Privacy Policy

Last updated: November 3, 2026 · Messiah by Sonnev. This policy explains what Messiah collects, how we use and protect it, and the controls you have. Questions? Email hello@sonnev.com or visit contact.sonnev.com.

1. What We Collect

What you give us

Account details: your Telegram user ID, username, first name, timezone, and any contact details you choose to share.
Your conversations with Messiah: the messages and instructions you send and the responses Messiah generates for you.
Memories and reminders: facts and preferences you ask Messiah to remember (/memories), scheduled reminders (/reminders), and the work Messiah performs on your behalf.
Approval history: a log of sensitive or write actions you explicitly approved or denied through Messiah’s confirmation buttons.
Support messages: information you send when contacting our support or security teams.

What we collect automatically

Usage and tool activity: how you interact with Messiah, including command usage, tool execution status, approval decisions, and daily message quota counts.
Technical and diagnostic data: basic request metadata (such as IP address, timestamps, and error logs) required to keep our webhooks, APIs, and website reliable and secure.

What we get from connected accounts

Connected apps: when you connect third-party services (such as Gmail, Google Calendar, Google Drive, Notion, Slack, GitHub, Linear, Outlook, or other integrations via /connect), Messiah accesses the data in those accounts needed to carry out your instructions in real time.
No passwords stored: Messiah never sees or stores your third-party passwords. Accounts are linked via secure OAuth handled by our integration provider (Composio).
Live access, not bulk mirroring: Messiah reads connected app content live to answer your questions and does not bulk-copy your inbox, calendar, or drive into our database.

2. How We Use Your Data

We process your information only to provide, secure, and improve Messiah. Under applicable data protection laws (including EU and UK GDPR), we rely on the following legal bases:

To run Messiah and do what you ask — reading connected apps at your request, drafting or executing actions you approve, delivering scheduled reminders, and managing connected integrations (performance of a contract, Art. 6(1)(b)).
To personalize your assistant — applying your timezone and the memories or preferences you ask Messiah to remember (performance of a contract, Art. 6(1)(b)).
To enforce human-in-the-loop safety — holding write actions (sending emails, creating events, modifying or deleting data) for your explicit approval before execution (performance of a contract & legitimate interests in user safety, Art. 6(1)(b), 6(1)(f)).
To support you and send operational notices — delivering sign-in link codes (/link), reminder notifications, and responses to support inquiries (performance of a contract, Art. 6(1)(b)).
To keep Messiah secure and prevent abuse — verifying webhook signatures, enforcing rate limits and daily quotas, and detecting fraud or unauthorized access (legitimate interests in a secure service, Art. 6(1)(f)).
To maintain and improve the Service — debugging errors and ensuring reliable uptime (legitimate interests, Art. 6(1)(f)).
To meet legal obligations and enforce our Terms (legal obligation, Art. 6(1)(c) & legitimate interests, Art. 6(1)(f)).

No selling data or ad targeting: We do not sell your personal information, and we never use your conversations or connected app data for advertising. We do not use your private communications or connected workspace data to train generalized foundational AI models.

3. How We Share Your Data

We share data only as necessary to operate Messiah and fulfill your requests:

Infrastructure and service providers: cloud hosting and serverless execution (Vercel), database hosting (Supabase), scheduled cron workers (Cloudflare), OAuth and tool integration routing (Composio), messaging delivery (Telegram), and AI model providers (such as Google, Anthropic, or OpenAI) strictly to process and respond to your prompts.
Connected services at your direction: when you ask Messiah to act in a connected app and tap Approve, Messiah sends the required payload to that service on your behalf.
Legal and safety disclosures: when required by law, regulation, or valid legal process, or when necessary to protect the rights, security, or safety of Messiah by Sonnev, our users, or the public.
Business transfers: in connection with a merger, acquisition, financing, reorganization, or sale of assets involving Sonnev, subject to the protections of this Privacy Policy.
With your consent: whenever you direct or authorize us to share information with another person or service.

4. Google User Data & Limited Use

Messiah only accesses your Google data (such as Gmail messages, Google Calendar events, and Google Drive files) after you explicitly connect your Google account, and uses it solely to provide the user-facing features you request. Our use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

We do not sell Google user data or use it for advertising or marketing.
We do not use Google user data to train generalized or foundational AI/ML models.
Humans at Messiah by Sonnev do not read your Google data unless you explicitly ask us to for support, it is required to investigate a security incident or abuse, or we are required to do so by law.
You can disconnect your Google account at any time from your Google Account Security Settings.

5. Cookies and Tracking

Our website uses only essential cookies and local storage required for security and core functionality. We do not run third-party cross-site advertising trackers or sell browsing activity to ad networks.

6. Your Choices, Controls, and Rights

You can inspect and control your data directly inside Messiah at any time using built-in commands:

/memories and /forget <id> — view every fact Messiah remembers about you and delete any specific item.
/reminders — inspect your upcoming scheduled reminders.
/apps — view all currently connected third-party integrations.
/reset — immediately clear your chat message history while keeping your saved memories and connected apps intact.
/delete_me — permanently erase your entire account, including all messages, memories, reminders, approval logs, and tokens.

Depending on where you live (including the EU, UK, and California), you may also have statutory rights to access, correct, delete, restrict, or export your personal data, or to withdraw consent. You can exercise deletion immediately via /delete_me or contact us at support@sonnev.com or hello@sonnev.com. We will not discriminate against you for exercising your privacy rights.

7. Retention

We retain your data while your account is active so Messiah can assist you across sessions. When you run /reset, your conversation history is deleted immediately. When you confirm /delete_me (or request account deletion via support), your user record and all linked messages, memories, reminders, link codes, and approval records are erased from our primary database via cascading delete. Residual encrypted backups are overwritten automatically as backup cycles expire.

8. Messaging

Messiah messages you within conversations you initiate on Telegram and sends reminders at the times you schedule. Messiah does not send unsolicited third-party marketing messages. You can stop messages at any time by cancelling your reminders, running /delete_me, or stopping the bot in Telegram.

9. Security

We protect your data using technical and organizational safeguards, including Row-Level Security (RLS) across all database tables, encryption in transit (TLS), cryptographic verification on incoming webhooks, isolated per-user integration sessions, and mandatory confirmation before write actions execute. No system is perfectly secure; if you discover a security issue, please report it to security@sonnev.com.

10. Other Websites and Services

Messiah connects to third-party applications and websites at your direction. Their own privacy policies and terms govern the data you store with or send to them.

11. Children

Messiah is intended for individuals 18 years of age and older. We do not knowingly collect personal information from anyone under 18. If we learn that an account belongs to someone under 18, we will close it and delete its data.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the date at the top of this page and notify users where appropriate.

13. Contact Us

Messiah by Sonnev ( contact.sonnev.com )

General & Privacy Inquiries: hello@sonnev.com
Support: support@sonnev.com
Security Reports: security@sonnev.com
Press & Partnerships: press@sonnev.com · partners@sonnev.com