crewEffective October 17, 2026
Crew is a personal AI companion operated by Sinuosity LLC (Sinuosity AI). It helps with everyday conversation, ideas and follow-through, using saved context only when you enable it. You can manage personal tasks, review optional day plans, bring selected calendar context into a conversation, or request deeper research.
What we process
Conversations process your messages, relevant authorized connected-service content, documents, approval decisions and any profile or memories you save or permit Crew to learn. You can inspect, edit or remove saved memories. Personalization is optional. With automatic context enabled, Crew selects relevant saved memories and open tasks for each conversation. A separate, default-off learning setting lets Crew save and use lasting preferences and goals stated in your own messages without asking for each entry. Automatic learning excludes sensitive details, third-party facts and inferred facts. Learned memories show their origin and the exact wording you provided. You can correct, forget or pause learning at any time. With learning off, proposed new memories still require your approval. Live-call captions are not automatically saved as memories. Relevant authorized memories may be sent to OpenAI's embeddings API to match meaning as well as wording. Private numerical representations are cached with the memory, refreshed after corrections and removed when you forget the memory. A separate conversation-recall setting lets Crew find relevant excerpts from your other unexpired conversations. You can see the context sources used and turn this off. Corrections, forgetting and disabling context invalidate earlier saved AI continuation state; existing visible conversation copies can be deleted separately. Calendar commitments you explicitly select on your device are uploaded as a snapshot, not continuously synchronized or independently verified by our server. Day-plan drafts require AI permission and your review before becoming saved priorities. Manual task entry, completion and rescheduling do not require AI permission. Depending on the connected service and permissions, selected results may include workspace people and contact details, financial transactions, balances, and payment-method details. In your main chat, Crew can choose relevant tools from your currently connected apps for each message you intentionally send. Connecting an app does not start mailbox ingestion or unrelated background reads. Other workspaces use the connections you select; scheduled work retains its authorized app scope. Provider connection credentials are encrypted on our backend and are not placed in model prompts or sent to the app.
For an authorized Google Calendar connection used for your request, Crew reads bounded event titles and times from your primary calendar for the feature you request. Raw Calendar API results are held only in the worker's memory and are not saved in its internal conversation transcript. A worker retry may repeat the authorized read. Your visible conversation response remains part of your saved conversation. This access does not change events, send invitations or schedule notifications. Google data is used to provide your requested personal feature, not advertising or general model training. Crew's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google Calendar access is currently limited to an explicitly authorized personal pilot pending Google verification; other users can select calendar commitments on their device instead.
Gmail Read and Gmail Send are separate, explicitly authorized connections in a limited three-account testing pilot pending Google verification. Signing in with Google does not connect Gmail. In main chat, Crew may choose a relevant connected Gmail tool for your request without a separate Apps selection. Bounded email search, message and thread results may be sent to OpenAI to answer you. Raw Gmail reads remain in worker memory rather than saved continuation; derived summaries, reviewed drafts, approvals and requested documents remain in your conversation until deletion or expiry. Crew does not synchronize your mailbox or download email attachments. A deterministic filter withholds recognizable sign-in codes and password-reset messages; it is not a guarantee that all sensitive mail will be identified. Email and web content are treated as untrusted data, never permission to act. Gmail Send requires your explicit in-app confirmation of the sending account, exact recipients, subject, body and any saved-file attachments. When you approve an attachment, Crew sends the reviewed file bytes and filename to Gmail with that message. If its source, version or availability changes, a new review is required. Gmail attachments in this feature come from your own saved Crew work; Crew does not silently upload unrelated files. A send accepted by Gmail is not proof of delivery or reading. Disconnecting prevents future access; already-sent messages cannot be recalled by deleting Crew data.
Optional automatic follow-ups
Automatic follow-ups are off until you enable them in your profile. This standing permission lets Crew plan a concrete next step from a message you wrote in your main chat, without requesting approval for each read or research task. Crew schedules at most one per turn and three per day to avoid unwanted interruptions, within seven days. Work and notifications defer during 22:00–08:00 in your configured time zone. At the scheduled time, Crew uses the recent conversation and your currently authorized personal context to reassess whether the work is still useful. It can skip a resolved or redundant task without a message. Results appear in your main chat; push delivery also requires your notification preferences. You can inspect or cancel planned work in Background work. Turning this permission off, deleting the source chat, or changing its privacy/context permissions prevents pending work and future automatic notifications. External changes, including sending email, still require a separate explicit review. Follow-ups cannot automatically schedule more follow-ups.
