TL;DR
- We don't resell your data or use it for AI training.
- We store your data in Supabase with strict row‑level security.
- We host the app on Vercel.
- We use the Vercel AI SDK to call AI models; your data is not used to train them.
- Sign in with email or Google. See Third-party sign-in for what Google shares with us.
- We use Resend to send essential emails.
- Optional: You can import from Todoist; we only use that data in-app.
- Optional: On Android, you can sync wearable health data from Health Connect (sleep, heart rate, HRV, SpO₂, steps, weight, and workouts). You choose which devices to include, and we only read what you authorize.
- You can delete your account and all your data at any time, no questions asked.
Introduction
BigPicture ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and share your information when you use our personal productivity and health-tracking service.
Information We Collect
When you use BigPicture, we collect:
- Account information (via email or Google sign-in; see Third-party sign-in)
- Content you create (notes, todos, habits, and related data)
- Mood ratings, nutrition logs, and other health-related entries you add in the app
- Optional wearable metrics you choose to sync from Health Connect on Android (sleep, heart rate, HRV, SpO₂, steps, weight, and workouts)
- Optional imports you authorize (e.g., Todoist)
- Space and collaboration data (if you use shared workspaces)
- Usage data and analytics
Third-party sign-in (Google)
BigPicture lets you create an account and sign in with Google through Supabase Auth. We use Google sign-in only to authenticate you and populate basic account details. We do not use Google sign-in to access Gmail, Drive, Calendar, contacts, or other Google services.
When you choose Continue with Google, Google may share the following with BigPicture (via Supabase):
- Email address (used as your account identifier and for essential account emails)
- Name (display name in the app; you can update it in Settings)
- Profile picture URL (optional; shown if Google provides it)
- Google account ID (a unique identifier Supabase stores to link your login; not shown in the product UI)
How we use this information: to create and secure your account, keep you signed in, associate your notes and other workspace data with the correct user, and send transactional messages (for example sign-in or security-related email). We do not sell Google account data, use it for advertising, or use it to train general-purpose AI models.
Where it is stored: Authentication records are stored by Supabase (see Third-Party Services). Your profile fields live in your BigPicture account like other account data and are protected by row-level security.
Your choices: You can sign in with email (magic link) instead of Google. You can revoke BigPicture’s access in your Google Account permissions at any time. Deleting your BigPicture account removes the workspace data we hold; contact us if you need help with auth records.
Google’s use of information collected about you is described in Google’s Privacy Policy. Supabase’s role as our auth provider is described in Supabase’s Privacy Policy.
How We Use Your Information
We use your information to:
- Provide and improve our productivity and health-tracking features
- Generate insights and briefs from your activity, mood, and optional wearable data
- Enable space and collaboration features
- Communicate with you about your account
- Analyze usage patterns to improve our service
Third-Party Services
We use several third-party services to power BigPicture:
- Supabase: Database and authentication. Your data is stored in secure Postgres with RLS.
- Vercel: Application hosting and content delivery.
- Vercel AI SDK: Access to AI models. We use providers that do not train on your data.
- Google (OAuth): Sign-in only; see Third-party sign-in (Google) above for data shared and how we use it.
- Resend: Transactional email delivery (e.g., login links, notifications).
- Todoist: Optional connection for imports when you explicitly authorize it.
- Health Connect (Android): Optional read access to health metrics stored on your device when you connect wearables in Settings. BigPicture does not write health data back to Health Connect in the current release.
Health and Wearable Data
If you use the Android app and connect Health Connect, BigPicture can read health metrics that your wearable or health apps have written to Health Connect (for example from Ringconn, Oura, Garmin, or Withings, depending on what you have enabled on your phone).
- Your choice: Sync is optional. You grant permissions in Health Connect and choose which detected data sources to include in BigPicture.
- What we read: Sleep, heart rate, resting heart rate, heart rate variability (HRV), blood oxygen (SpO₂), steps, weight, and workouts, within the scopes you approve. We do not write health data to Health Connect.
- How we use it: To show summaries on your Health page and to inform optional AI features (e.g. Daily briefs). When heart rate stays high and you did not save a workout, BigPicture can add a detected effort on your Health page. You can edit or delete it. We do not sell this data or use it to train AI models.
- Where it is stored: After sync, copies are stored in your BigPicture account on Supabase, protected by row-level security, like your other account data.
- Revoking access: You can turn off individual sources in BigPicture Settings, revoke BigPicture’s permissions in Health Connect, or delete your account to remove stored health metrics.
- Not medical advice: Wearable and synced data is for personal wellness tracking only. BigPicture is not a medical device and does not provide medical advice, diagnosis, or treatment.
Health Connect itself is provided by Google and stores data on your device according to Google’s policies. BigPicture only accesses Health Connect when you use the mobile app and initiate or allow a sync.
Data Storage and Security
Your content and personal data are stored securely on Supabase's infrastructure using their PostgreSQL database. We implement row-level security policies so your private data remains private, and space data is only accessible to authorized members.
Data Retention
We retain your content, health metrics, and account information until you choose to delete them. You can delete individual items or your entire account at any time through the application interface.
Your Rights
You have the right to:
- Access your personal information
- Delete your content and account
- Export your data where the product provides export options
- Control sharing settings for space and collaboration features
- Revoke Health Connect or other optional integrations
- Object to processing of your information
Space and Collaboration Privacy
When using shared spaces:
- Personal content remains private unless explicitly shared
- Space owners can manage member access
- You control which content is shared within a space
- Synced wearable health data is tied to your user account and is not shared with other space members unless you explicitly add sharing for that data in a future feature
Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date.
Contact Us
If you have any questions about this Privacy Policy, please contact us at info@bigpicture.guru.