Privacy Policy

What data Sidecue collects, why, and the choices you have.

Sidecue · Chrome Extension & Web Dashboard · Effective October 26, 2026

This policy explains what data Sidecue collects, why, and the choices you have. It covers the Sidecue browser extension and web dashboard (together, the “Service”).

Who we are

Sidecue is operated by Michał Włosik EFC, ul. Północna 16/5, 54-105 Wrocław, Poland (NIP: 8942747708). “We”, “us”, and “our” refer to the operator. “You” refers to you, the user of the Service.

What Sidecue does

Sidecue is a Chrome extension and companion web dashboard that provides real-time answer cues during conversations. When you start a session, the extension captures audio from a browser tab, transcribes it in real time, detects questions or talking points, and generates suggested responses in a side panel or floating overlay. Sidecue does not access your microphone.

The dashboard lets you manage your knowledge base (context text and uploaded files), review past session history, and manage your account. Knowledge base content syncs automatically between the dashboard and the extension. Audio is never recorded or stored on any server, tab audio is streamed to a speech-to-text provider for live transcription and discarded immediately after processing.

Eligibility

Sidecue is intended for users aged 16 and older. By using the Service, you confirm you are at least 16. We do not knowingly collect data from anyone under 16; if we learn that a user is under 16, we will promptly delete their account and associated data.

Data we collect

Account data

Email address: for authentication and account management.
Display name and profile photo: provided by Google if you sign in with Google OAuth; used only for display within the Service.
Authentication tokens: stored locally on your device and managed server-side via Supabase Auth to keep you signed in.

Knowledge base content

Context text: free-text notes about your meetings, such as agendas, names and terms, stored in our database and synced between extension and dashboard.
Uploaded files: agendas, notes or reference documents (.txt, .md, .pdf, .docx) stored in Supabase Storage under your account. At session start, files are temporarily transferred to Google’s Gemini File API so the AI can read them; those copies expire automatically after 48 hours.

You control your knowledge base entirely and can edit, delete, or clear it at any time. Deleting a file removes it from our storage immediately.

Session usage data

Session start and end timestamps, to calculate duration.
Session duration, to meter usage against your monthly quota.
Plan (Free, Pro or Power), to enforce usage limits.

Session history

Session title and platform, e.g. “Google Meet”, from the captured tab title.
Conversation transcript, attributed to “You” and the other speaker.
Generated cues, the questions detected and answers produced during the session.
Phrases and terms explained in your cues, saved to your Phrases list.

You can delete individual sessions or your entire account at any time.

Settings and preferences

Your settings (coach mode, meeting language, level, reply style, theme and so on) are saved to your account so they stay in sync between the dashboard and the extension.

Email records

Which emails we sent you and when (for example a welcome email or a trial reminder).
Delivery status reported by our email provider, such as delivered, bounced or marked as spam, and, where your email client allows it, whether the email was opened or a link was clicked.
Your email preferences, including whether you unsubscribed from product emails.

Technical logs

When a session starts we record which account requested a speech-to-text connection and when, to prevent abuse and to reconcile our costs. These records contain no audio or transcript.

Analytics

The extension and dashboard do not use third-party analytics, advertising or tracking tools. We look at usage in our own records (for example sessions started and minutes used) to understand how Sidecue is used. Our website and blog are hosted on Ghost, which may count visits in an aggregated, cookieless way.

How we use your data

Provide the service: authenticate your account, manage sessions, enforce quotas, and sync your knowledge base across devices.
Generate real-time cues: relay transcribed speech and your knowledge base to a large language model. Prompts and responses are processed in real time and are not stored by us.
Transcribe audio: stream tab audio to a speech-to-text provider. Audio is processed in real time and not retained.
Session history: save transcripts and cues so you can review them later.
Improve the product: analyse anonymous, aggregated usage patterns.
Customer support: respond to enquiries you send us.
Emails: send account emails and, unless you opt out, product emails (see below).

Legal bases (EEA and UK users)

Performance of a contract: running your account, sessions, knowledge base, history, quotas and subscription.
Legitimate interests: keeping the Service secure, preventing abuse, understanding usage in aggregate, and telling existing users about Sidecue features and offers. You can object at any time.
Legal obligation: keeping billing and tax records.
Consent: where the law requires it, for example for marketing emails in some countries. You can withdraw consent at any time.

