Privacy policy.

SiKick (sikick.si, the SiKick web app, the Telegram bot @Sikickbot, the guest join pages and the optional SiKick desktop apps) is operated by TimeFyndr. TimeFyndr is the controller for the personal data described in this policy. Our details are in the Who we are block above.

Teams decide what they connect to SiKick (a Telegram group, a Google Drive folder, recordings). If you add information about other people to a workspace, such as a contact's email or phone number, please make sure you may share it.

Account

• Your email address and name.
• Sign-in codes: we email you a one-time code (sent through Resend). There are no passwords.
• Session cookies that keep you signed in on a device (see Cookies), and a beta code if you joined through a beta link.

Workspace content

• Cards, comments, decisions and activity: what is on a project board, and who changed what and when (every change is logged in Activity).
• People and seats: who is on a project and with which seat (owner, lead, member, contact).
• Contacts: a name on a project, with an email address or phone number only if someone adds one.
• Your day: your personal plan, your own tasks, your working hours, time zone and preferences. These are yours; teammates see your work on project cards, not your day.

Telegram

• Messages in groups where a team added @Sikickbot. The bot only reads: apart from one line confirming the link, it never posts, and it never edits or deletes anything. Removing the bot or unlinking the group stops it reading.
• Voice notes and recordings you send to the bot in a private chat (the bot does not reply to them).
• Your Telegram user id, when you link your Telegram account to SiKick so it knows which messages are yours.

Recordings

• Audio recordings made with Kick in in the browser, and their transcripts and notes. On a computer, Kick in records your microphone and the call tab you choose to share: its sound (the other side) and screenshots of what was shown in it.
• People who join with their mic: teammates and guests can join a recorded call from a link (sikick.si/j/…). We then process their name, their microphone audio and when they spoke, so their lines carry their name. A guest first agrees to being recorded, and gives an email address only if they ask for the summary: we send that one email and nothing else. Guests get no access to the board, and the link stops working when the call ends.
• In the optional Mac app, when you allow it: the other side's call audio, screenshots of the screen the call is on and of regions you pin, and window titles (used to name calls and work blocks). Screenshots of your other screens are taken only if you turn on Screenshots of all my screens (off by default), and they stay private to you unless you share them.
• For recordings over 20 minutes we keep only the speech once the transcript is saved; the silent parts are removed.
• Recordings have auto-stop safeguards: after 10 minutes without speech SiKick asks Still in a call? and stops 5 minutes later if no one answers; long recordings stop at 4 hours.

Google Drive

Only if an owner or lead connects Google Drive to a project. SiKick uses the drive.file scope, so it can reach only the files someone picks in Google's file picker, or that SiKick creates (such as a project folder). Details are in Google user data.

"Connect your AI"

You can connect your own AI assistant (for example through MCP and OAuth). It reads only what you can read in SiKick and can only suggest cards, notes and comments; accepting, assigning and deciding stay a person's click. The keys it uses are stored hashed, and you can revoke them at any time. What your assistant does with what it reads is governed by your agreement with its provider.

Notifications, preferences and technical data

• Push notification subscriptions, if you turn notifications on: the address your browser's push service gives us and the keys to encrypt messages to it.
• Appearance preferences (dark, light, paper, auto), stored in a cookie.
• Technical data needed to deliver and protect the service, such as IP address, browser type and request logs, processed by our hosting provider (Fly.io) and by Cloudflare.
• AI and transcription usage per space (amounts and cost, not content), to apply fair-use limits.

We do not use your data for advertising, we do not sell it, and we do not make decisions about you by automated means that have legal or similarly significant effects.

SiKick uses a large language model to suggest cards, notes and decisions from your team's chat and calls. Only what a task needs is sent: the new messages of a sync, one transcript, one card; never whole databases.

• Requests go through an AI API (OpenRouter), set to route only to large language model providers selected for no data retention and no training on your data. Providers based in, or hosting in, China are excluded.
• Suggestions can be wrong. They are only suggestions: a person accepts, edits or skips each one, and Activity records who.
• Transcription (speech to text) runs on our own servers with Whisper, at our hosting provider in Frankfurt (EU); recording audio is not sent to an outside transcription service.
• The Mac app's voice commands use Apple's speech recognition on the device only.

