, as your record of what you sent. Files that arrived as attachments stay too — once saved they are that client's files like any other, and they go when you delete them or delete your account. Revoking Drive access stops all further access to the files you picked; their links stay on the client record, and the files themselves were never ours to delete — they are and remain yours, in your Drive.

7. Your rights

If you are in the EU or UK, you have the right to:

access the personal data we hold about you;
have inaccurate data corrected;
have your data erased ("right to be forgotten");
restrict or object to certain processing;
receive your data in a portable format;
withdraw consent at any time, where processing is based on consent.

To exercise any of these rights, email jeremy.lightsmith@gmail.com. You also have the right to lodge a complaint with your local data-protection supervisory authority.

8. Security

We use industry-standard measures to protect your data, including encryption in transit (HTTPS) and access controls that limit data to your own account. No system is perfectly secure, but we work to protect your information and limit what we collect in the first place.

9. Children

Throughway is intended for use by coaches and is not directed at children under 16. We do not knowingly collect personal data from children.

10. Changes to this policy

We may update this policy from time to time. When we do, we will revise the "Effective" date above and, for material changes, take reasonable steps to let you know.

11. Contact

Questions about this policy or your data? Email jeremy.lightsmith@gmail.com.

Privacy Policy