POMET, INC.

Privacy Policy

Effective date: August 12, 2026 · Last updated: August 12, 2026

Pomet is built on a simple premise: what people share with you is personal. That extends to how we treat your data. This policy explains what we collect, who can see it, how we use it, and how we protect it. Plain language, no surprises.

What we collect

Sources of information

We collect personal information from the following sources: (a) directly from you, when you create an account, record a voice note, or contact us; (b) from your device, such as device type, operating system, and usage data; (c) from third-party authentication providers (Apple, LinkedIn), when you use their sign-in services; and (d) from a calendar account you choose to connect (Google, Microsoft, or your device’s Apple Calendar).

Account information

When you create a Pomet account, we collect your name, email address, and authentication details. If you sign in with Apple or LinkedIn, we receive only what those services pass to us, which is typically your name and email. We never see your Apple or LinkedIn password.

Voice notes and transcripts

When you elect to use Pomet to record a note about someone, we receive the audio you speak. That audio is transcribed in real time and processed to extract the details you want to remember. Audio is not stored. Instead, we retain the profile Pomet builds from it, as well as the original transcripts so Pomet can respond to specific questions from you about that person.

Voice recordings are classified as sensitive personal information under certain privacy laws, including the California Consumer Privacy Act (as amended by the CPRA). We process your voice recordings solely for the purpose of transcribing them into text so that Pomet can build and update your contact profiles. We do not store, sell, or share your voice recordings for any other purpose. Our legal basis for processing voice recordings is contract performance (GDPR Art. 6(1)(b)): transcription is a core part of the Pomet service you signed up for. California residents have the right to limit the use and disclosure of their sensitive personal information under CPRA § 1798.121.

Profile data about third parties

When you use Pomet, you enter information about other people: names, relationships, preferences, milestones, and other details from your personal and professional interactions. This data is entered by you and is never collected passively. Pomet does not independently verify or enrich the information users provide. Pomet is a personal briefing tool intended for private, individual use. Users are responsible for the information they choose to store in Pomet and should exercise discretion when saving sensitive personal details. Users must not store information obtained unlawfully or shared in violation of applicable law.

If someone believes a Pomet user has stored information about them and wishes to exercise their data protection rights, they can reach us at privacy@pomet.ai and we will take reasonable steps to address their request.

Children and Minors

Pomet is intended for users who are at least 18 years old. Users may choose to store limited information about minors — such as names, birthdays, schools, activities, or milestones shared during ordinary personal or professional interactions, but we do not knowingly permit minors to create accounts or use the service directly.

Device and usage data

We collect basic technical information to keep the app running — device type, operating system version, crash reports, and general usage patterns. This data is aggregated or deidentified and used only to improve the product. Crash reports are sent to a third-party crash reporting service and contain technical diagnostic information about the device and the state of the app, together with a pseudonymous account identifier — never your notes, transcripts, or profile content.

Subscription information

When Pomet becomes a paid subscription, purchases are made through the Apple App Store. Apple processes your payment; we never receive your card or payment details. We receive your subscription status — whether a subscription is active, which plan you are on, and when it renews — so we can give you access to what you paid for.

Calendar (optional)

If you connect a calendar, Pomet reads your upcoming events so it can help you prepare for and follow up on your meetings. We request read-only access. From a Google or Microsoft calendar we receive event titles, descriptions, times, locations, and attendee names and email addresses. From your device’s Apple Calendar we read the same event information already on your phone. Pomet never writes to your calendar, and you can disconnect a calendar at any time in Settings.

Waitlist and marketing

If you join our early access waitlist, we collect your email address. You submit it through a form on our website, and it is sent directly to Mailchimp, where it is stored and used for launch announcements, significant new features, and important product updates. Pomet does not keep a separate copy of the form submission. We’ll never sell your email address or share it with advertisers. You can unsubscribe at any time.

Feedback and support

If you send us feedback, a feature request, or a support message, we receive it and we read it — that’s what it’s for. These messages are separate from your notes and profiles: nothing you’ve stored in Pomet is attached to them unless you include it yourself. We use what you tell us to reply to you and to improve the product. Support messages and feature requests are sent through a third-party provider and recorded in our product issue tracker so we can respond to them and act on them.

