Privacy Policy

1. Who processes your data

The data controller is Samuel Moreno Conejero, the individual who operates Madrugo at the domain https://madrugo.com/en. Madrugo is in open testing: it is free and nothing is charged.

• Controller: Samuel Moreno Conejero
• Tax number (NIF): 46067689T
• Address: C/ Consell de Cent 140, A-4, 08015 Barcelona (Spain)
• Official domain: https://madrugo.com/en
• Privacy and rights: [email protected]
• Support: [email protected]
• Data protection officer: none has been appointed. There is no obligation to do so today (Article 37(1) GDPR and Article 34 of Spain's LOPDGDD); if Madrugo comes to profile users on a large scale, one will have to be appointed.

2. What data we process, and where it comes from

Only what the features you connect actually need. Every connection is voluntary and independent: if you do not connect it, that data does not exist at Madrugo. Where a permission grants more than Madrugo uses, we say both things: what is granted and what is done with it.

• Your Madrugo account: email address, which provider you sign in with, language, preferences and the edition assigned to you (Free, Basic, Pro or Max), with any note the administrator wrote when assigning it. From the Google account you connect, your name and profile picture are stored too. Your time zone is sent by your browser with each request and is not stored on your account. Sign-in is handled by Firebase Authentication, a Google service. You can sign in with email and password, with Google or with Apple. If you use a password, Google holds it, not Madrugo: your browser or the app sends it straight to Google, and Madrugo neither sees nor stores it. The emails to verify your address and to reset your password are sent by Firebase.
• Google Workspace (OAuth 2.0): connecting asks for read access only —gmail.readonly, calendar.readonly, tasks.readonly — plus your basic profile. On the Free edition the Drive permission is never requested. Write access is requested in two ways. Action by action: if an action fails for lack of permission, the link you are offered asks only for that action's permission. Or all at once: the “Authorize actions” button in Settings, and the reconnection offered when the connection has expired or a permission is missing — including from a voice command or when importing your Gmail signature — ask in one go for every write permission, the contacts permissions, the Drive permission and your organisation's directory. The connect-Google button in the iPhone app asks for the same minus the directory.
• What Madrugo does with each Google permission: with gmail.readonly it lists and opens your messages and reads your labels and your “send as” settings (aliases and signature); with gmail.modify it marks as read, stars, archives and moves to trash; with gmail.compose it creates and edits drafts; with gmail.send it sends; with calendar.events it creates, changes and deletes events; and with tasks it creates, changes, completes and deletes tasks. What Madrugo reads is decided by your edition, not by what Google has granted: if your edition stops including something, the permission stays granted at Google, but Madrugo stops using it. To withdraw it completely, go to myaccount.google.com/permissions.
• Google contacts: with contacts.readonly, contacts.other.readonly and, if you grant it, directory.readonly, Madrugo reads the name, email addresses, phone numbers and organisation from “My contacts”, “Other contacts” and your organisation's directory, up to 2000 per source. A copy is stored at Madrugo, encrypted field by field, to put names to senders and complete recipients.
• Google Drive: the drive.readonly permission in theory grants read access to your whole Drive, and Google classes it as a restricted permission. Madrugo only opens the documents attached to the events in your daily summary: it downloads the whole document as text, keeps the first 3000 characters of each and sends them to the AI model inside the summary. Neither Madrugo nor the AI gateway stores that text. On the Free edition this permission is not requested.
• Microsoft 365 / Outlook (Microsoft Graph): connecting asks for your basic profile (openid, profile, email, offline_access, User.Read) plus Mail.Read, Calendars.Read and Tasks.Read. Write access is requested permission by permission, when needed: Mail.ReadWrite to mark as read, archive, delete and create drafts; Mail.Send to send; Calendars.ReadWrite to create events; and Tasks.ReadWrite to create and complete tasks. With Contacts.Read your contacts are read and a copy is stored at Madrugo, encrypted.
• iCloud Mail: your iCloud address and an app-specific password, which is stored encrypted. Today it is the only mailbox of this kind that can be added, with Apple's servers fixed. That password in theory gives access to the whole mailbox. In practice, Madrugo's screens only use it to send: the mail you send — recipient, subject and body — leaves through Apple's server. Madrugo's server has code to test the connection and read the subject, sender and date of the latest messages (never the body), but no screen uses it today.
• Calendars by link (ICS): the calendar's secret address and a copy of its events, both encrypted. The copy is refreshed at most every 15 minutes, takes up to 1 MB per calendar and does not keep one-off events older than 30 days.
• Todoist: the data:read permission in theory grants read access to all your Todoist data. Madrugo only asks for today's and overdue tasks, up to 400, and uses their title, description and date. It does not store them: the only thing stored is the token, encrypted. Madrugo does not create or complete tasks in Todoist.