Main chat and shared media
Your main private chat keeps your crew conversation together. Photos, reviewed voice notes and video clips upload only when you choose Send, with AI processing permission. Selecting or previewing media alone does not upload it. Uploaded originals and prepared media are private to your account and expire within 30 days of upload; you can delete them sooner. Images and sampled video frames are sent to OpenAI for analysis, and provided audio may be transcribed. Sampled frames are not analysis of every video frame; a clip without provided audio is described as frames only. The original video remains available for your authenticated playback and is not automatically sent for model analysis. Transcripts and derived replies can remain in the conversation until it is deleted or expires. Deleting the main chat also removes its archived messages and media. Deletion replaces private storage objects with empty, content-free write fences until their storage lifecycle expires, preventing late uploads from restoring deleted bytes.
Your brief, constraints, mission results and Firebase account identifier are processed to provide Crew. You can start as a guest or link Google or Apple sign-in to keep the same account. If you choose a sign-in provider, Firebase Authentication processes that provider's account identifier and any name or email it supplies, including an Apple private-relay address. Crew uses these details for account access and display, not advertising. Sign-in does not grant access to your provider's files or other connected services. The app stores session credentials and basic account information securely on your device. Signing out removes those local credentials; account deletion removes the Firebase account and Crew cloud data. Do not submit passwords, sensitive personal information or confidential material.
Run creation, status, timestamps and usage counts support job recovery and service limits. Google Cloud operational logs can include source IP and network information, user agent, request path and method, response status, latency and byte counts. We use these records to operate, secure and troubleshoot the service; we do not use them for advertising or derive your location from your IP address.
AI and infrastructure
Briefs and relevant context are sent to Google Cloud Vertex AI to generate results. Scout uses Google Search grounding; search queries derived from your brief are sent to Google. Google Cloud also provides authentication, database storage, hosting and the task queue. AI output can be inaccurate.
Agent workspaces use the OpenAI Responses API. Relevant conversation context, your profile when enabled, explicitly selected memories, relevant saved memories and open tasks when automatic context is enabled, selected device-calendar snapshots, and tool results are sent to OpenAI. The agent may use web search. Selected connected services receive the inputs needed for their tools. External write actions, proposed personal tasks and memories proposed outside optional automatic learning require your approval in Crew. A task reminder is scheduled only when you explicitly choose a time. You can also approve a one-time background follow-up with an exact instruction and time within seven days. Crew runs it on the server, even when the app is closed, using the original selected connections and current permitted context. External writes still require a separate approval. Results appear in Crew; push updates require a supported build, service configuration and notification permission. You can inspect or cancel scheduled follow-ups. They are not continuous monitoring. Recurring routines start as drafts. You review their instruction, daily or weekly schedule, time zone, selected connections and quiet hours before turning them on. Quiet hours defer the whole occurrence, including AI preparation. You can pause or delete a routine; editing an active routine requires another approval. Call routines send an invitation to talk, not an automatic call or microphone recording. Long conversations may use OpenAI compaction to preserve working context in a smaller encrypted continuation. Older messages may leave the app's displayed conversation window while that working context continues. Ordinary agent requests disable stored Responses objects. Live voice web lookups use temporary stored background Responses so we can cancel a lookup if the call ends. We request deletion after use and cancellation of unfinished lookups. Network or provider failures can prevent confirmed cleanup. These controls do not eliminate provider security, abuse-monitoring or other retention described in OpenAI's data policy. Disabling AI consent stops future dispatches; requests already sent to a provider may finish. Pending local withdrawal is synchronized when your device reconnects.
