This Privacy Policy explains how Nyxone OÜ (“Timeline”, “we”, “us”, or “our”) processes personal data when you visit our websites, create an account, join a team, contact us, or use The Timeline service. Our plain-language Trust page summarizes the same operating model, and our Cookies and similar technologies notice lists current browser storage and the release conditions for optional analytics. This Policy controls if those pages differ.
1. Who is responsible for the data?
For our website, account administration, service operations, security, product analytics, and direct support, the data controller is Nyxone OÜ, Estonian registry code 16172329, Harju maakond, Tallinn, Kesklinna linnaosa, Narva mnt 5, 10117, Estonia. Contact us at [email protected].
For messages, documents, recordings, transcripts, integration records, and other content submitted to a team workspace (“Customer Content”), the customer organization normally decides why and how that data is used. The customer is the controller and Timeline acts as its processor. Individual team members should first direct workspace-data requests to their organization. We will assist the customer as required by applicable law and our agreement.
2. Data we collect
- Account data: name, email address, profile image, authentication method, email-verification state, legal-acceptance records, and account preferences.
- Team and permission data: team names, memberships, roles, invitations, selected visibility, settings, approvals, connection ownership, and audit records.
- Customer Content: notes, messages, email, files, document versions, meeting transcripts, calendar events, integration records, prompts, agent conversations, extracted facts, vectors, summaries, suggestions, objects, tasks, and citations.
- Connection data: provider account identifiers, selected resources, webhook metadata, OAuth tokens, API credentials, and custom MCP configuration. Secrets are stored encrypted, not as readable plaintext.
- Authorized-app data: OAuth client identity and callback metadata, the selected team and approved scopes, credential digests and prefixes, issue and expiry times, revocation state, and security audit records for MCP hosts a member authorizes.
- Service and device data: IP address, user agent, timestamps, request and response metadata, job status, security signals, diagnostics, personless surface-request events, and explicit pseudonymous product lifecycle events. If you allow optional public browser analytics, this category can also include the consent preference and approved public-page events and identifiers described in our cookies notice. We do not intentionally place Customer Content in product analytics.
- Communications: support requests, sales questions, feedback, and related correspondence and attachments.
3. Where data comes from
We receive data from you; other members of your team; your employer or organization; the authentication, communication, meeting, storage, calendar, developer, and work-management services you choose to connect; and automatically from your browser or device when needed to operate and secure the service. A team must have authority to connect a source and submit data about other people.
4. Purposes and legal bases
The analytics bases below are our current intended positions and remain subject to qualified privacy and legal review before this version is published in production.
| Purpose | Legal basis when GDPR applies |
|---|---|
| Provide accounts, teams, capture, storage, retrieval, AI features, and support. | Performance of a contract or steps requested before entering one. |
| Secure the service, prevent abuse, debug failures, and protect legal rights. | Our legitimate interests in operating a safe and reliable service, and legal obligations where applicable. |
| Send transactional messages, invitations, and requested service notices. | Contract performance and our legitimate interest in service communication. |
| Evaluate approved, content-free product lifecycle events and improve workflows. | Our legitimate interest in improving the service, balanced against user privacy. |
| Run optional PostHog browser analytics on eligible public pages after you allow it. | Consent obtained before PostHog initializes. Policy acknowledgement, account creation, and necessary storage are not that consent. |
| Count requested public pages and signed-in product surfaces through fixed, non-visitor server streams. | Our legitimate interest in understanding basic service operation, where that count constitutes personal-data processing. The event contains an allowlisted surface only and cannot recognize a browser, visitor, session, account, user, or team. |
| Comply with law, valid legal process, and regulatory requirements. | Legal obligation or legitimate interests, depending on the request. |
Where we rely on consent, you may withdraw it at any time without affecting earlier lawful processing. We do not treat acknowledgement of this Policy as consent to processing that requires a separate choice.
5. AI processing, privacy, and training
Hosted Timeline sends only the content needed for the requested feature to OpenRouter, which routes it to an eligible upstream inference endpoint. This covers generation, extraction, summarization, embeddings, media text extraction, and transcription. Model families may change as quality and availability change; current exact model IDs and their roles are published on the Trust page.