• tokidu: another application run by the same owner as Madrugo. If you connect it (with one tap, tokidu creates the personal token and hands it to Madrugothrough a single-use code that expires after 10 minutes; or by pasting that token by hand, created at My account → Integrations), Madrugo asks tokidu on every daily summary, with your time zone, for up to 20 pending or in-progress tasks (title, project, priority, date and whether the timer is running) and shows them in your daily plan, on the web and in the iPhone app. It does not store them: the only things stored are the token, encrypted and bound to your account, and the date tokidu rejected it, if you revoke it there. Madrugo does not create, complete or time anything in tokidu.
• Telegram (if you connect it): Madrugo stores the identifier of the chat you link, encrypted and bound to your account, and the settings you choose (time, days, time zone and contents). At the chosen time it sends the daily summary to that chat with what you have ticked: weather and warnings, today's appointments, tasks, the electricity price, air quality and, only if you turn it on, the subject and sender of unread emails. Telegram handles that message under its own terms: its servers are outside the European Economic Area and chats with bots are not end-to-end encrypted. Sending /stop pauses it; disconnecting also deletes the identifier and the settings.
• The Madrugo app on iPhone: if you allow it on the phone, it reads your Calendar, your Reminders and your Contacts. To be able to read, Apple requires asking for full access, read and write, to Calendar and Reminders. The app uploads to your account the events of the next 14 days (30 at most) with their title, start, end, location and notes, and up to 30 pending reminders with their title and date. It also edits and deletes events and reminders on the phone when you ask it to. From your contacts it uploads up to 2000 that have an email or phone: name, emails, phones and organisation, stored encrypted alongside those from Google. From the device, its name and platform are stored when you pair it, and when it was last used.
• Time to leave (iPhone only, if you turn it on): the phone asks for your location while you use the app and sends it to Apple Maps with the address of your next appointment, to find the place and work out the travel time. Apple handles that under its own terms. Your location does not reach Madrugo's servers and is not stored. If you turn on the reminder, the phone itself schedules the notification.
• Apple notifications (Live Activity): if you turn it on on your iPhone or iPad, the device asks Apple for two notification tokens (APNs), one to start the activity and one to update it, and sends them to Madrugo together with the app they come from and your time zone. The activity shows up an hour before each timed event, with an alert that says the event's title and time, and goes away when it ends. While it is on screen, the server sends through Apple, every 15 minutes and only if something has changed, what it shows: the headline and the Today summary (which may name an event, an email or a task), the weather, how many emails, events and tasks you have, up to three of today's events with their time, the day's birthdays, the title of your first Google Tasks task and the subject and sender of your most recent unread email, so you can complete it, mark it as read or delete it with a button. That content is not stored: only a fingerprint to know whether it has changed. What is stored is the tokens, which event it was last started for and, for two days, which events you marked as done from the activity. The tokens are deleted when you turn it off, when you sign out or when Apple reports them as expired. Apart from this, no other notification is sent.
• Dictation and voice commands: dictation is done by your browser or your phone, with its own speech recognition service: Apple's on iPhone, the system's on Android and the browser's on the web. Madrugo never receives the audio: only the text, 500 characters at most. Where the audio is processed is up to Apple, Google or your browser, under their own terms. The text of the command does go to the AI model.
• Weather: the municipality you choose in Settings; only its code is stored. In Spain the municipal forecast and official warnings are requested from AEMET using the municipality code; outside Spain, and for the hourly rain probability, approximate coordinates go to Open-Meteo. Neither of them is sent your name or any identifier. If air quality and pollen are on, the same approximate coordinates also go to Open-Meteo's air quality API; and if the electricity price is on, Red Eléctrica is only asked for the day's price, with nothing of yours. The name of your municipality does travel to the AI model inside the daily summary. If you press “Use my location”, your browser sends your position rounded to about a kilometre to find the nearest municipality, and it is not stored.
• Mail signatures: the ones you write in Madrugo or import from Gmail, up to 30 per account. They may carry your name, job title, phone and postal address. Importing the Gmail one reads your “send as” settings with the Gmail permission you already have, and only when you ask for it.
• Daily routines: which series in your calendar you have marked as done each day and which you have removed from view. The series identifier and the day are stored, without titles.
• Images in emails: they are blocked by default. If you press “Show images”, your browser downloads them from the sender's server, which sees your IP address and knows you opened the email. It is not told which page you came from.
• Technical data: sync and audit logs (which action, when, and whether it failed), counters of how many times a day you use each capped feature and of how much your account's AI costs per month, and a cryptographic digest of your IP address to limit abuse, which is stored next to the daily summary and lasts as long as it does: 90 days. There is no analytics, no advertising and no trackers.

