Privacy
Your data and your control.
You choose which accounts to connect. Sources inform your recommendations; Plan changes require your acceptance.
Core commitments
- Flair only reads from the accounts and signal modes you connect.
- Multi-account provenance is preserved so one inbox or calendar does not silently contaminate another.
- Workspace connections are read-only. Flair does not send email or change your calendar.
- Privacy and policy boundaries remain visible in product surfaces, not buried behind generic claims.
Launch-surface trust summary
Flair reads
- Inbox sender, thread timing, and message context only through approved MCP connectors
- Calendar events and time pressure only through approved MCP connectors
- Accepted plan state, execution artifacts, and progress signals inside Flair
Flair does not do
- No hidden email sends
- No silent calendar writes
- No cross-account mixing when policy blocks it
- No background execution without an explicit user action
Disconnecting and deleting
Disconnecting stops future collection from that connection. It does not erase information already saved in your Flair account. You can request account deletion from Account, including after paid access ends.
Deletion pauses your account, cancels its Stripe subscriptions, revokes supported Google and wearable connections, and removes active Flair records and uploaded files. Identity is deleted last. If a provider or file cleanup fails, you can sign in to retry the saved request; Flair does not report completion until those steps succeed.
Deletion does not remove original emails, calendars, or wearable records from the services you connected. Those providers control their own retention. Stripe may retain transaction records for its legal and financial obligations.
If you connect through Junction, accepting deletion disconnects its provider connections immediately. Junction documents a seven-day grace period before erasing its user data. A stored deletion acknowledgement does not confirm that this later erasure has finished.
For Stridee connections, “Disconnect and remove wearable history” immediately stops Flair from using that source and removes its normalized wearable history. Removal of Flair’s provider connection stays pending until confirmed. This does not delete your original wearable account or its records.
Backups and provider logs can outlive active account data. Flair retains a restricted receipt containing your account identifier, wearable provider identity, scoped connection identifiers and deletion or acknowledgement time to prevent replayed data and to support erasure after recovery. Backup expiry and recovery verification are still being completed before public rollout. Contact support for the status of a deletion or retained backup.