Beck Privacy Policy

Effective Date: April 24, 2026
Last Updated: April 24, 2026

This Privacy Policy describes how Tribe Industries Inc., a Utah corporation ("Tribe Industries," "we," "us," or "our"), collects, uses, discloses, and otherwise processes personal information in connection with the Beck mobile application and related services (collectively, the "Service"). This Policy applies to users of the Service worldwide and forms part of our Terms of Service.

If you do not agree with this Policy, do not install, access, or use the Service.

1. Who We Are (Data Controller)

For purposes of the EU/UK General Data Protection Regulation ("GDPR"), the data controller is:

Tribe Industries Inc.
23 North Scenic Hills Circle
North Salt Lake, UT 84054
United States
Email: privacy@beck.app

We have not appointed a Data Protection Officer, but you may direct all privacy inquiries to the email address above.

2. Scope

This Policy covers personal information we process when you:

Download, install, open, or use the Beck mobile application;
Create or sign in to a Beck account;
Interact with our AI features, including chat, scheduling, and schedule-scanning;
Subscribe to a paid plan or start a free trial;
Contact us for support, feedback, or any other inquiry; or
Otherwise interact with the Service.

This Policy does not cover information processed by third-party services you connect to Beck (e.g., your Apple Calendar, Google Calendar, or Microsoft Exchange account), websites we do not operate, or offline interactions. Your use of those services is governed by their own privacy policies.

3. Information We Collect

We collect the categories of information described below. Most processing happens locally on your device. We only transmit data to our servers or third parties when necessary to provide the Service.

3.1 Information You Provide Directly

Account information. When you create an account, we collect your email address, a hashed password (if you use email/password sign-in), and, if you use Google Sign-In, the identifying information Google returns to us (typically your Google account ID, email, and name).
Subscription information. When you start a free trial or purchase a subscription, Apple processes the payment; we receive a transaction identifier, subscription status, renewal date, and price tier from Apple and Superwall. We do not receive your full payment card number, CVV, or bank account details.
Chat messages and prompts. When you interact with Beck's AI, the text you type (and any images you attach via the Scan Schedule feature) is sent to our backend and then to our AI provider for processing.
Meeting notes and pasted content. When you paste notes into Beck or use in-app recording, the resulting text is stored on your device and, when relevant, included in prompts sent to our AI provider.
Support communications. If you email us, we receive the contents of your message and any attachments.

3.2 Information Collected Automatically From Your Device

With your permission (and only with your permission), Beck accesses the following on-device information:

Calendar data (via Apple EventKit). Event titles, times, locations, attendees, notes, and recurrence rules for calendars you have configured on your device (iCloud, Google, Exchange, etc.). Beck reads a rolling window (approximately 90 days in the past and 30 days in the future) to provide context to the AI. Events are not copied to our servers in bulk; relevant excerpts are included in individual AI prompts on an as-needed basis.
Contacts (via Apple Contacts). When you grant permission, Beck reads contact names and email addresses to help the AI understand who you're meeting with. Contact data is processed on-device; names and addresses relevant to a given request may be included in AI prompts.
Microphone and speech. When you use in-app recording, Beck captures audio locally and transcribes it using Apple's on-device speech recognition (SFSpeechRecognizer with on-device recognition required). Audio never leaves your device. The resulting text transcript is stored locally and may be sent to our AI provider if you ask Beck to summarize or act on it.
Photos and camera. When you use Scan Schedule, you choose an image from your photo library, take a photo, or use the document scanner. The selected image is processed and sent to our AI provider to extract calendar events.
Device and usage information. We automatically collect technical information such as your device model, operating system version, app version, time zone, locale, crash logs, and anonymized usage events (e.g., "scan_schedule_started"). This information is used to operate, secure, and improve the Service and is not used to identify you personally.

3.3 Information From Third Parties

Apple. Subscription status, transaction identifiers, and App Store receipt data.
Google (if you sign in with Google). Your Google account ID, email address, and display name. We do not request access to your Gmail, Google Drive, or Google Calendar through Google Sign-In; we only use it for authentication.
Superwall. Subscription and paywall analytics events tied to your anonymous user identifier.

3.4 Sensitive Information

Calendar and contact data may contain information that is sensitive to you personally, such as health appointments, legal matters, or private relationships. We treat this information with heightened care: it is encrypted in transit, processed only to fulfill your requests, and not used for advertising, training AI models, or profiling.

We do not knowingly collect: government ID numbers, Social Security numbers, precise geolocation, biometric identifiers, genetic data, financial account numbers, credentials (other than your Beck password hash), or information about racial or ethnic origin, religious beliefs, union membership, sex life, or sexual orientation, except to the extent you voluntarily include such information in your calendar, contacts, notes, or chat messages.

