Privacy policy

Who we are

Valmi is an Android app in a private, invite-only beta. This policy covers the app and this website, valmi.app. In it, “we” and “us” mean Valmi.

Questions about your data go to hello@valmi.app.

What Valmi does

You speak or type a request, and Valmi reads and changes your TickTick tasks for you. If you turn on money logging, it also sends spending entries to the Cashew app on your phone. To do that, it needs the data below.

What we collect and why

• Your sign-in identity. Your email address and sign-in details are held by our sign-in provider so you can log in. Valmi itself keeps an account ID, not your name.
• Your time zone, so “tomorrow at 6” means your tomorrow.
• Your TickTick access token, encrypted, so Valmi can act in TickTick for you. We don’t keep a refresh token.
• Your conversations: the messages you send, including the text of your voice messages, and Valmi’s replies.
• A journal of the changes Valmi made, so each change can be checked and shown to you as a card.
• Receipt photos you attach to a message.
• Your Cashew settings (whether money logging is on, your categories and your currency) and a record of each entry handed to Cashew.
• A daily usage counter, for the beta’s fair-use limits.
• Technical logs: when requests happen, how long they take, what failed, and internal IDs for runs and conversations, so we can keep Valmi working. Connection logs can include your IP address. They never contain the text of your messages.
• On this website: the email address you give to join the waitlist, held by our sign-in provider so we can send your invitation.

What we don’t collect

• No ads. We don’t sell or rent your data.
• The app contains no analytics, advertising or crash-reporting kits.
• Your voice audio is streamed for transcription and not stored by us. Only the transcript is kept, as your message.
• Our server logs don’t contain the text of your messages.

Your TickTick data

Your tasks stay in TickTick. Valmi reads and changes them through TickTick’s official API, with permission to read and write your tasks. What Valmi reads or changes can appear in your conversation and in its journal of changes.

You can disconnect TickTick at any time. Disconnecting deletes our copy of the access token and asks TickTick to revoke it.

Cashew

No Cashew server is involved. When you log spending, your phone hands each entry to the Cashew app on the same phone through Cashew’s own add-transaction links, and Cashew applies it when it opens.

Valmi can’t read your Cashew data.

Receipt photos

• Photos are compressed, and their metadata, such as location and camera details, is removed before they’re stored.
• Only you can view them, while signed in.
• A photo is deleted with its conversation. A photo that was uploaded but never attached to a message is deleted after 24 hours.
• To read a receipt, the photo is sent only to providers that state they don’t collect it.

Service providers

We use these kinds of providers to run Valmi:

• Sign-in: holds your email address and sign-in details.
• Database and file storage: stores your account data, conversations and receipt photos.
• Server hosting: runs Valmi’s servers.
• AI model providers: work out what you asked, write the replies and read receipt photos. They receive your messages and the task and spending details Valmi reads or changes for them.
• Speech-to-text: turns your voice into text.
• Server error monitoring: reports server errors, without personal data or message text.

TickTick isn’t one of these providers: it’s the service Valmi connects to for you, where your tasks live.

This website is run by a web host and uses privacy-friendly web analytics that count visits and measure page speed in aggregate, without cookies.

How long we keep data

• Conversations, with their transcripts, receipt photos and Cashew hand-off records, stay until you delete them.
• When you delete a conversation, its messages, transcripts, photos and hand-off records are purged within about an hour.
• If you disconnect TickTick, we delete the access token and ask TickTick to revoke it.
• If you ask us to delete your account, we delete your sign-in account and your TickTick token, and purge your conversations. We keep a minimal marker that the account was deleted. This never touches the data in your TickTick account.

Your choices and rights

• Delete any conversation in the app.
• Disconnect TickTick at any time.
• Email hello@valmi.app to ask what data we hold about you, or to delete your account. There’s no in-app button for account deletion yet.

Security

Your TickTick access token is encrypted before we store it. Your conversations and photos are served only to you, signed in. Our logs don’t record what you write or say.

No system is perfectly secure, but we work to keep your data safe.

Children

Valmi isn’t meant for children under 13, and we don’t knowingly collect their data. If you think a child has given us data, email hello@valmi.app and we’ll delete it.

Changes to this policy

If we change this policy, we’ll update this page and the date at the top.