Saved Markdown and CSV documents belong to their private Crew conversation. Crew can list and read those documents to continue your work. Replacing a document requires your approval of the complete proposed text and the current document version; a concurrent change requires a new review. Document reads and edit receipts are stored with the conversation and follow its existing expiry and deletion rules. Editing does not extend that retention period. Earlier quoted text and reviewed proposals may remain in conversation history until you delete it or it expires. The text document editor does not itself access a browser or execute files. Separate optional computer tools can create supported files in a private hosted workspace. Saved work may be downloaded or shared when you choose, including as a reviewed Gmail attachment. Exported copies and messages already sent are outside Crew's deletion controls.
Your computer and saved browser
Optional computer work runs on a separate cloud computer hosted by E2B, not on your iPhone or personal Mac. You choose whether Crew may use it. The current browser pilot is for public web pages; website sign-in and shared browser-account access are not enabled. E2B processes the pages you open, page addresses, screen content, browsing history, input you type and files in that computer to provide the feature. Pages can also send information to their own website operators, subject to those sites’ policies.
While Crew is in control, relevant page text, structure and screenshots can be sent to OpenAI to carry out your request. The live preview is delivered to your app. Taking control pauses Crew’s observation and actions; your touches and typing still go to the E2B computer and the website you are using. Handing control back lets Crew observe the current page again. Do not enter passwords, payment details or other secrets in this pilot.
Stop pauses work; it does not erase the saved computer. Browser pages, history, profile state and workspace files may remain for your next visit. Where enabled, a paused computer can also retain a memory snapshot for resuming. A snapshot’s resume window is not a promise that all stored browser data is erased after that period. Open Settings → Your browser and choose Forget browser or Delete workspace, or delete your Crew account to request removal. Access is revoked first; provider cleanup runs separately and may need retries. Provider failures can delay confirmed erasure. Browsing data is used for the requested computer feature, not advertising.
Places and optional weather
Places searches use Apple MapKit on your iPhone. Apple receives the place or area you explicitly enter. Crew does not request your device’s GPS location for this feature. A fresh place-search card in chat can search the named area while the app is in the foreground. Older cards need you to choose Search again. Search results stay on the device unless you choose a place, review its details in a message draft and send that message to your crew. Opening a place’s website sends you to that site; Directions opens Apple Maps, where Apple’s own settings and policies apply.
If you enable weather in Appearance and select a city, its coordinates are sent to Apple WeatherKit to retrieve real conditions. The city selection is saved locally for your Crew account, and weather observations are cached briefly on the device. Crew does not send those observations to its AI models. You can remove the selected city in Appearance. Weather and map services are subject to availability; unavailable weather does not prevent using Crew.
Dictation and live calls
Microphone access is optional and starts only when you choose to record or start a call. Dictation sends a recording of up to one minute to OpenAI for transcription; you review the words before adding them to a message. Temporary recordings are removed from your device after transcription, cancellation or interruption. Live calls stream microphone audio through our server to OpenAI's Realtime API for group calls or GPT-Live API for legacy solo calls, and play AI voices for Scout, Skeptic and Maker. A transcript is used in memory to maintain context when speakers change. Solo crew calls last up to five minutes. Active calls can continue when minimized or when the screen locks through iOS CallKit and background audio; end the call in Crew or the system call controls to stop it. Audio interruptions, account changes, lost connectivity and service limits can also end a call. Crew does not save ordinary live-call audio or full transcripts to its database. Captions remain on the call screen until cleared or you change accounts. Private solo calls can use the personal context you have enabled, including saved memories and your private delegated-call recaps, and can look up web information. Voice calls do not make changes in external connected apps; use chat for actions that require your review. Voice usage and admission metadata, linked to a hashed account identifier, expire after two days. Account deletion removes account-linked voice metadata. Provider processing and retention remain subject to the OpenAI data policy linked above; disabling stored sessions does not remove all provider records.
People and shared spaces
Other signed-in, registered Crew users can look up your exact chosen username to preview your public display name, optional photo and short bio, or invite you to a shared space. Showing your selected Scout, Skeptic or Maker on your profile is optional and off by default. This public identity is separate from your private companion profile.
