Exo — Privacy notice
Last updated: June 2026 (legitimate-interest diagnostics). We may update this notice and will take reasonable steps to surface material changes in the app or on exosites.ch.
Who we are
This notice covers Exo — our desktop and mobile applications from Exosites, 21 places d'Armes, 1227 Carouge, Geneva, Switzerland. It does not replace the exosites.ch website privacy policy for marketing pages and the contact form. Unless your organisation has a separate agreement with us, the data controller is Exosites at that address, reachable at studio@exosites.com or +41 22 301 08 12.
Plain summary
• Exo processes your files on your device by default (desktop and mobile). • On desktop, coarse usage analytics and crash reports run on our legitimate interest to improve reliability; you may object in Settings → Privacy. Mobile crash reporting stays opt-in. • Google, Microsoft, and other connectors run only when you start a flow in the app. • You can download, export, or delete your cloud account and erase local assistant data in Settings. • You can disconnect integrations anytime. • We do not sell your data.
Local processing and on-device data
Your files stay on your computer unless you start a connector import. Chat uses hosted models through your Exo account — you do not paste provider keys. On mobile, synced memories and tasks are stored encrypted on the device; the cloud relay holds ciphertext only. You choose which folders the assistant may use; configuration and UI preferences are stored locally. File contents and paths are not uploaded unless you enable separate features (hosted chat, mail or cloud imports, GO SYNC ciphertext, or other network flows you start). You are responsible for the sensitivity of folders you authorise, device security, encryption, and backups.
Google user data and Limited Use
When you connect Google in External sources, Exo accesses only the products and permissions you approve on the consent screen. We do not scan Gmail, Drive, or Calendar in the background. Access happens when you connect the integration or use assistant tools you enabled. Exo's use of Google user data is limited to user-facing features (assistant mail and Drive tools you turn on, calendar for the assistant). We do not sell Google user data, use it for ads, or train generalized models on it. Human access occurs only with your consent, for security, or when required by law. Exosites' use of information received from Google APIs adheres to the Google API Services User Data Policy, including Limited Use requirements: https://developers.google.com/terms/api-services-user-data-policy. Scopes in plain language: Gmail read/modify/label/move — search and read messages, apply labels, move or trash mail when assistant mail tools perform an action you requested. Gmail send — only when you or the assistant explicitly triggers a send. Google Drive full access — list, search, and open files you choose for the assistant; organize or upload files only when you approve assistant actions. Google Calendar read and events — read events for calendar-aware assistant actions; create or update events when you request them. OAuth tokens and local copies stay on your device until you disconnect in External sources, delete local app data, or tokens expire or are revoked. Disconnect in the app or at https://myaccount.google.com/permissions.
Other integrations
Microsoft Graph (OneDrive, Outlook mail): OAuth tokens stored on your device; accessed when you start assistant flows you enable. Dropbox: same pattern — tokens on device, access on user-initiated assistant jobs. Notion: integration token stored locally; used for assistant context when enabled. Slack: token on device; used for assistant features you turn on. Amazon S3: credentials you configure; used for assistant access to buckets you specify. iCloud: accessed when you connect and start flows in the app. Infomaniak (kDrive, Mail, Calendar): tokens on device; mail/drive for assistant access you start; calendar for assistant actions. Prompts sent to external chat or model providers follow those vendors' policies.
Hosted AI vs files on your device
Chat and meeting summaries you start run on hosted models through your Exo account after you sign in. You do not paste OpenAI, Anthropic, or Google Gemini keys into the app. The app discloses when conversation text or audio is sent for those features. Connector imports (Gmail, Drive, and similar) pull only what you choose onto the device for the assistant. We do not store your file contents on the account servers used for sign-in and licensing.
Exo account service (api.exosites.ch)
Signing in with email, Google, or Apple uses our account service at api.exosites.ch for authentication, trial status, license entitlement, and GO SYNC relay metadata. Cloud sign-in uses openid, email, and profile only — it does not grant Gmail, Drive, or Calendar access. That is separate from connecting Google in External sources. We store account identifiers, entitlement metadata, sync device registrations, and encrypted blob envelopes (ciphertext only) on our servers — not your file contents or plaintext memories. Crash ingest may receive technical reports under our legitimate interest unless you object (see Telemetry). No credit card is required to start the 7-day Exo Pro trial (chat and apps).
