What Andy reads, what she keeps, and how to take it back.
Andy is a deadline dashboard app made by Factor Eight (Andrew Bennett, Saskatoon, Canada). She reads the things you already keep (Notion, Google Calendar and Gmail, Dropbox, and the calendar on your phone if you allow it), takes what you share with her from your phone, and writes you a short plan for the day that changes as the day does. She also adds a few things to those accounts for you, and lists them in the app with undo (the one exception is below). This page says plainly what all of that involves.
Signing in
You sign in with Apple, on your phone or iPad; a Mac is signed in from your phone. From Apple, Andy keeps the stable id Apple gives her and the email Apple shares (which can be Apple's private relay address). Each device you sign in on gets its own private sign-in code, kept in that device's secure storage; Andy keeps only a scrambled fingerprint of that code, never the code itself, plus the device's name and which version of the app it runs. If you joined with a reference, Andy keeps the email it was made for and the note its maker wrote about who it's for. If you used a code instead (for when you'd rather hide your email from Apple), she keeps a scrambled fingerprint of the code, never the code, its last four characters, how many days of Andy, full-time it gave, when you used it, and its maker's note. Deleting your account deletes both.
What is read, and what Andy does there
Notion: the pages and databases you share with Andy when you connect. Andy reads their text and properties to find deadlines, projects and open items. She writes there in one case: when you mark something that came from a Notion page (done, not doing, submitted), Andy adds a short dated note to that page, and sets its status when the database has a matching one. What you share with Andy stays in Andy; it is not filed into your Notion.
Google: your calendar events (the calendars you let her read) and your mail, including sent mail, so she can tell what you have already answered. When she writes your day, Andy reads each message's sender, subject and Gmail's short preview. Once you've said ok to it in the app, for mail that may need you (from someone you write to; from an address with no list headers that isn't an automated one like noreply or billing, where a role address like info@ at a place you write to counts; mail sent to many, or from an automated address, that asks something of you or names a day; or anything new on a conversation already on your day), and for the other messages in that conversation, your own included, she may also read the message itself: about its first 2,000 characters, leaving out what it quotes where she can tell (a forward keeps what it forwards), to see what it asks and by when. Mail whose sender, subject or preview reads as medical, and a sign-in code, a sign-in link or a password reset from someone you don't write to, she sees by its preview only, and everything else too. She reads a whole thread only to write you a reply draft. Google also lets her know when one of your calendars changes (only that it did, never what), so she reads what's new as it comes rather than on her next round. She adds things there too: time set aside on your calendar for something with a date, or an hour to work on something that closes soon when you tap "hold" (in a calendar called "Andy's holds" when there is one), and drafts in your Gmail drafts: a reply when you tap for one, or a first email when something you shared asks you to write to an address it shows. Some of these she adds when you tap, and some on her own, from something you shared (a show with a date becomes an event). Andy never sends mail; you do.
Dropbox: file and folder names, and the text of small files (plain text, markdown) Andy opens while she writes your day. Andy writes nothing to Dropbox; pictures you share stay in Andy.
Apple Calendar: only if you allow it, on your phone. Andy reads the calendars on your phone there (iCloud's included, birthdays left out) and sends her copies of your events from the last two days and the next two weeks: each one's title, time, place, which calendar and account it's in, whether it repeats, whether you declined it or marked it free, when it was last changed, and the phone's own ids for the event and its calendar; and the names of the calendars it read. The copies are replaced each time the phone sends them, and used only while they're fresh (a few days); what changed since the last ones goes on the list of what changed (below). A few minutes before she writes your day (six in the morning, ten, and nine at night), Andy may wake the app on your phone, without showing you anything, to send them then; when she updates your phone in the background for other reasons, it sends them too if your calendar changed or it has been a quarter of an hour. She never writes to your calendars through this. A calendar on your phone that belongs to the Google account you connected is left to Google; to tell which, Andy keeps a keyed fingerprint of the name and id of each calendar that account has (not the names themselves), until you disconnect Google.
