Privacy policy

Last updated October 28, 2026. Cells is operated by HomeZero PBC. This policy covers our website and apps. Contact hello@cells.md with privacy questions or requests.

Information you provide

We use your email address to create and sign in to your account. We store profile details you provide, conversations, bot memory, files, and the tasks and other work you save. If you use voice or dictation, your microphone audio goes to the speech providers described below for processing. Transcripts and call summaries can become part of your conversations.

Connected Google accounts

Connecting an account is optional. You choose a connector and approve its permissions through Google. We use that access to perform the features you request, including work you authorize through tasks or routines. We do not ask for your Google password.

• Gmail access can include message bodies, attachments, headers, recipients, labels, drafts, and other email metadata. It lets your assistant find and summarize messages. Additional permissions let it prepare drafts, send mail, or organize messages when authorized.
• Other Google connectors can access calendar events and attendees, contacts, Drive files and metadata, document content, spreadsheets, presentations, forms and responses, or tasks. Which information is available depends on the services you connect and the permissions you grant.

Connected content and derived information, such as an email summary, may be saved in your chats, bot memory, files, and task results so your team can continue your work. Vercel Connect manages the access and refresh tokens used to reach connected services. Manage connections and delete saved data.

Email your team reads on its own

While Gmail's “Access emails” permission is allowed, the app checks your new inbox mail every few minutes, without being asked. For most messages it keeps only the headers, sender, subject, and Gmail's short preview, never the message itself, for at most 14 days. Four kinds of email are read in full so the useful facts can be pulled out of them:

• Home listing alerts from Zillow, Redfin, and Realtor.com: each home's address, price, size, listing link, and photo links. These homes are kept for 30 days, and deleted when you disconnect Google or delete your account.
• Flight confirmations, changes, and cancellations: the flights, their times, the booked fare, and what your assistant needs to watch the trip, saved with that trip in your files. Names, ticket numbers, and contact, payment, and loyalty details are not kept. The trip stays until you delete it or your account.
• Showing confirmations: the home's address and the showing time, passed to your assistant in your chat so it can help plan the visit. They stay with your conversations.
• Receipts, orders, and shipping notices: short notes on what you buy and use, saved in your assistant's shopping memory. Order history and amounts are not kept. The notes stay until you delete them or your account.

The emails themselves are not saved to your account. Like any work your assistant does, the run that read one may remain in agent run logs under our providers' retention rules, described under Retention and deletion. Disconnecting Google stops these reads.

Your chief of staff's email

Your chief of staff, Mito, can have its own email address, which you create in the app. Nobody else on your team has one. It sends an email only when you approve it on a card in the chat. If you set Send emails to Allow in Settings, under Connectors, Mito Mail, it writes without asking to people it has already written to or you let in, and still asks before writing to anyone new. Email to your own sign-in address never asks. It can write to at most 10 new people a day; past that, a message waits until 8 in the morning in your time zone. Resend carries the email.

Mail it receives from someone it has already written to, someone you let in, or your own sign-in address is delivered to Mito's chat, where your assistant reads it. Mail from anyone else is held: stored, listed in the Mail tab, and never shown to your assistant until you choose Let in or Ignore. Ignore deletes the thread. Automatic replies, and mail whose sender cannot be verified, are held too. At most 200 held threads are kept, and 20 messages in each; past that, the oldest held thread is deleted with its text, and further mail on a full held thread is not kept.

The text of each email is stored so you can read it in the app, and goes to your selected model provider when Mito reads it. The sender, recipients, subject, a short preview, and times are stored with your account records. Attachments are not kept, only how many there were. Deleting the address, in the same Settings page or by deleting your account, removes it, its threads, and their text, and the address can never be used again. Email already sent stays with its recipients.

Google data and model choice

Information obtained from Google APIs is for your requested assistant features. We do not sell it, use it for advertising, or use it to determine creditworthiness or make lending decisions. These limits also apply to information derived from it.

We send Google content to the selected model provider to perform the work you request. If you explicitly choose Contributor and accept its training disclosure, that provider may also use inputs and outputs for model training. Other sharing is limited to security, legal obligations, or a business transfer with your prior consent.

Google publishes the Google API Services User Data Policy and the Google Workspace API User Data and Developer Policy, including Limited Use requirements that prohibit using Google data to train general-purpose models. The optional Contributor mode does not satisfy that restriction. The app is not Google-verified.