3. What for, and on what legal basis

• Your consent (Article 6(1)(a) GDPR) to read and process the mail, calendar, tasks and contacts of the accounts you connect, and the calendar, reminders and contacts on your iPhone if you grant that permission on the phone. You give it when you connect each account or grant each permission, and you can withdraw it whenever you want, without explaining yourself.
• Your explicit consent (Article 9(2)(a)) for the unavoidably sensitive part: an email may mention your health, your beliefs or trade union membership, and reading it processes that too.
• Performance of the service (Article 6(1)(b)) to keep your account, your edition and your preferences.
• Legitimate interest (Article 6(1)(f)) for security and cost control: rate limits, usage counters, audit logs and abuse detection.

4. Other people's data that appears in your mail

When Madrugo reads your mailbox it also reads who writes to you. Those people have given us no consent, and processing their names and addresses rests on the legitimate interest (Article 6(1)(f) GDPR) of providing the service you asked for: without knowing who wrote to you there is no summary and no reply.

So as memory we keep the minimum — name, address, subject and an extract — encrypted, and never the full message body. You can exclude contacts, domains and whole labels so they are never processed. If one of those people writes to [email protected], we will deal with their request.

There are other places where other people's data remains, and it is better to say so: your contact book, which is copied encrypted; your list of excluded contacts and domains, which is stored unencrypted with your preferences; and the audit log, which when you “forget a contact” or “a domain” records that address or domain unencrypted. Also, when the AI processes an email, the text that leaves carries the name and address of whoever wrote to you (see the next section).

5. Artificial intelligence: what leaves, where it goes, and what we do not do

Madrugo uses a language model for four things: summarising your day, proposing a reply to an email, drawing memories from your mail (Memory) and understanding a voice command. Every call goes through our own authenticated gateway (Sinergia), which picks the provider; Madrugo never talks to a model provider directly and holds no provider keys. The provider is Google (Gemini, via Vertex AI) and, if Google fails, OpenAI.

This is what travels in each case, and what happens afterwards:

• Daily summary: the emails in your inbox from the last two days, read or not, up to 25, 100 or 250 depending on your edition (Basic, Pro or Max): for each one, the sender's name — or their address, if the sender has no name — the subject, the date, whether it has been read and a 200-character extract, or 400 on Max; up to 8 events (title, start and end) from Google, the iPhone and calendars by link; up to 8 tasks (list, title and date) from Google Tasks, iPhone reminders, Todoist and tokidu; and the weather, with the name of your municipality. Each email, event and task also carries its identifier in the service it came from, because the alerts point at it. If a Google event has Drive documents attached and you have granted that permission, also the name of each document and up to 3000 characters of its text.
• Reply proposal: the sender with their address, the subject, the date, the extract and up to 6000 characters of the email body.
• Mail memory: for each email, the sender, the recipients, the subject, the date, the extract and up to 7000 characters of the body. The contacts, domains and labels you have excluded are discarded before the model is called.
• Voice commands: the text of what you said (500 characters at most), the date and time, and your time zone.
• What travels with each call is technical: your edition, your language and a pseudonym for your account, used to know what it costs. Never your email address or the subject of your messages.
• Before sending anything, Madrugo hides what is not needed: account (IBAN) and card numbers with their security code, Spanish ID numbers (DNI and NIE), passwords and verification codes are replaced with a notice such as “[IBAN oculto]”. An automatic filter does this, recognising the usual formats. And what the model returns for Memory goes through another filter before it is stored.
• The gateway does not keep what you send. Sinergia, owned by the same person as Madrugo, passes the text to the model and only records what each call cost and which model it used.
• What depends on your edition: on Free there is no model-based summary and Drive is not requested; Gmail is read and there are voice commands, up to 3 a day. On Basic, Pro and Max there is a model-based summary, which reads 25, 100 or 250 emails, and more voice commands, with daily caps. AI over mail — proposals and Memory — is switched on separately: until it is, those two features send nothing.
• If you turn AI off in Settings, no model is called. The day's summary is made on our server, without AI, and mail proposals, Memory and voice commands stop. The server checks it, on the web and in the apps.