Cookies and analytics

Our website is built and hosted on Ploy, which also provides our website analytics. When you visit pomet.ai we collect information about the visit — pages viewed, how you arrived, approximate location derived from your IP address, device and browser type, and interactions with elements on the page. This information relates to your visit to the website and is kept separate from your Pomet account. It is not used to identify you personally and is never used for advertising. Where required by law, we ask for your consent before placing non-essential cookies. You can withdraw consent or disable cookies in your browser settings at any time. Within the app, we use PostHog, a product analytics provider, to collect a limited, predefined set of usage events — such as whether key steps in the app complete successfully. These events never include your notes, transcripts, the names of the people in your profiles, or the text of your questions. PostHog operates as a data processor under our instructions and does not use this data for any independent purpose.

Who has access to it

You

Your data belongs to you. Your profiles are private to your account. Pomet is not a shared or collaborative tool — your colleagues, contacts, and other Pomet users cannot see your profiles.

Pomet employees

We never read your notes or transcripts. To understand how Pomet is used and to improve the product, we see only de-identified, category-level signals — for example, that a note contained a family detail or a work update — never your words and never the names of the people in your life. These signals are shown only in aggregate. Access to user content is technically restricted and limited to authorized personnel only when necessary for security, support, maintenance, or legal compliance.

OpenAI

Pomet uses OpenAI’s APIs to transcribe and process your voice notes. Under our signed Zero Data Retention agreement with OpenAI, voice notes sent for transcription are not retained for model training or long-term storage.

Supabase

Your structured profile data (the information you see on someone’s profile) is stored securely using Supabase, our database provider. Supabase operates as a data processor under our instructions and does not use your data for any independent purpose.

Apple and LinkedIn

If you use Sign in with Apple or Sign in with LinkedIn, those services authenticate your identity and pass your name and email to us. We do not share any Pomet data back to Apple or LinkedIn.

Mailchimp

Email addresses collected via our waitlist are stored in Mailchimp solely for product communications. Mailchimp does not receive any profile data or content from your Pomet account.

Our service providers

We work with a small number of service providers who process data on our behalf, and this list may change as the product grows. We keep a current list at pomet.ai/service-providers. The providers named in this policy are examples, not a complete list.

Legal and regulatory authorities

We may be required to disclose data to law enforcement or regulatory bodies if compelled by law. Where legally permitted and appropriate, we will notify you. For details on how your data is protected when transferred internationally, see Section 07.

We will not sell your personal data or share it with advertisers.

How it’s used

To deliver the service

We use your data to make Pomet work — processing your voice notes, building profiles, surfacing reminders, and responding when you ask for a briefing. Pomet uses artificial intelligence to transcribe your voice notes, extract structured information, and generate profile summaries. These features are assistive tools designed to help you organize information; Pomet does not make automated decisions about you that produce legal or similarly significant effects. You can always edit, correct, or delete any AI-generated content in your profiles.

Improving the product

We use aggregated and de-identified usage data to understand how Pomet is used and to improve the product experience. This data is stripped of direct identifiers and processed so it cannot reasonably be linked to any individual user.

Communicating with you

We use your email address to send you product updates, launch notifications, and service communications. You can unsubscribe from marketing emails at any time. We will always continue to send transactional emails related to your account regardless (such as security alerts and service updates) even if you unsubscribe from marketing.

Security and fraud prevention

We may use account and usage data to detect and prevent misuse, fraud, or security threats. This is never used for profiling or automated decision-making about you.

Legal compliance

We use data as necessary to comply with applicable laws, respond to legal requests, and fulfil our legal obligations.

We process your personal data on the following bases: (a) Contract performance (GDPR Art. 6(1)(b)): to provide and maintain the Pomet service, including transcription and profile generation; (b) Legitimate interests (GDPR Art. 6(1)(f)): to improve our product, ensure security, and prevent fraud, where these interests are not overridden by your rights; (c) Consent (GDPR Art. 6(1)(a)): for marketing communications and any processing of sensitive data; (d) Legal obligation (GDPR Art. 6(1)(c)): to comply with applicable laws and regulatory requirements. You may withdraw consent at any time without affecting the lawfulness of processing that occurred before withdrawal.

If we introduce materially different uses of your data, we will update this policy and ask for consent where required.