A shareable web profile is a separate, optional setting, off by default. If you enable it and save, anyone with your username-based profile link can see your public name, username, photo, bio and the crew members you chose to show, without signing in. Public profile pages never include your email, private chats, memories, calendar, tasks, connected-app credentials or saved people list. Turning sharing off immediately makes the hosted profile unavailable on subsequent requests. It does not remove your signed-in Crew profile or copies someone already viewed or saved. Account deletion also makes the public link unavailable.
Uploaded photos are decoded, metadata is removed, and only a small JPEG thumbnail is saved. Your saved people list is private to your account and resolves their current public profiles. Saving someone does not send a notification or invitation, accept a call, or authorize unavailable-mode delegation. Removing someone changes only your own list. Account deletion removes your public profile and saved-person references.
A registered account and a chosen username let another person invite you by exact username. Accepting joins the shared space as yourself with none of your AI crew selected. Each person separately chooses which of their own Scout, Skeptic or Maker may join. Both people must allow AI processing before shared AI participates. Shared calls use LiveKit for media transport and participant presence; LiveKit receives the media and connection information needed to carry the call. Human participants can hear shared audio, and selected AI voices process shared conversation through OpenAI. The app labels whose crew each voice belongs to. Private profiles, memories, private chats and connected-app credentials are not shared into these calls.
Both members can see and edit a shared task board. Assigning a task does not start AI work; its owner explicitly chooses Run. Shared AI work uses shared instructions and returns a reviewable document, not access to another person's private context. Hanging up leaves the workspace available. Closing or leaving a shared workspace removes its shared content for both participants.
Supported builds use Apple's PushKit and iOS CallKit for genuine incoming calls, including while Crew is in the background. A separate encrypted VoIP delivery token routes these calls. Apple receives call and room identifiers, a hashed recipient identifier, the caller's public name and the invitation expiry. The public caller name can appear on your system incoming-call screen. Answering connects you as a human, with none of your AI crew selected, and requires microphone permission. You can decline instead. When available, explicitly choosing one crew member to answer delegates that call without joining or turning on your microphone; you can stop that delegation. Delivery and connection are subject to connectivity, device settings and service availability. Call-history metadata expires after 30 days. Signing out or deleting your account unregisters this installation's server-side VoIP delivery token; a content-free revision and capability hash remains to prevent stale device updates.
Unavailable mode is off by default. You may explicitly allow one to three of your own AI voices to answer selected accepted contacts for a chosen period of up to eight hours. The caller is told that AI is answering for you. It cannot disclose private memories or make commitments on your behalf. A private recap and review items may be saved for you after the call and recalled in your own crew conversation. You can turn this permission off or forget a recap. Routine call invitations do not automatically answer calls.
Public profiles, reports and blocking
Before publishing a public profile, Crew asks for explicit confirmation to send its proposed public username, name, bio, selected public crew names and metadata-free profile image to OpenAI for a moderation check. Before publishing a custom shared-room title or shared-task title and detail, Crew similarly asks to send that shared text for a safety check. These checks send only the selected public or shared content, not your private chats, email, crew duties or personality settings. Existing unchecked content is not automatically sent. If a check is unavailable, the proposed change is not published. Moderation can make mistakes; contact support if you want to question a decision. Live human call audio is not automatically moderated.
If you choose Report, Crew sends the selected content, report reason, any detail you add, and the relevant reporter and target identifiers to a private support queue in Google Cloud. Text snapshots are limited to 2,000 characters per field and your optional report detail to 500 characters. A report about a profile photo references its hash and revision instead of saving another copy of the image. Reports are retained for up to 30 days or removed earlier through account deletion. Making a report does not automatically send an email.
Blocking stores private member identifiers to prevent further contact until you unblock the person or delete your account. Crew revokes the shared connection and retries provider disconnection if it cannot confirm it immediately. Blocking does not erase copies someone already saved. You can report a concern or request help at hello@sinuosity.ai.