New teams start on Muse Contributor. When connecting Google, the Connect button accepts a disclosure that Meta may use your team's conversations, saved history, memories, Google content and derived content for training. This also applies to background work and future Google connections. Selecting a different model clears this permission for future requests; it does not undo data already processed. Disconnecting Google does not erase saved content.

Connected bank accounts

Where available, you can choose to connect a bank through Plaid. Plaid handles the bank sign-in and permission screens. We receive access to the accounts you select, including account names, masked account numbers, balances, transactions, and recurring income or bills. This connection is read-only and does not let your assistant move money.

We store encrypted connection credentials on our server. Financial information your assistant reads may be included in conversations, summaries, or saved work and processed by your selected model provider. Review the model's data-use disclosure in Settings before sharing financial information, including whether its Contributor option allows training.

Disconnecting Plaid removes its bank connections. Account deletion must finish removing bank access before deleting the credentials needed to do so. If a bank connection or removal is still pending, the app asks you to retry. Resetting your account keeps its connections. Earlier financial information saved in conversations or files follows the retention and deletion rules below. Plaid also processes information under its End User Privacy Policy.

Service providers and sharing

Clerk handles sign-in. Vercel hosts the app, agent sessions, files, execution environments, and logs, and manages connector authorization and the AI Gateway. Convex stores account records and app data shared across your devices. The model provider you select in Settings processes text conversations through Vercel AI Gateway. This may be Meta or another available provider. Google processes live voice. Dictation uses OpenAI through AI Gateway for protected teams, and may use Meta for other teams. Image generation uses Meta through AI Gateway; memory search uses OpenAI embeddings through AI Gateway. Podcast narration uses ElevenLabs and is unavailable to teams protected for Google data. Resend sends and receives your chief of staff's email.

You can choose standard Muse without training, or another available model, in Settings. An existing model choice stays selected when you connect Google. Contributor requires accepting the disclosure when connecting or selecting it in Settings. Existing users are not opted in automatically. This choice does not change the separate no-training routing for images, embeddings or dictation, the paid Google credentials used for live voice, or the podcast restriction. Subquadratic may process auxiliary decisions only for teams without Google data. Review the model information in Settings before choosing one.

PostHog receives usage events and website session replays, with text and form inputs masked. Cookies and browser storage support sign-in, preferences, and analytics. The iPhone app does not include a session replay SDK. Technical information, such as errors and service usage, helps us operate and troubleshoot the service.

If you ask your assistant to use another service or share a result, the information needed for that action goes to that service or recipient. A shared link can be opened by anyone who has it. We do not sell personal data or use conversations for targeted advertising.

The browser and saved logins

When your assistant uses a website, it works in a browser we run for your account, which keeps the pages it visited, its latest screenshots, and the sites you signed in to. Logins you save are encrypted with a key on our servers, so the service can decrypt them to sign in for you; your assistant never receives them, and you can delete them in Settings, under Secure store.

Storage and protection

Account data is associated with your signed-in account. Connected credentials are handled on the server. We use HTTPS for communication with our hosted services and restrict access to account data through authenticated requests. Our service providers process information where they operate, which may be outside your country. To help you with a problem, an operator may open your account and see the app as you do. Every such visit is logged with who did it and why, and any messages they send to your team appear in your chat.

Retention and deletion

We keep account content while your account is open so your conversations and saved work remain available. Disconnecting a service removes its connection from the app and stops new requests using that connection. It does not erase earlier messages, summaries, memories, or files. You can also revoke access in your Google Account connections.

In the app, open Settings, then General, then Delete account. Successful deletion removes your account, clears and retires its chat sessions, and removes the app's account records, bot memory, saved files, saved logins, your browser and what it kept, and shared copies that the app tracks. The deletion process also attempts to revoke connected accounts. Revoke access directly with Google if you want to confirm that authorization has ended.

Deletion is not immediate erasure from every provider system. Agent run logs, service logs, and provider backups may remain under those providers' retention rules. Copies already sent to another person or service, including sent email, remain with that recipient. We do not publish a fixed retention period for these provider records.

You can request access, correction, or deletion by emailing hello@cells.md, including if you cannot sign in. We may need to verify that the account belongs to you. See the connection and deletion guide for the steps.

Changes to this policy

We will update this page when our practices change. If we propose a new use of connected Google data, we will disclose it and request your consent before using it that way.