Model privacy policy 2026-08-21.1 classifies generation, extraction, summarization, media text extraction, and embeddings as zero-data-retention required. Supported requests send data_collection: deny, zdr: true, and an explicit cache-disable control. OpenRouter may select among eligible ZDR upstreams, but these roles fail closed instead of falling back to an endpoint with weaker retention. The production key must be restricted to the code-owned model catalog and attested to this exact policy version. Prompt logging, input/output sharing, Broadcast, and persistent response caching must remain disabled. Repository code cannot independently prove those account settings, so the deployment evidence must be captured before publication of a verified hosted guarantee. OpenRouter may retain non-content request metadata such as model, token count, cost, latency, and account identifiers for operations and billing.
Non-meeting voice-note transcription currently uses openai/gpt-4o-transcribe as a quality-preserving exception. OpenRouter's provider table lists OpenAI as not training on prompts but retaining them; OpenAI API data controls document default API abuse-monitoring retention of inputs and outputs for up to 30 days. Timeline will move this role to ZDR only if a reproducible broad-multilingual evaluation shows no material quality, reliability, format, or latency regression. This exception does not permit any ZDR-required role to downgrade during an outage. Source policies: OpenRouter's provider table; OpenAI API data controls.
We do not use Customer Content to train or fine-tune any model, or to build model-training datasets. Creating customer-specific embeddings for retrieval is service processing, not model training. We also disable rich prompt-and-output observability tracing in hosted production. AI output can be inaccurate; Timeline keeps citations so users can inspect the underlying evidence.
6. Meetings, recordings, and transcripts
If a team enables meeting capture, Recall.ai joins as a visible bot and processes meeting media to produce a transcript. Host consent confirmation is required by default. Customers remain responsible for participant notices and any consent required by law, contract, or workplace policy.
Timeline does not copy raw meeting audio or video into its object storage. Hosted Timeline requests Recall.ai's one-hour media-retention setting for each bot. Recall.ai documents that setting as deleting provider media after one hour, but the deployed account, request-level setting, and deletion-failure handling must be verified before relying on completed deletion. The resulting transcript, timestamps, speakers, and derived Timeline records remain in the workspace until an authorized user deletes them or a valid deletion request applies. Recall.ai separately documents seven-day retention for operational logs and removal of meeting URLs 14 days after a bot terminates.
7. Service providers
We use processors to deliver the service. They may process data only for the relevant purpose and subject to their agreements with us. Depending on the deployed configuration and the features a customer enables, core hosted-service providers include:
| Provider | Purpose and data |
|---|---|
| Railway | Application and worker hosting; PostgreSQL and Redis services; and persistent volumes for Qdrant and RustFS. The deployment design requires private-network server traffic, non-public buckets, and an external HTTPS endpoint limited to authorized, short-lived signed RustFS browser transfers. Current production exposure still requires verification. |
| OpenRouter and eligible inference endpoints | Zero-data-retention-required routing for generation, extraction, media processing, and embeddings; a disclosed retained, no-training exception for non-meeting voice-note transcription; and non-content usage metadata. |
| Recall.ai | Meeting-bot attendance, temporary meeting media, and transcript capture. |
| Daytona | Ephemeral, isolated document-extraction compute for supported file formats. Sandbox state is discarded when the sandbox stops, while Daytona retains observability logs, traces, and metrics for three days. |
| Postmark | Transactional and inbound email, invitations, and support messages. Postmark retains message content according to the configured account period (seven-day minimum; 45-day default) and states that stored message content is not encrypted at rest. |
| Sentry | Error reporting and diagnostics. Default PII collection is disabled, and Timeline strips cookies, authorization and sensitive headers, URL query strings and fragments, invitation tokens, and Telegram bot tokens. Diagnostic text can still reach Sentry; arbitrary exception and breadcrumb text is not guaranteed to be content-free. |
| PostHog | Personless server surface-request events, pseudonymous content-free product events, and optional public-browser analytics. The personless streams use one fixed non-visitor identifier each and receive only an allowlisted surface. Product-action identifiers are transformed before capture and are not anonymous. Browser PostHog may initialize only after affirmative consent on an eligible public page and is never identified or grouped to an account, user, or team. Autocapture, heatmaps, session replay, DOM capture, automatic page views, and client-side feature flags are disabled. Project region, retention, DPA, deletion, access, and deployed account settings still require dated provider evidence. |
| Cloudflare Turnstile | Abuse prevention on public forms and email/password registration. |
| GitHub (authentication, when configured) | Basic GitHub profile, email, and account identifiers used to sign in. This is separate from a team's optional GitHub content integration. |
8. Customer-directed integrations
A team may choose to connect services such as Slack, Telegram, GitHub, Google Drive, Linear, Monday.com, Sentry, calendar providers, custom webhooks, and custom MCP servers. We exchange data with them only when configured or invoked by the customer and according to the permissions granted. Those providers act under their own terms and privacy notices for their services. Disconnecting a source stops future access but does not automatically erase records already captured into Timeline.