Emails we send

Account emails: sign-in links, confirmations, password resets, and messages about your plan, trial or payments. These are part of the Service.
Product emails: a short welcome series, occasional tips, trial reminders, and occasional offers for Sidecue plans. Every product email has an unsubscribe link, and unsubscribing takes effect immediately. You can also write to contact@sidecue.app.

We send at most one product email every 48 hours and never share your address with advertisers.

Third-party services

Deepgram, speech-to-text

Tab audio is streamed from your browser to Deepgram over an encrypted WebSocket for real-time transcription. Current versions of the extension connect with a short-lived access token issued by our server for each session.
Audio is processed on the fly and not stored under our configuration.
deepgram.com/privacy

Google Gemini, cue generation

Recent transcribed speech and your context text are sent via our server-side proxy to generate cues.
Uploaded files are temporarily sent to the Gemini File API and expire after 48 hours.
Prompts and responses are processed in real time; we don’t log or store them.

Supabase, backend infrastructure

Handles authentication (email/password and Google OAuth).
Stores account data, usage records, knowledge base content, uploaded files, and session history.
Hosted in the EU West region.

Stripe, payment processing

If you subscribe to a paid plan, payment is handled by Stripe. We never receive or store your card details.
stripe.com/privacy

Resend, email delivery

Sends account emails and product emails to your email address, and reports delivery, opens and clicks back to us.
resend.com/legal/privacy-policy

Hosting and automation

Vercel hosts the web dashboard.
Ghost hosts our website and blog.
Composio and Anthropic (Claude) run our scheduled email jobs. For this they process your email address, plan and trial dates, and which emails you have already received. They do not receive your knowledge base, transcripts or cues.

We do not sell, rent, or trade your personal data. We share data only with the third-party providers above to operate the Service, when required by law, or in the event of a business transfer.

Data retention

Account data: retained while your account exists; removed within 30 days of deletion.
Knowledge base and files: retained until you delete them or your account.
Session history: retained until you delete the session or your account.
Temporary Gemini copies: deleted by Google after 48 hours.
Email records and technical logs: kept while your account exists, deleted with it.
Billing records: kept for as long as tax and accounting law requires, typically five years.
Audio: never stored; processed in real time and immediately discarded.

Data security

All traffic uses HTTPS/TLS; audio streams use encrypted WebSocket (WSS).
Our long-lived API keys are kept on our servers. The extension uses short-lived access tokens to reach the speech-to-text provider.
Uploaded files are accessible only to you, enforced via row-level security.
The Supabase backend is hosted in the EU West region.

No system is perfectly secure, but we take reasonable precautions to protect your data.

Your rights

Depending on your jurisdiction, you may have rights to access, rectify, erase, port, object to, or restrict processing of your personal data. To exercise any of them, contact contact@sidecue.app. We respond within 30 days, or the timeframe required by law.

You can delete your account yourself in the dashboard. If you are in the EEA, you also have the right to lodge a complaint with a data protection authority. In Poland this is the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl.

International data transfers

Our authentication and storage run in the EU (West) via Supabase. Third-party services such as Deepgram and Google Gemini may process data in the United States or other regions. By using the Service, you acknowledge that your data may be processed outside your country of residence.

Browser permissions

tabCapture: capture audio from a browser tab. Sidecue does not request microphone access.
offscreen: process tab audio in the background.
sidePanel: display cue cards, transcript, and settings.
storage: save settings and your session locally.
identity: complete Google OAuth sign-in.
activeTab & scripting: inject the floating overlay when you request it.
Access to supported meeting sites (such as Google Meet, Zoom, Microsoft Teams and Webex): show the overlay on those pages. Sidecue reads nothing from these sites except the tab audio during a session you start.

Audio capture requires an explicit two-step action: click the Sidecue icon to connect, then click Start. No audio is captured or sent anywhere until you press Start, and stopping the session immediately releases the stream.

Chrome Web Store Limited Use

Sidecue’s use of information received from Chrome APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. We use this data only to provide and improve Sidecue’s single purpose, do not sell it, do not use it for advertising or creditworthiness, and do not let humans read it except with your permission, for security, or as required by law.

Changes to this policy

We may update this policy from time to time. For material changes we’ll update the effective date and, where feasible, notify you. Continued use after changes take effect constitutes acceptance.

Contact

Michał Włosik EFC
ul. Północna 16/5, 54-105 Wrocław, Poland
Email: contact@sidecue.app