6. Who else has access to your data

We do not sell or hand over personal data. The following providers process it on our behalf or are the destination of data you asked us to sync:

• Google Ireland / Google LLC: Gmail, Calendar, Tasks, Contacts and Drive (source of the data), Cloud SQL (database), Firebase Authentication (your identity and, if you use one, your password) and Vertex AI (models).
• Microsoft Ireland: Microsoft Graph, if you connect a Microsoft 365 account.
• Apple: as identity provider, if you sign in with “Continue with Apple”; and as iCloud mail server, if you connect iCloud Mail: it receives your address, the app-specific password and the mail you send; and as notification service (APNs), if you turn on the Live Activity: it receives what the lock screen shows in order to deliver it to your device.
• OpenAI: only as a fallback when the Google model fails.
• Telegram, if you connect the Telegram summary: it receives the content of every summary sent to you.
• Doist (Todoist), AEMET, Open-Meteo and Red Eléctrica, if you use those features.
• tokidu, the task app run by the same owner: if you connect your token, it receives that token and your time zone on every summary and returns your next tasks. Its data lives in the same Google Cloud database as Madrugo's, in the European Union.
• The speech service of your browser or your phone (Apple, Google or the browser maker): it receives the dictation audio, under its terms and not ours.
• Cloudflare (delivery network and protection): it protects the website from attacks: traffic goes through its network, which filters it and forwards it encrypted to our servers. Contabo and IONOS (servers, in Germany): Madrugo runs on them, and traffic is decrypted there too.
• Sinergia Barcelona, the AI gateway run by the same owner: it receives the text of each call to pass it to the model and only keeps its cost and the model used.
• Cifrago, the payment gateway run by the same owner: today it receives nothing, because payments are built but switched off. When they are switched on, it will receive your email address as customer identifier, your language and the product you buy, and it will register you as a subscriber the first time your entitlements are checked. We will explain it here before switching them on.

7. Transfers outside the European Union

The servers and the database are in the European Union. There are, however, three transfers you should know about (Article 13(1)(f) GDPR):

• The AI models. The Gemini call is made against Vertex AI's global endpoint, not a European region, so inference may happen outside the EU. What is sent is what the artificial intelligence section sets out: text from your emails, your calendar, your tasks, Drive documents or your voice command, depending on the feature.
• The fallback provider. If Google does not respond, the call may go to OpenAI, in the United States.
• Telegram, only if you connect it. The daily summary goes to Telegram's servers, outside the European Economic Area. It happens because you ask for it when you connect it; there are no signed standard contractual clauses with Telegram. You stop it with /stop or by disconnecting it.

8. How long we keep it

We keep information only as long as we need it to provide the service, or until you ask us to erase it. The periods per data category, what deletes them and when, are in our Data Retention and Erasure Policy, and what it says is what the code does.

9. Security: what is encrypted and what is not

Everything travels over HTTPS with TLS 1.3 and HSTS. In the database, the following is encrypted field by field with AES-256-GCM, using a key held separately from the database. Except for the Google and Microsoft tokens, which are encrypted whole, each encrypted value is also bound to its row, so it cannot be copied into someone else's:

• Credentials for connected accounts: the Google, Microsoft, Todoist and tokidu tokens, the iCloud app-specific password and the address of calendars by link.
• The copy of the events of calendars by link.
• Memory derived from mail: sender, recipient, subject, extract and the memory itself.
• The memory profile: lasting facts, preferences, frequent contacts and writing style.
• Reply proposals: subject, sender and the draft.
• Your contact book, whether it comes from Google, Microsoft or the iPhone: name, addresses, phone numbers and organisation.
• The body of your mail signatures.

10. What the administrator can see

Madrugo has a single administrator, who signs in with a password or passkey. To use the admin panel they must have signed in to it: their normal app session is not enough. In the panel they see each account's technical state, not its content, because otherwise support and cost accounting would be impossible. Of your account they can see:

• Who you are: your account email and, if you have connected Google, the name and email of that Google account.
• How you sign in and since when: which provider you sign in with (Google, Apple or email and password), when the account was created and the day of its last activity. The day, not the time.
• Your edition: which one you have, whether it is paid, set by hand or the default, and the note it was set with.
• AI usage, in numbers: how much AI has cost on your account this month and how many times each capped feature has been used today.
• What you have connected: Google — since when, and which permissions you gave it — Microsoft, other mailboxes, calendars by link, Todoist, tokidu and Telegram. For the rest, only whether it is connected or how many there are: never the address of those mailboxes or the link of a calendar.
• Your paired devices: the name, the platform, when each one was paired and the day it was last used.
• Your language, theme, colour, notification and quiet-hours preferences, and whether you have AI switched on or off.
• Memory, in numbers: how many memories there are and how much creating them has cost, how many contacts, facts and commitments were drawn from them, and how many contacts, domains and labels you have excluded. The number, not the list or what they say.
• What has been done on your account: which actions and which settings changes, who made them and when. For a change they see the names of the fields, not their values.

11. What the administrator can change, and what they cannot

They cannot override what you choose. If you have switched AI or Memory off, they cannot switch them back on: only you change that, in your app. They can bring your Memory up to date only if you have it switched on: they cannot make AI process your mail if you have switched AI or Memory off, or if your edition does not include it. And they can neither see nor change your exclusion list.

This is what they can do with your account from the panel:

• Change your language, theme, colour, notifications and quiet hours. No other preference.
• Reset your preferences to the defaults. You lose what you had chosen, but if you had AI or Memory switched off they stay off, and your exclusion list is not touched.
• Set your edition by hand, with a note, or stop setting it.
• Revoke one of your devices: it stops syncing at that moment. What was already stored on the device is not erased.
• Erase memories from your Memory without seeing them — those of a contact, those of a domain, or all of them — and go over the stored ones to clean them, without calling AI.
• Delete your whole account: when you ask, when the law requires it — for example, if the account belongs to a child under fourteen without the necessary consent — or if the account was set up by mistake. For 90 days after that deletion, the administrator's log keeps the account email, the date, the reason and the receipt number, so that it can be shown to have been done. After that they are deleted.
• Decide the defaults for anyone who has not chosen yet: language, theme, colour and whether AI starts switched on; and which menu and blocks the web app has. They can also fix the web app's theme for everyone and stop the theme and colour, or the language, notifications and the other preferences — including switching AI on or off — from being changed in the web app. A colour you had already chosen is kept, and in the apps you still change everything yourself.

12. Your rights and how to exercise them

You have the right to access your data, rectify it, erase it, restrict its processing, object, take it to another service and withdraw consent (Articles 15 to 22 GDPR).

Write to [email protected]. It is free and we will reply within one month at the latest; if the request is complex we may extend that by two further months, but we will tell you within that first month and explain why (Article 12(3) GDPR).

13. If there is a security breach

If a personal data breach occurs that poses a risk to your rights, we will notify the Spanish Data Protection Agency without undue delay and, where feasible, within 72 hours (Article 33 GDPR). If the risk is high we will also tell you, in plain language, what happened and what you can do about it (Article 34).

14. Children

Madrugo is not intended for children under fourteen. In Spain, below that age consent must come from whoever holds parental authority or guardianship (Article 7 of Organic Law 3/2018). If we learn that an account belongs to a child under fourteen without that consent, we will delete it.

15. Cookies and what is stored in your browser and on your devices

We use no advertising, analytics or third-party cookies, which is why there is no cookie banner. There is one session cookie, signed and unreadable by page code: it lasts 90 days from sign-in and is renewed for one year when you connect Google. There is another like it, lasting 180 days, if you connect Microsoft, and a few single-use cookies while you authorise a connection. There is no language cookie: the language comes from the domain and the page address. These are technical cookies, exempt from consent (Article 22(2) of Spanish Law 34/2002).

In addition, your browser keeps in its local storage a copy of your preferences — with the list of excluded contacts and domains and your municipality — the theme, the panels, the state of your connections and the events you have marked as done today. Firebase also keeps its session in the browser, under its own rules. Signing out clears the cookies and the Firebase session, but not that local storage: for that there is a separate button in Settings, under Privacy.

The apps also leave something on the device. On iPhone, Mac and watch, the keychain holds the device credential and your account email, and a file holds the last state — calendar, mail and tasks — so you can see it offline; it is emptied when you unpair the device or sign out in the app. On Android, the credential goes in the system's secure storage, and the account and device identifier in the app's preferences. Erasing the account on the server reaches none of this: it is removed by signing out or uninstalling the app.

16. Changes to this policy

We may update this policy because the law changes or because the product does. The version and date are at the top. If a change really affects you — a new purpose, a new processor or a new transfer — we will tell you in the app before it takes effect, not just by publishing it here.