Apple Reminders: only if you connect it, on your phone. Andy keeps a list of her own (called "Andy", or "Andy's to-dos" if you already have a list called Andy) in step with your to-dos in Andy, both ways: a reminder you add there becomes a to-do in Andy, and a to-do from something you shared goes there too, with an alert when it has a time. She keeps private to-dos (health, money, and ones whose words read as health) off it. To keep that list in step, Andy adds, ticks and deletes reminders in it. Once you've said ok to it in the app and switched it on (connecting Reminders does, or "read them" under it), Andy also reads every other list there, on your phone, and sends her copies: the reminders still open, and those you ticked off in the last three days, each with its title, which list and account it's in, when it's due, its priority, when you ticked it off, when it was last changed, and the phone's and iCloud's ids for it; and the names and accounts of the lists it read (a to-do of Andy's own is left out wherever it is). The copies are replaced each time the phone sends them (one that's gone from them is kept until a later send shows it was really deleted: ten minutes on, or an hour when several went from one list at once), and used only while they're fresh (a few days); what changed since the last ones goes on the list of what changed (below). Andy reads them to write your day: a reminder's date counts as written down, and something that came from one you ticked off or deleted may leave your day (not one you've changed or marked in Andy). A list shared with you is read the same way, with what others add or tick there. The phone sends them as the calendar's are sent, and when Andy wakes it before she writes your day. She never adds, ticks, changes or deletes a reminder on your other lists.
Links you share: when you share a link, Andy opens it to read the post (for Instagram and TikTok, the public version they offer for embedding), so that site sees a request from Andy.
Google user data
Andy's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Andy uses your Google data only to show you your day, your deadlines and your mail's previews in the app and in her notifications to you (such as when something's work has to start, worked out from your calendar), and to make the calendar holds and Gmail drafts you ask for. It isn't sold, used for advertising, or used to train AI models, and people at Factor Eight don't read it, except with your permission, to look into something you reported, for security, or where the law requires.
What is kept on the server
Your day: what Andy writes (short lines, plus the things on your list with their dates, whether they're done, and a few words from where each came from, so you can see what she read), what you mark done, not doing or right, your fixes (what or when, in your words, and what the source said when you fixed it, so Andy keeps yours when she writes your day again), your notes and to-dos, how long each thing takes (your answer, or her guess from the kind of work until you give one) and your working hours, copies of your Google calendar events (the next two days, the next three weeks for working out when each thing needs you, and each week you've opened), which things she saw coming so she tells you once when one needs you, how you use Andy (opens and taps), and a record of when Andy updated your day and what each piece of her work cost.
Apple Calendar copies: the events your phone sent (above), one set per phone. They go when you turn Apple Calendar off in the app or take Andy's calendar access away in your phone's settings (the next time Andy opens), when that phone is signed out, when that phone hasn't sent any for 30 days, and when you delete your account.
Apple Reminders copies: the reminders your phone sent from your other lists (above), one set per phone. They go when you stop Andy reading your other lists, or disconnect Reminders, in the app, or take Andy's reminders access away in your phone's settings (the next time Andy opens), when that phone is signed out, when that phone hasn't sent any for 30 days, and when you delete your account.
Your first minutes: for accounts made since September 25, 2026, when you signed in, which way in you took and when, when her first look at your sources was ready, when Andy first showed you something that needs you, and when you first did something with it, with which kind of thing it was (right, fix it, a hold, a draft, open or done). Times only, never what it was. Only Factor Eight sees them, beside your email, to learn how long Andy takes to be useful to someone new.
What you share: the link, the words and up to four pictures you share (screenshots reach Andy only this way), the post's own picture when Andy fetched one, and what Andy made of it. Pictures are kept encrypted. Throw a share out and its pictures are deleted at once; the words that came with it, and what Andy read in it, stay until you delete your account.
Mail: the sender, subject and Gmail's short preview of the last week's mail, kept for a week and deleted when you disconnect Google, plus the names and addresses you write to, so Andy knows who you know. A mail Andy tells you about in a notification is also kept with that notification. The text of a message is read when your day is written, or for a draft, and isn't stored; what Andy writes on your day from it (the thing, its date, a few of its own words) is kept with your day.
What changed: for a week, a list of what changed in your mail (mail you sent included), calendars (the one on your phone too), Notion and your reminders' other lists (a mail's sender and subject, an event's, a page's or a reminder's title and time, and what Andy made of it), so she reads what's new instead of everything again. It goes with the source when you disconnect it, and with your account. An edit another app makes in your Notion (an integration, a connector) isn't listed as yours, unless it adds a row to one of your databases or changes a page something on your day came from: to tell them apart, Andy keeps Notion's id for each app or person who edits your pages and which one it is (and when she checked), nothing else, until you disconnect Notion. Andy also keeps which of your calendars Google tells her about, until when, and when it last did; that goes when you disconnect Google, and with your account.