4. How We Use Your Information

We use personal information for the following purposes:

Purpose	Categories Used	Legal Basis (GDPR)
Provide the core Service (chat, scheduling, Scan Schedule, Entity Brain)	Account info, chat content, calendar, contacts, meeting notes, device info	Performance of a contract (Art. 6(1)(b))
Authenticate users and secure accounts	Account info, device info	Performance of a contract; legitimate interests in security (Art. 6(1)(f))
Process subscriptions, trials, and billing	Subscription info, account info	Performance of a contract
Send transactional messages (receipts, security alerts, service updates)	Account info	Performance of a contract; legitimate interests
Diagnose crashes, debug, and improve the Service	Device info, anonymized usage events	Legitimate interests in operating and improving the Service
Respond to support requests	Support communications, account info	Legitimate interests; performance of a contract
Comply with law, enforce our Terms, prevent fraud	Any relevant category	Legal obligation (Art. 6(1)(c)); legitimate interests
Send optional product announcements (with opt-out)	Account info	Consent (Art. 6(1)(a)) or legitimate interests, as applicable

We do not use your personal information to train AI models. Our AI provider (Anthropic) has contractually agreed not to train its models on API inputs or outputs transmitted through our account.

We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act ("CCPA") as amended by the CPRA.

5. How We Share Information

We disclose personal information only as described below. Each third party listed is a "service provider" or "processor" that handles data on our behalf under written contract.

Anthropic, PBC — Our AI provider. We send your chat messages, relevant excerpts of your calendar and contact data, uploaded images, and meeting notes to Anthropic's Claude API to generate responses. Requests are proxied through our backend so that Anthropic does not see your account identity. Anthropic's processing of API data is governed by its Commercial Terms of Service and Privacy Policy.
Supabase, Inc. — Our backend provider. Hosts our authentication service, database (storing account records and subscription state), and the Edge Function that proxies AI requests.
Apple, Inc. — Processes payments, hosts the App Store, and operates the underlying calendar, contacts, and speech-recognition frameworks on your device.
Superwall Labs, Inc. — Manages paywall configuration, subscription lifecycle, and associated analytics.
Google LLC — If you choose Google Sign-In, Google authenticates you and returns identifying information to us.
Professional advisors. Lawyers, accountants, insurers, and auditors under duties of confidentiality.
Successors in interest. In connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, subject to standard confidentiality protections.
Legal and safety disclosures. When required by subpoena, court order, or applicable law; to enforce our Terms; to protect the rights, property, or safety of Tribe Industries, our users, or others; or to investigate fraud or abuse.
With your direction. When you explicitly direct us to share information (for example, by forwarding a support email with attachments).

We do not disclose personal information to advertisers, data brokers, or marketing partners.

6. International Data Transfers

Tribe Industries is based in the United States, and our primary infrastructure providers (Supabase, Anthropic, Apple, Google, Superwall) operate servers in the United States and other jurisdictions. If you access the Service from the European Economic Area, the United Kingdom, or Switzerland, your personal information will be transferred to, stored in, and processed in the United States and potentially other countries whose data protection laws may differ from those of your country.

Where such transfers occur, we rely on:

Standard Contractual Clauses adopted by the European Commission (and the UK International Data Transfer Addendum where applicable) with each processor; and
Supplementary measures including encryption in transit (TLS 1.2+), encryption at rest for stored records, and strict access controls.

You may request a copy of the relevant transfer mechanism by emailing privacy@beck.app.

7. Data Retention

We retain personal information only for as long as necessary to provide the Service and fulfill the purposes described in this Policy, unless a longer retention period is required by law.

Data	Retention
Account record (email, hashed password, Google ID)	Until you delete your account, then up to 30 days in backups
Chat messages (server-side)	Not retained server-side after the response is returned; retained locally on your device until you delete them
Calendar / contact excerpts in AI prompts	Processed in-memory for the duration of the request; not persisted server-side
Meeting notes / transcripts	Stored locally on your device in SwiftData; not stored server-side
Subscription records	For the life of your subscription plus 7 years (tax and accounting)
Support emails	3 years from last correspondence
Crash logs / diagnostic data	90 days
AI provider logs (Anthropic)	Per Anthropic's retention terms — currently up to 30 days, as described in its Commercial Terms

When you delete your account, we delete or anonymize associated personal information on the schedule above. Some records may be retained longer to comply with legal obligations, resolve disputes, or enforce agreements.

