Privacy Policy

We only collect what we need to make Sochima and Sochi work:

• Account Information: Your name, email address, time zone, account status, and delivery preferences. Passwords are stored as hashes rather than readable text.
• Contact Details: Phone numbers, verification status, SMS consent, and the connection permissions needed to deliver the reminders you request.
• Reminder Data: Task labels, optional descriptions, scheduled times, recipients, delivery channels, recurrence, and completion or cancellation status.
• Inbound Reminder Texts: Texts sent to the Sochi number are temporarily processed to understand the reminder title and requested time.
• Security and Usage Records: Authentication events, IP addresses, timestamps, and request counts used to protect accounts, limit abuse, and troubleshoot service errors. AI assistant integrations store hashed identifiers for their rate-limit counters.

We use practical safeguards to protect your data:

• Encryption: All data is encrypted in transit and at rest
• Secure Servers: Hosted on industry-leading cloud infrastructure
• Access Controls: Only authorized team members can access systems
• Regular Audits: We regularly review and update our security practices

We use your information to:

• Schedule and deliver reminders you or an authorized connection have requested.
• Improve our service and add new features
• Provide customer support when you need help
• Send important account and service updates
• Maintain account security and comply with legal requirements.

We do not sell your personal information.

We work with trusted partners to deliver our services:

• SMS and Voice Providers: Twilio processes the recipient phone number and reminder content needed for text messages and phone calls.
• Email Services: Resend and Mailgun process email addresses and notification content to deliver email.
• Analytics Tools: To understand how to improve Sochima
• Payment Processors: Stripe and RevenueCat provide billing and entitlement information. The assistant reminder tools do not request or return payment card details.
• AI Providers: To extract reminder details from text messages. The AI is not given permission to perform actions other than returning structured reminder fields.
• Hosting, Storage, and Scheduling: Vercel, MongoDB, and Upstash process the account data and scheduling records needed to operate Sochima.

We share the information needed for each provider's role. Their services also operate under their own privacy terms.

Linking your account through OAuth lets the assistant you choose receive your account ID, name, email address, time zone, reminder preferences, verification and entitlement status, eligible connection names and IDs, and the reminder details needed for your requests. With write permission, it can create, reschedule, and cancel reminders for you and eligible verified connections.

This applies to ChatGPT and Dots, and to Meta's Muse when that connector becomes available and you choose to connect it. Muse has been submitted for review and is awaiting Meta onboarding. Each assistant requires its own account authorization.

The tools operate on the details sent for a reminder action. They do not request your full conversation history, passwords, payment card information, government identifiers, or medical records. Use brief task labels and avoid putting these details in reminder text. Recipient phone numbers and email addresses are not returned by the eligible-connections tool.

You can revoke access from connected apps. Revocation stops future tool access; it does not cancel existing reminders or remove information already returned to an assistant. Disconnecting one assistant does not revoke the others. Data received by ChatGPT is handled under OpenAI's privacy policies and your ChatGPT account controls. If you connect Muse, Meta's privacy policies and Muse account controls apply to the information it receives.

Account, reminder, and account-security records are retained while you keep an account, unless deleted using available controls or removed through a completed deletion request. Cancelling a reminder retains its record; deleting it from Sochima removes the reminder record. Account deletion also removes associated reminder and login records.

Assistant access tokens expire after one hour. Refresh tokens expire after 30 days unless rotated by an active connection. Consent requests expire after ten minutes, authorization codes after five minutes, and duplicate-request receipts after 24 hours. Revocation records last up to 30 days plus one hour; rate-limit records expire at the end of their minute or hour window. Expired integration records are removed during subsequent request cleanup.

Request access, correction, export, or deletion through support or email hello@heysochima.com. Disconnecting assistants and opting out of SMS are available in your account settings without deleting your account.

You have the right to:

• Access your personal data
• Correct inaccurate information
• Delete your account and data
• Export your data
• Opt out of marketing communications

To exercise any of these rights, just contact us. We'll handle it as quickly as we reasonably can.