A member may also authorize ChatGPT, Claude, Codex, or another MCP-compatible client to request data from one selected team. The read scope can return team-visible content, the authorizing member's private content, and content shared specifically with that member, but only where the member can access it at the time of the request.
The separate agent:ask scope can be approved only by a current team owner or admin. It lets the client ask the Timeline agent using team-visible context, create team-visible proposals for review, and use enabled team tools. Those tools may act on third-party services and can have external side effects. This scope does not give the client general team-administration access.
The authorized app receives the content returned in response to its requests and may process or retain it under the app operator's own terms and privacy policy. Revoking access stops future Timeline requests, but it does not delete copies the app already received. Timeline uses PKCE for this authorization flow, stores digests instead of plaintext authorization codes and access or refresh tokens, and never sends your Timeline password to the app.
9. When we disclose data
We may disclose personal data:
- within the team according to team, private, and specific-user visibility;
- to the processors and customer-directed services described above;
- at the customer's instruction or when the user asks us to perform an action;
- when required by valid law or legal process, or when reasonably necessary to protect users, the public, our rights, or the integrity of the service; and
- in a merger, financing, acquisition, reorganization, or sale of assets, subject to appropriate confidentiality and notice where required.
We do not sell personal data or share it for cross-context behavioral advertising.
10. Cookies, local storage, and analytics
We use necessary cookies or browser storage for authentication, security, team selection, invitation continuity, requested chat handoffs, and user preferences. The dedicated Cookies and similar technologies notice lists current names, purposes, and lifetime criteria. Reading that notice or accepting this Policy is not consent to optional browser analytics.
A previous source version loaded a Convex-hosted page tracker globally. It could create persistent browser and session identifiers and send full URLs, referrers, campaign parameters, language, screen dimensions, scroll depth, and time on page. The current source removes that script and guards the root layout against another hard-coded remote tracker. The separate Convex deployment, historical data, and live production release still require verification before we treat that incident as closed.
Browser PostHog is limited to eligible public pages after a separate affirmative choice and does not run in protected workspace routes. Rejecting or withdrawing results in no PostHog browser event, cookie, local-storage value, session identifier, or visitor identifier from that point forward. Autocapture, heatmaps, and session replay remain off. Consented pageviews include only reviewed public page paths and referring website origins, without query strings, fragments, page titles, or referrer paths. These support visitors, pageviews, referrers, and popular-page reports. Browser identities are not connected to accounts or teams. Separate server-to-server surface events continue regardless of the browser choice. Eligible, allowlisted, non-prefetch public navigations share one non-visitor stream identifier; eligible app navigations count only after Auth.js permits the request and share another. Only an allowlisted surface is variable, so these events cannot recognize a returning visitor or account. Sentry error monitoring and Cloudflare Turnstile abuse prevention are separate processing, not PostHog analytics.
The source includes the public-route consent and withdrawal controls, but browser capture remains disabled when its public project key is absent. Provider account settings, retention, processing region, access, and the production deployment remain separate evidence items. We do not use behavioral advertising trackers.