How it’s protected

Secure storage and transmission

Your profile data is stored securely in Supabase and transmitted over encrypted connections (TLS). We use row-level security to ensure data is strictly isolated by account.

Zero Data Retention with OpenAI

Under our signed Zero Data Retention agreement with OpenAI, voice notes sent for transcription are not retained for model training or long-term storage.

Access controls

Access to production systems and user data is strictly limited and monitored. Access to profile content is technically restricted and limited to authorized personnel only when necessary for security, support, maintenance, or legal compliance.

Data minimization

We only collect what we need. We do not build advertising profiles or use your data for targeted advertising. We only keep data for as long as it’s serving you, not indefinitely in case it becomes useful to us later.

Breach notification

In the unlikely event of a data breach that affects your personal information, we will notify you promptly and take immediate steps to contain and remediate the issue.

Your rights

You have the following rights regarding your personal data. To exercise any of them, email us at privacy@pomet.ai and we will respond within 30 days.

Access

You can request a copy of all personal data we hold about you at any time.

Correction

You can update or correct your account information directly in the app, or ask us to do it for you.

Deletion

You can delete your account and associated data at any time directly from the app. You can also request deletion by emailing privacy@pomet.ai.

Export

You can export all your profile data at any time in a portable format, directly from the app.

Opt out of marketing

You can unsubscribe from marketing emails at any time using the unsubscribe link in any email, or by contacting us directly.

Your state privacy rights.

Depending on where you live, you may have additional rights under your state’s privacy law, including the right to: (a) confirm whether we are processing your personal data and access that data; (b) correct inaccuracies; (c) delete your personal data; (d) obtain a portable copy of your data; (e) opt out of the sale of personal data, targeted advertising, or profiling; (f) appeal if we deny your request. We do not sell your personal data, use it for targeted advertising, or profile you for decisions producing legal or similarly significant effects. To exercise any of these rights, contact us at privacy@pomet.ai. If we deny your request, you have the right to appeal by emailing us with the subject line “Appeal.”

California residents (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act, including the right to know what personal information we collect and how it is used, the right to delete, the right to correct, and the right to opt out of the sale or sharing of personal information. We do not sell or share your personal information.

To exercise your CCPA rights, email privacy@pomet.ai. We will not discriminate against you for exercising these rights.

Rights for users in the EU/EEA

If you are located in the EU or EEA, you have the right to: access and receive a copy of your data; rectify inaccurate data; erase your data; restrict processing; object to processing based on our legitimate interests; data portability; and withdraw consent at any time. You also have the right to lodge a complaint with your local data protection supervisory authority. To exercise any right, email privacy@pomet.ai.

Data retention

We keep your data for as long as your account is active. If you delete your account, we will delete or deidentify your account data within 30 days, except where retention is required by law, necessary for security incident investigation, or needed for temporary backup restoration (backup copies are deleted within 90 days of account deletion).

Waitlist and early access email addresses are retained until you unsubscribe or until 24 months of inactivity, whichever occurs first.

Calendar data covers a rolling window from 24 hours ago to 7 days ahead. Events outside that window are deleted at the next sync, and disconnecting a calendar deletes all cached calendar data along with the connection and its access tokens.

In limited cases, we may retain certain information for longer periods where required by law — for example, for financial recordkeeping — but this does not include your profile content or voice transcripts.

International Transfers

Pomet is based in the United States and relies on a small number of trusted service providers — including infrastructure, website hosting, website and product analytics, crash reporting, email, and AI processing providers — that may process data in the United States or other countries. Your data is transferred to the United States, which does not have an EU adequacy decision. We rely on Standard Contractual Clauses (SCCs) approved by the European Commission, supplemented by additional safeguards where necessary, to protect your data. You can request a copy of the SCCs by contacting us at privacy@pomet.ai.

Changes to this policy

We may update this policy as the product evolves or as laws change. If we make material changes, we will notify you by email and update the effective date at the top of this page. Where required by law, we will ask for your consent before applying material changes to how we process your data.

Contact us

If you have questions, concerns, or requests relating to this policy or your personal data, please reach out.

Email: privacy@pomet.ai

Address: Pomet, Inc. · 2261 Market Street STE 76796, San Francisco, CA 94114