Health and money: Andy doesn't read Apple Health, and has no check-in or medication plan. If you logged any during the earlier beta, it stays with your account, unread, until you delete your account or ask us to remove it. Anything clinical Andy finds in your calendar, mail, Notion, reminders or what you share (an appointment, a refill, a result) is kept as a private item: on your phone and iPad only, and out of Notion and anything Andy learns about how you work. A payment you owe (a bill, rent, a tax) is kept private the same way, and once Andy reads it as a payment she doesn't put it on your calendar; a notification about one says only that a payment is due, and one about a mail only that mail about a payment came in.
What Andy did: each thing Andy added to your accounts, with what it takes to undo it.
Connections: the access you give Andy to Notion, Google and Dropbox, kept encrypted. Until Google verifies Andy, it lets a limited number of people connect Google, so Andy keeps when you first connected it. If you delete your account, that count stays, with nothing that says whose.
Notifications: every notification Andy wanted to send, whether it went or not; when you want the book (your morning note) and in what tone; and the address Apple uses to deliver Andy's notifications to your device.
Your subscription: Andy, full-time is bought through the App Store, and Apple handles the payment; Andy never sees your card. What Apple reports about it is kept: which plan, when it started, renews or ends, whether it's in the two free weeks or another App Store offer, whether it will renew, and its price and currency, so the reminder two days before your free weeks end can say when they end and what comes next.
Learning how you work (coming in November)
How Andy learns how you work, if you let her: this comes with Andy's release version in November, and is off until you turn it on. If you turn on "let Andy learn how you work", Andy keeps a short record of how her notes land with you: which notes you open, mute or wave off, and what you've told her not to joke about. She uses it only to adjust how much she says to you. You can see the record in the app under "what i've learned" and delete any line of it, or all of it, at any time. It stays with your account, is used only for you, and is never used to improve Andy for anyone else or to train AI models. It's deleted when you turn the switch off or delete your account. Things you tell Andy directly, like "less like this", are kept as your settings whether or not the switch is on.
Who else sees it
Andy runs on Netlify, which stores what Andy keeps, pictures included; Netlify also keeps backups of Andy's database (below). The writing is done by Anthropic's Claude models, reached through Netlify's AI Gateway, and sent only what a given task needs: what's needed to write your day (your calendars, Apple's copies included, your reminders' copies, your mail's previews and the text of mail that may need you, and Notion's pages), an email thread for a draft, one share to sort, the names of your databases and folders to suggest where things go. Notifications go through Apple, and leave out anything Andy has marked or reads as private. Andy does not sell what she keeps, share it for advertising, or use it to train models.
Your control
Connections: any connection can be removed from the app's preferences at any time; removing one deletes Andy's copy of that access, and removing Google deletes the mail Andy kept. What Andy already read from a source (the things on your day, Google calendar copies) stays until you delete your account, apart from the next three weeks of your Google calendar she keeps for working out your free time, which go with Google. Apple Calendar is turned off in the same place, and its copies go with it; so is the reading of your other reminders lists, and their copies go with it. To take Andy's access away on the other side as well, remove it in Notion (settings, connections), at myaccount.google.com/permissions, or in Dropbox (settings, connected apps).
What Andy did: what Andy added to your accounts can be undone from the app (preferences, what Andy did), except the dated note and status she writes on a Notion page when you mark something; change those in Notion.
Devices: signing a device out ends its sign-in at once, and the phone can sign out any other device from its list. A device's sign-in stops working after six months unused.
A copy: the app can hand you a copy of everything Andy keeps about you, every picture included, as one file.
Deleting your account: from the app, on your phone or iPad. It signs out every device, asks Google and Dropbox once each to take back the access you gave, deletes your pictures, then deletes your account and everything in it: your day, your history, mail, shares and devices. If there isn't time to ask Google and Dropbox, your account waits up to an hour, and nothing is done for it meanwhile. What Andy added to your Google, Dropbox and Notion stays there, so undo it first if you want it gone. What stays with Andy, with nothing that says whose: Apple's notices about a subscription (the payment record), what each piece of Andy's work cost, and for about a month, the account's id and when it went, so nothing can be stored for it again. Notion has no way for Andy to give her access back, so remove Andy there yourself. Deleting your account doesn't cancel an App Store subscription: cancel it with Apple (the app shows you where). It cannot be undone. You can also write to andrew@factoreight.net.
Backups: Netlify keeps backups of Andy's database: the scheduled ones for 30 days, and one at each of Andy's last ten releases. A deleted account stays in those until they age out. A backup is only ever restored whole, by hand; restoring one would bring back accounts deleted since, and they would have to be deleted again, by hand.
This page describes Andy as she runs today, and the one thing marked as coming in November. Last updated September 30, 2026.