Privacy
earmuff.ai is an early-access service. We store your verified phone number, a protected hash and an encrypted viewable copy of your calling passcode, browser session records, and temporary verification and rate-limit records on a persistent Fly.io volume. SMS sign-in is provided by Twilio Verify. We use a secure, HTTP-only cookie to remember your browser for up to 30 days. Sign out on shared devices. Passcodes and SMS codes are not written to application logs. New accounts do not have Gmail or Calendar access; the existing owner-only Google connection remains separate.
Owner-only email and calendar
At your request, the assistant searches and reads Gmail, creates or revises drafts, and archives selected messages. When you explicitly ask to send, it can email your own connected address or contacts you have approved on the website. Other recipients can receive drafts only. It reads Calendar and adds personal events to calendars you own, without invitations. It does not delete mail, download attachments, or mark messages as read.
Email, approved contact names and addresses, and calendar content requested during calls are passed to OpenAI to generate answers and perform your requested actions. Text spoken on the call is processed by ElevenLabs and Twilio for voice playback. Twilio and its speech-recognition provider process your spoken requests.
Storage
The Google refresh token and approved contacts are encrypted using keys derived from a server secret and stored on the app’s Fly.io volume. Fly.io may retain volume snapshots under its retention policy. Recent call text, email and calendar content, and synthesized speech stay temporarily in memory and are cleared from the call context when the call ends. Drafts and sent messages remain in Gmail; created events remain in Calendar. Archived mail stays in Gmail outside the inbox. The app does not record caller audio or save message or event contents to application logs.
Fixed phrases such as “Go ahead” are prepared in advance and reused from server memory to make replies faster. This shared audio cache contains no contact names or private message content.
Service providers
OpenAI, Google, ElevenLabs, Twilio, and Fly.io process data under their own terms and retention settings. OpenAI Responses requests use store:false. This is not a guarantee of zero retention by all providers. Google user data is used to provide your requested assistant features, not for advertising or selling data.
Your choices
You can sign out and change your calling passcode from the account page. Passcode changes revoke other browser sessions. Signed-in users can reveal passcodes saved with encrypted viewing support; older hash-only passcodes must be saved once first. Self-service account deletion is not available in this early-access release. Do not use the assistant for emergencies. Stripe processes real payments and recurring subscriptions. The $5 monthly plan includes 10 minutes with AI, voice and searches during those minutes; additional usage uses prepaid credit. Auto-recharge requires opt-in consent. We store plan selection, usage quantities, estimated provider costs, credit/debit records, spending reservations, recharge preferences and confirmed billing events. Stripe handles card information; earmuff stores payment references, not card numbers. Only your account and the service owner can view your billing details.
Edit or remove approved contacts on the website at any time. Removing a contact prevents future sends to that address unless another saved alias still allows it; it does not recall sent messages. Disconnect Google to remove the active stored token; saved contacts remain for a future reconnection. You can revoke access in your Google Account; this connection uses the shared Shipwreck project, so review Google’s notice about related connections. You can review and manage drafts directly in Gmail.