Skip to content
milo
Browse the docs

Privacy

What Milo stores, who sees it, how long it is kept, and how you remove it.

What is stored

  • Your phone number and Google sign-in identity.
  • Your texts and the replies, tasks with their steps and results, approvals, memory files, schedules, and daily usage counts.
  • If you connect Google: an encrypted refresh token, and the email, calendar items and summaries we derive from it.
  • Your agreement to the AI processing notice, and when you gave it.
  • Never card numbers. You type a card into a site inside your own private browser, and it stays there.

What is sent to Google Vertex AI (Gemini)

Google Vertex AI processes your messages and, if you connect Google, the text of your email and calendar. This is how Milo answers you. You agree on a screen that names Google Vertex AI before any of it starts. Without that agreement, Milo reads none of your connected data.

What is sent to Kernel

Kernel runs your private cloud browser. It holds your browser profile: cookies, logins and any card you saved on a site. Pages you ask Milo to visit are loaded there. Milo does not store or see card numbers.

What is sent to Composio

Apps like Slack, Notion, GitHub, Outlook, Linear, Todoist, Dropbox and Google Drive connect through Composio. Composio holds the sign-in tokens, not Milo, and relays each request to the app. Disconnecting in Connections deletes the account at Composio. Reads run on their own; every send, post, create or delete waits for your YES by text.

Others

Supabase hosts the database. Vercel hosts this site. The message transport carries texts only. Nothing is sold or used for ads.

How long it is kept

  • Your data is kept until you delete it or delete your account.
  • Approvals expire after 24 hours and then never run.
  • Sign-in links are single use and expire.
  • Your browser session closes after 15 minutes idle. The profile stays until you delete it.

Disconnect Google

In Connections, tap Disconnect. The token is revoked at Google and deleted. Every stored email, calendar item and summary from Google is deleted in the same step. If something is left, it shows "Not fully removed, retrying" and keeps retrying until the page shows zero left. Milo cannot summarize that inbox again.

Delete everything

In Account, tap Delete all my data and type the last four digits of your phone. Messages, tasks, approvals, memory files, schedules, connections, tokens, your browser profile and the account are deleted, with verified counts. You get one last text, and then no more. See Delete my data.

Safety

Secrets never enter the model. Email and web pages are untrusted and cannot trigger an outward act. Every outward act needs your YES.

Contact

Questions go through Support.