Privacy Policy

SonderSpot OÜ ("we", "us", "our") operates the Sidekick mobile application ("Sidekick" or the "Service"). This policy describes how we collect, use, and protect your information when you use Sidekick.

Last updated: July 9, 2026

1. Information We Collect

• Account information: If you create an account, we receive your name and email address as provided by your sign-in method. Guest use does not collect personal account information.
• Conversations and prompts: Content you choose to submit may include chat messages, relevant recent conversation context, personalization or project instructions, saved memory or project knowledge, image/video/voice prompts, source images, attachments, extracted document or photo text, live microphone audio, web search queries, and YouTube URLs. Conversation history is stored locally on your device, but relevant context is included in an AI request when needed to answer you.
• Usage data: Basic event data (feature usage, screen views, session duration) collected through analytics SDKs to help us improve Sidekick.
• Subscription data: If you purchase a subscription, your anonymous user identifier is passed to RevenueCat for entitlement management. We do not receive or store payment details.

2. How We Use Your Information

• To provide and deliver Sidekick's AI-powered features (chat, image generation, voice mode, OCR, web search, writing tools).
• To manage accounts, subscriptions, and entitlements.
• To monitor service health, diagnose issues, and improve the app.

3. AI-Powered Features and Your Consent

Before any data is sent to a third-party AI provider, Sidekick shows an in-app consent sheet that explains what may be sent. Data is transmitted only after you explicitly grant permission and request an AI feature. You can revoke that permission at any time from Profile settings, and you can review the provider-by-provider disclosure at Settings > AI Data & Providers.

We do not include your account name, email address, payment details, or authentication token in requests sent to AI providers. Content you type, say, or attach may itself contain personal information, so you should share only content you want the selected provider to process.

Data Sent to AI Providers

• Chat requests — your message, relevant recent conversation context, selected personalization or project instructions, relevant saved memory or project knowledge, and attachments you choose
• Image and video requests — prompts and source images you explicitly provide for generation, editing, or animation
• Voice requests — text used for speech, voice transcriptions, and live microphone audio while you actively use voice mode
• Documents and photos — attached media or text extracted from files, scans, and photos when you ask Sidekick to process them
• Web and transcript requests — a web search query, or a YouTube URL and transcript language when you request those features

Third-Party AI Providers

Sidekick uses the following providers to deliver AI features. The provider that processes a given request depends on the model you select in the app:

• OpenRouter — routes selected chat and video requests to the model provider
• OpenAI — GPT chat, safety moderation, image generation and editing, text-to-speech, and live voice (subject to OpenAI's Privacy Policy)
• Anthropic — Claude chat models (subject to Anthropic's Privacy Policy)
• Google — Gemini chat models and Veo video generation
• MiniMax — MiniMax chat models
• Tavily — web search queries and results
• Supadata — YouTube URL and transcript requests

Most provider traffic is routed server-side through a Cloudflare Worker proxy we operate, so provider API credentials are never exposed to the app. Live voice audio connects directly to OpenAI using a short-lived session token. Sidekick does not use your content to train models; each provider's handling and retention are governed by its terms and privacy policy.

4. Data Storage and Retention

Conversations and message history are stored locally on your device in an on-device database. You can delete individual conversations or clear all data at any time from within the app.

Third-party providers may retain transmitted data in accordance with their own policies and the service configuration used by Sidekick. Consult the applicable provider policy for current retention terms.

5. Analytics

We use PostHog to capture anonymous usage data — screen views, feature interactions, and session metadata — to understand how Sidekick is used and to improve it. PostHog data does not include the content of your conversations or prompts.

6. Service Providers

We rely on the following third parties to operate Sidekick. Each is contractually required to protect your data and use it only to deliver their portion of the Service:

• OpenRouter, OpenAI, Anthropic, Google, MiniMax, Tavily, and Supadata — AI, search, and transcript providers (see Section 3)
• RevenueCat — subscription management
• PostHog — product analytics
• Cloudflare — secure API proxy and edge delivery
• Apple — App Store, authentication, and platform services

7. Security

All communication between Sidekick and our backend uses TLS encryption. Authentication tokens are stored on-device in the iOS Keychain. While we apply commercially reasonable safeguards, no method of transmission or storage is ever 100% secure.

8. Children's Privacy

Sidekick is not directed at persons under 18. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with personal information, please contact us and we will delete it.

9. Your Rights and Data Deletion

You can delete your conversations and locally stored data at any time from within the app. To request deletion of any other personal information associated with your account, please contact us.

10. Changes to This Policy

We may update this policy from time to time. Changes will be posted on this page with an updated effective date. Continued use of Sidekick after an update constitutes acceptance of the revised policy.

11. Governing Law

This policy is governed by the laws of the Republic of Estonia.

12. Contact Us

If you have questions about this policy, please contact us.