Privacy Policy

Last updated: April 24, 2026

Rocky ("the Service") is a WhatsApp-based executive-assistant agent operated by BugleRock Advisors ("BugleRock", "we", "us"). This Privacy Policy explains what data we collect when you connect your Google Account to Rocky, how we use it, and the controls you have over it.

Data we collect

When you onboard to Rocky via WhatsApp and grant Google OAuth consent, we receive and store the following data from your Google Account:

Profile & email — your name, email address, and Google account ID (openid, userinfo.email, userinfo.profile scopes).
Google Calendar — event summaries, times, attendees, and descriptions of events you ask Rocky to read, create, update, or delete (calendar scope).
Gmail — read-only access to messages you ask Rocky to summarize or reference, and compose-only access to draft emails Rocky writes on your behalf (gmail.readonly, gmail.compose).
Google Drive — read-only access to files you reference when asking Rocky to brief you on a meeting or document (drive.readonly).
Google Tasks — write access to your default task list, used to mirror todos Rocky creates on your behalf (tasks).
WhatsApp metadata — your WhatsApp phone number and the content of messages you send Rocky, received via Twilio's Business API.

How we use your data

To carry out tasks you explicitly ask Rocky to perform (e.g. drafting an email, scheduling a meeting, summarizing a thread, logging an expense).
To maintain short conversational context so Rocky's replies are coherent across a session.
To persist a small set of long-term memories you explicitly ask Rocky to remember (e.g. preferences, recurring project details).

We do not use your data to train machine-learning models, to target advertising, or to build aggregate profiles. We do not sell or rent your data to third parties.

Data storage and security

OAuth refresh tokens are encrypted at rest using Fernet symmetric encryption before being written to the database.
WhatsApp-phone-to-profile mappings and long-term memories are stored in an isolated per-profile directory scoped to your identity.
All traffic between your device, Twilio, our servers, and Google APIs is encrypted in transit via TLS.
Servers are hosted on Google Cloud Platform; access is restricted to authorized BugleRock personnel.

Third-party services we invoke on your behalf

Google — Calendar, Gmail, Drive, and Tasks APIs, for the actions you request. Subject to Google's Privacy Policy.
Twilio — WhatsApp message delivery and receipt. Subject to Twilio's Privacy Notice.
Anthropic — the underlying large language model that interprets your messages. We send Anthropic the conversation context required to generate a reply; we do not send raw credentials or file contents we did not retrieve on your behalf. Subject to Anthropic's Privacy Policy.

Google API Services User Data Policy

Rocky's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Your rights and controls

Revoke access at any time from Google Account → Third-party apps. Rocky will immediately lose the ability to call Google APIs on your behalf.
Delete your data — email irock@buglerockadvisors.com and we will purge your user record, OAuth tokens, message history, and stored memories from our systems within 30 days.
Export your data — same contact address; we'll send a JSON dump of what we hold for you.

Retention

Your account data is retained while your Google consent remains active. If you revoke consent, OAuth tokens become inert immediately and the associated account record is scheduled for deletion within 90 days. Message history is retained for up to 180 days to provide conversational context.

Children's privacy

Rocky is intended for BugleRock Advisors clients and is not directed at children under 16. We do not knowingly collect data from children.

Changes to this policy

We will update this page when the Service's data practices change. The "Last updated" date at the top reflects the most recent revision. Material changes will also be communicated via the email address on file.

Contact

Questions, data-deletion requests, or security concerns: irock@buglerockadvisors.com.