Privacy Policy

Last updated: 9 June 2026

This Privacy Policy explains how Lily ("Lily", "we", "the service") — a personal AI assistant operated by Peter Kim (the "operator"), contactable at the email at the bottom of this page — collects, uses, and protects your information.

1. Information we collect

• Messages & assistant memory: the messages you send your assistant and the facts it remembers at your direction (preferences, people, plans).
• Account & channel data: your Telegram user ID (to route messages to your account) and basic settings (assistant name, language, timezone).
• Usage data: token/cost counters used to manage your usage allowance.
• Google data (only if you connect it): if you choose to connect Google Calendar, we access your calendar events and availability to provide scheduling features you request. We request the Calendar scope only. We do not access your Gmail, contacts, or other Google data.

2. How we use your information

Solely to provide the assistant to you: to respond to you, remember what you ask it to, search the web on your request, and — if connected — view and manage your calendar as you direct. We do not use your information for advertising, and we do not sell it.

3. Who we share it with

• Anthropic — your messages and relevant context are sent to Anthropic's Claude API to generate responses. Anthropic processes this as our AI provider.
• Google — if you connect Google Calendar, requests are made to Google's Calendar API on your behalf.
• Infrastructure — data is stored in a managed PostgreSQL database (hosted on Railway).
• The operator who hosts the service can technically access stored data (true of any hosted service); we limit this to operating and supporting the service.
• We do not otherwise sell or share your personal information.

4. Google API Services — Limited Use

Lily's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, Google Calendar data is used only to provide and improve the user-facing calendar features you request; it is not transferred to others except as needed to provide those features, to comply with law, or with your consent; it is not used for advertising; and no humans read it except where you ask, for security, to comply with law, or in aggregated, anonymized form.

5. Your data & deleting it

You can delete your information at any time. Specifically, you may:

• Forget specific things — ask your assistant (e.g. "forget my address").
• Delete everything — request deletion of your entire account and all associated data (conversations, memory/profile, usage records, and any connected-account tokens). Just tell your assistant to "delete all my data", or email us at the address below. We will action the request and permanently delete your data from the live service without undue delay; it then rolls out of routine backups within about two weeks, after which it is purged.

You can revoke Google access at any time from your Google Account permissions or by asking us; revoking it deletes the stored Google tokens. We otherwise retain your data only while your account is active or as needed to provide the service.

6. Security

Each user's data is isolated at the database level (row-level security). Sensitive credentials such as Google refresh tokens are encrypted at rest. Connections use HTTPS/TLS.

7. Your rights

Subject to applicable law (including Korea's Personal Information Protection Act, PIPA), you may request access to, correction of, or deletion of your personal information, and you may withdraw consent at any time. To exercise these rights, contact us below.

8. Children

The service is not directed to children and is intended for adults.

9. Changes

We may update this policy; material changes will be reflected by the "Last updated" date above.

10. Contact

Questions or requests: [email protected].