8. Your Privacy Rights

8.1 Rights for Everyone

Regardless of where you live, you can:

Access your account information from within the app.
Correct inaccurate account information from within the app or by emailing us.
Delete your account and associated data by using the in-app "Delete Account" control or by emailing privacy@beck.app. We will complete deletion within 30 days.
Export a copy of your account data by emailing privacy@beck.app.
Revoke permissions for calendar, contacts, microphone, or speech recognition at any time via iOS Settings → Beck.
Unsubscribe from optional product emails via the link in each message.

8.2 Rights Under the GDPR (EEA, UK, Switzerland)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you additionally have the right to:

Object to processing based on our legitimate interests;
Restrict processing in certain circumstances;
Port your data to another controller in a structured, commonly used, machine-readable format;
Withdraw consent at any time where processing is based on consent (without affecting the lawfulness of prior processing);
Lodge a complaint with your local supervisory authority (for the UK, the Information Commissioner's Office at ico.org.uk; for other EEA countries, see edpb.europa.eu).

To exercise these rights, email privacy@beck.app. We will respond within one month, extendable by two months for complex requests. We may need to verify your identity before fulfilling certain requests.

8.3 Rights Under the CCPA/CPRA (California Residents)

If you are a California resident, you have the right to:

Know / Access the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of third parties with whom we shared it, over the preceding 12 months.
Delete personal information we have collected, subject to statutory exceptions.
Correct inaccurate personal information.
Limit the use and disclosure of sensitive personal information to what is necessary to provide the Service. We already do this by default; we do not use sensitive information for secondary purposes.
Opt out of the sale or sharing of personal information. We do not sell or share personal information as those terms are defined under the CCPA, so there is nothing to opt out of. If this ever changes, we will update this Policy and provide an opt-out mechanism at least 30 days in advance.
Non-discrimination — we will not deny service, charge different prices, or provide a different level of quality because you exercised a CCPA right.
Authorized agent — you may designate an authorized agent to make a request on your behalf by providing signed, written permission that we can verify.

To exercise these rights, email privacy@beck.app with "CCPA Request" in the subject line. We will verify your identity using your account email and will respond within 45 days (extendable once by 45 days).

California Shine the Light. California Civil Code § 1798.83 allows California residents to request information about disclosures of personal information to third parties for their direct marketing purposes. We do not make such disclosures.

8.4 Other U.S. States

Residents of states with comprehensive privacy laws (including Colorado, Connecticut, Virginia, Utah, Oregon, Texas, Montana, and others) have rights substantially similar to those described above, which we extend to you. Contact privacy@beck.app to exercise them.

9. Children

The Service is intended for users 13 years of age or older. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided personal information to us, email privacy@beck.app and we will promptly delete it.

In jurisdictions where the digital age of consent is higher than 13 (including parts of the EEA where it can be up to 16), the Service is available only to users who meet that age or who have verifiable parental consent.

10. Security

We use commercially reasonable administrative, technical, and physical safeguards designed to protect personal information, including:

TLS 1.2+ encryption in transit;
Encryption at rest for stored account and subscription records;
Hashed passwords using industry-standard algorithms;
Least-privilege access controls and audit logging on backend systems;
On-device processing (via SwiftData, EventKit, and Apple's on-device speech recognition) wherever technically feasible, minimizing data sent to our servers.

No system is 100% secure. If you believe your account has been compromised, email privacy@beck.app immediately.

11. Automated Decision-Making

Beck uses generative AI to suggest calendar actions. No suggestion is applied without your explicit confirmation. All AI write actions (creating, rescheduling, or deleting events) require a confirmation card that you must approve before any change is made to your calendar. We do not use automated decision-making that produces legal or similarly significant effects on you within the meaning of Article 22 GDPR.

12. Cookies and Analytics

The mobile application does not use cookies. Any marketing website we operate may use strictly necessary cookies for its basic function; when we add analytics or other non-essential cookies, we will present a consent banner where required.

13. Do Not Track

Because there is no industry-standard way to interpret browser Do Not Track signals, we do not currently respond to them. Where the Global Privacy Control signal is required by law (including California), we treat a GPC signal as an opt-out of sale/sharing.

14. Third-Party Links and Services

The Service may contain links to third-party websites or services (for example, our AI provider's website, or support articles from Apple). We are not responsible for the privacy practices of those third parties. We encourage you to read their privacy policies.

15. Changes to This Policy

We may update this Policy from time to time. When we make material changes, we will update the "Effective Date" and "Last Updated" dates above and, where required by law, provide additional notice (for example, in-app notification or email). Your continued use of the Service after the effective date of the updated Policy constitutes your acceptance of the changes.

16. Contact Us

If you have questions, concerns, or requests regarding this Policy or your personal information, contact us at:

Tribe Industries Inc.
Attn: Privacy
23 North Scenic Hills Circle
North Salt Lake, UT 84054
United States
Email: privacy@beck.app