SiKick's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

What SiKick can access

SiKick asks Google only for the drive.file scope. With it, SiKick can use only the files a person picks in Google's file picker (Google Picker) and the files and folders SiKick creates. We don't read any other content in your Drive. Picking a folder does not give SiKick the files inside it.

What we store

• For each file attached to a card: the file id, name, type, thumbnail link and web link, which card it is on, and who attached it and when.
• The project's folder ids (and the folder's name and link).
• The Google account email that connected Drive, the scopes Google granted, and an OAuth refresh token, which is encrypted (AES-256-GCM) and bound to that one project.

File contents are not copied to SiKick. Thumbnails are fetched from Google when someone views a card and passed through to the browser without being stored. To show Google's file picker, the browser of the project member who uses it receives a short-lived access token from Google.

How we use it

• Google user data is used only to provide the Drive features the user asked for: showing and attaching files on cards, the project folder, and creating the folders you ask for.
• It is not used for advertising and it is not sold.
• It is not used to train AI models, ours or anyone else's.
• Humans don't read it, except with your consent, when needed for security (for example investigating abuse), or as the law requires.
• It is not transferred to others except as needed to provide these features, for security, or as the law requires.

Disconnect

An owner or lead can Disconnect Google Drive in the project's Settings. That revokes SiKick's access at Google and deletes the stored token; files already on cards keep their name and link. You can also remove SiKick's access in your Google Account at myaccount.google.com/permissions.

We use a small number of service providers (processors and sub-processors). They process data only on our behalf and only for the purpose listed.

Telegram and Google are also independent services with their own terms and privacy policies, which apply to your use of them. We may share data when the law requires it, or to protect the rights, safety and security of SiKick and its users.

SiKick runs at our hosting provider Fly.io, on servers in Frankfurt, Germany (EU), where your data and its backups are stored. Each project has its own database. Data leaves the European Economic Area only through the providers listed above (for example when an AI request is processed or an email is sent), and only with appropriate safeguards, such as the European Commission's Standard Contractual Clauses or an adequacy decision like the EU-US Data Privacy Framework.

Messages the bot already read stay in the project after a group is unlinked, until the team deletes them or the project. Deleted data can live on in backups until those copies are rotated out.

• All traffic is encrypted in transit (HTTPS).
• Sign-in uses one-time email codes; there are no passwords to leak.
• Google refresh tokens are encrypted (AES-256-GCM); API and AI-assistant keys are stored only as hashes.
• Access inside a project follows seats: owners, leads, members and contacts see and change different things, and every change is logged.
• Backups are stored with owner-only access, and we encrypt backup copies kept off the server.

No system is perfectly secure. If a breach affects your personal data, we will inform you and the authorities as the law requires.

Under the GDPR you have the right to:

• Access the personal data we hold about you;
• Correct data that is wrong or incomplete;
• Delete your data ("right to be forgotten");
• Export your data in a common, machine-readable format (portability);
• Object to processing based on legitimate interests, and to restrict processing;
• Withdraw consent for anything you turned on, at any time.

Email [email protected] from the address on your account. We answer within one month. Some content belongs to a team's workspace as well as to you; in that case we may involve the project's owner.

You can also complain to a data protection authority. In the Netherlands that is the Autoriteit Persoonsgegevens; you can also contact the authority where you live or work.

SiKick records only when you start it (or a call you set the Mac app to pick up), and it always shows a visible indicator while it records. Someone who joins with their mic sees who is recording and a recording indicator the whole time, and a guest must agree to being recorded before their mic turns on; Leave stops their mic at once.

SiKick uses only strictly necessary cookies. There are no analytics, tracking or advertising cookies and no analytics scripts, so we don't ask for cookie consent.

The app also keeps small preferences (such as a chosen board view) in your browser's local storage. Cloudflare may set its own strictly necessary security cookies.

SiKick is a work tool and is not meant for anyone under 16. We don't knowingly process children's data; if you think a child has given us data, contact us and we will delete it.

When SiKick changes, this policy may too. We'll update the date at the top, and for important changes we'll tell you in SiKick or by email before they take effect.

Questions or requests about your data: [email protected]. Our postal address and registration are in the Who we are block. See also the Terms of use.