Notifications and reminders
Notifications are optional and require your iPhone's permission. Timed task reminders are scheduled on this device only when you choose a time. Their metadata stays on the device. Completing or deleting a task here cancels its reminder; changes elsewhere may not be reflected until the app refreshes the task. Crew work updates use Apple's push notification service when available. We store encrypted device delivery tokens and notification preferences. Apple receives the delivery token, generic alert text, an opaque notification identifier and routing identifiers including a hashed account ID. Lock-screen alerts do not contain your message, task title or connected-service content. Pending delivery metadata expires after 24 hours. Turning notifications off prevents future dispatches and removes scheduled local reminders; alerts already accepted by Apple may still arrive. Sign-out and account deletion remove this installation's token and local reminders. A content-free installation revision and capability hash remains after unregistering or deletion to prevent delayed requests restoring a device binding. Delivery can be delayed or silenced by connectivity, Focus and iPhone settings.
Your private in-app inbox contains reminder text, call invitations and delegated-call recaps and mentions in your main chat. A model-authored mention can create a generic push linking to the exact saved message; it does not trigger another AI turn. Approved scheduled work posts its completed result to main chat and follows its reviewed quiet hours. Notification preferences and source permissions are rechecked before dispatch. Opening a call invitation does not start a call until you choose to join. Inbox items and delegated-call recaps expire within 30 days. Removing their source can make them unavailable sooner. Push alerts use generic wording rather than private reminder or recap content.
Google may retain Search-grounding debug logs containing derived queries and contextual information for up to three days. Google may log prompts for abuse monitoring under its applicable terms. Gemini may cache inputs, outputs and derived data for up to 24 hours. Deleting Crew data does not immediately erase these separate provider records. See Google's data retention documentation.
Storage and deletion
Cloud mission history expires after 30 days. Expired cloud records stop appearing in cloud history, and Google Cloud removes them through its expiry process. Copies saved on your device remain until you delete them in the app. Agent workspaces and their messages, approvals and documents expire after 30 days. Approved background follow-ups also expire after 30 days. Removing their original conversation or withdrawing AI permission prevents pending follow-ups from starting. Day-plan drafts and selected calendar snapshots expire after 30 days. Open tasks remain until you remove them; completed or dismissed tasks expire after 30 days. Removing a task does not remove earlier conversation or plan copies; remove those separately or delete your account to remove all live cloud copies. No recurring AI processing or external calendar changes are enabled by saving a plan. Saved conversation context can include tool queries and results used to continue the work. Removing personal context prevents its future use; deleting the workspace also removes its saved conversation context. Your profile, manually saved or automatically learned memories and active connections remain until you change or remove them or delete your account. Disconnecting removes saved provider credentials and prevents further tool access; actions already sent may have completed. Account deletion also removes these records and pending authorization attempts. Delete a conversation individually, or open You, tap Settings, choose Delete all my data, review the account, choose Delete my account, then confirm Delete account and workspaces to remove your live Crew cloud records. If asked, sign in again with your linked provider to confirm your identity. This requires an internet connection. If interrupted, reconnect and retry Delete all my data; the app keeps a recovery record until completion is confirmed. Deletion does not undo email already sent or other changes made in connected apps. Account deletion also removes the Firebase account and invalidates its session. A content-free mission deletion marker remains until its original expiry to stop delayed requests from restoring deleted content. Account deletion clears these markers and leaves a hashed account marker scheduled for expiry after 24 hours. To recover from interrupted deletion, a scoped deletion receipt is kept for 30 days. While pending it contains the account identifier needed to finish deletion. After completion that identifier is removed; only hashed identifiers, proof and status metadata remain. Retrying a pending deletion refreshes its recovery period. Saved computer removal also requires E2B cleanup; account access is revoked while that cleanup is pending. Google Cloud performs expiry cleanup asynchronously. Aggregate usage counts have no prompts and expire after two days. Our normal Google Cloud log bucket retains infrastructure request and service logs for 30 days; Google's required administrative and access audit log bucket retains its logs for 400 days. Crew does not intentionally log prompts, authentication tokens or deletion capabilities. Database point-in-time recovery is disabled.
Your choices
Crew is for adults aged 18 and older. Using AI requires your consent in the app. No advertising or cross-app tracking is included. Anonymous sessions are tied to this installation; reinstalling or losing device credentials can remove access to previous missions. Contact us for privacy or deletion assistance at hello@sinuosity.ai.