Telemetry and crash reports
On desktop, coarse usage analytics and crash reporting are processed on our legitimate interest in operating, securing, and improving Exo (GDPR Art. 6(1)(f) / Swiss FADP equivalent) — not on consent. They are on by default; you may object anytime under Settings → Privacy by unchecking Usage analytics and/or Crash reports. When active, the app sends allowlisted UI events (for example app started, tab changed, job started) with an anonymous instance id, app version, platform, and locale — never file paths, file names, folder names, prompts, or responses. When signed in, events may be linked to an internal account id (not your email in telemetry). Local telemetry rows are trimmed after about 90 days. Crash reports may include scrubbed stack traces, breadcrumbs, and technical context to api.exosites.ch; paths and contents are stripped. Cloud telemetry, feedback, crash reports, and session rows linked to your account are deleted when you delete your account. Cloud crash rows are also pruned after about 90 days. Some builds may use Sentry when configured; session replay is disabled. On mobile, crash reporting remains opt-in under Settings → Privacy.
Memory, tasks, and encrypted sync
Memory stores facts the assistant keeps; you can review, edit, and delete them. To Do holds tasks from chat, mail, and calendar when those connectors are connected. Encrypted sync (trial/Pro) stores memories and tasks across desktop and mobile with end-to-end encryption — our servers relay ciphertext only and cannot read the plaintext.
Microphone and meeting capture
On desktop, Record meeting uses the microphone only while Record is on. Live conversation voice is not on this version. We do not sell voiceprints or use voice data for advertising. Deny microphone permission at the OS level if you do not record meetings.
Retention and deletion
OAuth tokens and local connector copies remain on your device until you disconnect, erase local data in Settings → Privacy, or tokens expire or are revoked. Account, trial, and license metadata on our servers are kept while your account is active and as needed for legal obligations. Usage telemetry on device: about 90 days. Crash reports on our servers: about 90 days (or deleted sooner when you delete your account). GO SYNC ciphertext on our servers is deleted when you delete your cloud account.
Your rights and in-app controls
Where the GDPR, Swiss Federal Act on Data Protection, UK GDPR, or similar laws apply, you may have rights of access, rectification, erasure, restriction, objection, withdrawal of consent (where consent applies), and data portability. In the app: Settings → Your account → Download my data (JSON of cloud-held metadata) and Delete account (removes linked telemetry, feedback, and crash reports); Settings → Privacy → object to usage analytics or crash reports, and Erase local assistant data (memories, chats, and tasks on this device). You may lodge a complaint with a supervisory authority (for example the Swiss FDPIC or an EU/UK authority). Contact studio@exosites.com with subject "Privacy objection" or "Data request".
International transfers and subprocessors
Because hosted models, identity, or speech providers may process data, processing may occur outside Switzerland or the EEA. Where we act as controller and the law requires safeguards, we rely on appropriate mechanisms (such as standard contractual clauses or adequacy decisions). Subprocessors and infrastructure we use for Exo include, where applicable: Infomaniak (hosting, api.exosites.ch), Google and Apple (OAuth sign-in only for the account service), optional Sentry (crash reporting when enabled in a build), and hosted model providers tied to your Exo account. Contact studio@exosites.com for an updated list.
Children, changes, and contact
Exo is not aimed at children. AI suggestions are an assistive tool, not solely automated legal decision-making under Article 22 GDPR. We may update this notice; material changes are summarized in the app or release notes. For the marketing site, use the website privacy policy in the footer. Contact: studio@exosites.com, +41 22 301 08 12, Exosites, 21 places d'Armes, 1227 Carouge, Geneva, Switzerland.
Mobile applications
The Exo mobile app (iOS and Android) connects to the same account service and optional GO SYNC relay as desktop. Access and refresh tokens are stored in the device secure enclave (Keychain / Keystore). The sync master key never leaves your devices in plaintext. Optional mobile crash reporting is opt-in under Settings → Privacy and follows the same scrubbing rules as desktop. Microphone permission may be requested for future voice features; disable permissions in system settings if you do not use them. App Store and Play privacy labels should match this notice.
Assistant automation (meetings, codegen, terminal)
When you enable assistant features, Exo may: transcribe or summarize meetings you start and extract tasks or memories you approve; write or edit project files in folders you designate (codegen sessions); or run a restricted allowlist of read-only terminal commands you request. These actions run on your device under your control. Outputs may be sent to hosted models through your Exo account. Review suggestions before moving files, sending mail, or running commands. You can delete resulting memories, tasks, or generated files at any time.