11. Human access to Customer Content
Timeline's operating standard prohibits routine browsing of team workspaces and permits production access only for user-requested support, service reliability, security response, legal compliance, or another documented operational purpose. It requires minimum-necessary, time-bounded access where practicable and confidentiality. Production access inventory, enforcement, and audit evidence are still being completed. Product roles do not give a team administrator a general bypass into another member's private items.
12. Security
Repository controls and the hosted deployment design include encrypted external transport, private-network traffic required between hosted services, team-scoped database and vector queries, per-record visibility checks, encrypted integration secrets using authenticated encryption, signed or authenticated webhooks, short-lived or controlled file access, audit records for security-relevant product actions, and review of external content before it reaches the agent. Current service networking and public exposure still require deployment verification. No system can be guaranteed completely secure. See the Trust page for a concise explanation.
13. Retention and deletion
| Data | Typical criterion |
|---|---|
| Account, membership, and legal-acceptance data | While the account or team relationship is active, then as needed for security, legal, dispute, and compliance records. |
| Customer Content and derived indexes | While the customer keeps it in Timeline, subject to supported deletion and export workflows and backup or recovery copies where configured. |
| Raw meeting media at Recall.ai | Timeline requests one-hour retention; raw media is not copied into Timeline object storage. Recall.ai documents seven-day operational-log retention and removal of meeting URLs 14 days after bot termination. Production request/account evidence and deletion-failure handling remain subject to verification. |
| Daytona document-extraction observability | Three days for provider logs, traces, and metrics; ephemeral sandbox state is discarded when the sandbox stops. |
| AI prompt and response content at inference providers | The current quality exception uses openai/gpt-4o-transcribe. OpenRouter's provider table lists OpenAI as not training on prompts but retaining them; OpenAI API data controls document default API abuse-monitoring retention of inputs and outputs for up to 30 days. |
| Authorized MCP-app grant and token digests | Revoking an authorized app immediately marks its grant and credentials inactive. Expired authorization-code digests are eligible for deletion after their ten-minute validity window. Access- and refresh-token digests remain until the associated refresh-token expiry, up to 30 days from that token pair's issue, so attempted reuse can still be detected. Revoked grant records are eligible for deletion after 31 days and only after their code and token rows have been removed. Public-client registration metadata and security audit records may be retained after revocation; those retained records do not allow the app to regain access. |
| Operational, security, support, and email records | Only as long as reasonably needed for the purpose, contractual commitments, fraud and incident investigation, or applicable legal requirements. |
Deletion from an active system may not immediately remove data from backup or recovery copies where those copies are configured, or from immutable security records. The existence, schedule, retention, and deletion behavior of deployed backups depends on the production configuration and must be verified. Law may also require preservation. We may retain de-identified information that cannot reasonably be linked back to an individual.
14. International transfers
Our company is established in Estonia, but providers and customer-directed integrations may process data in other countries. Before a GDPR-restricted transfer, it must be covered by an adequacy decision, approved standard contractual clauses, or another lawful safeguard as applicable. Contact us to confirm the currently executed safeguards relevant to your data before submitting data that depends on a particular transfer mechanism.
15. Your rights and choices
Depending on applicable law, you may request access, correction, deletion, portability, or restriction; object to processing based on legitimate interests; or withdraw consent. You may also close connections, change visibility, or ask your organization to act on workspace data. We may verify identity and authority before acting. Some rights are limited where an exemption applies or retention is legally required.
The Cookie settings control lets you reject or withdraw optional public-browser analytics as easily as you accepted. This browser choice does not govern the separately disclosed personless surface streams, pseudonymous server/worker product analytics, Sentry, security logs, or necessary service storage. See the cookies notice for the browser-storage inventory.
Send requests to [email protected] or use our private support form. Do not put account details or a privacy request in a public GitHub issue. You also have the right to complain to your local supervisory authority or the Estonian Data Protection Inspectorate.
16. Children and sensitive data
The service is intended for professional use and not for children under 16. The hosted Service is not approved for special-category personal data, protected health information, government identifiers, financial account credentials, or other highly regulated data. Do not submit any such data unless Timeline has given express prior written approval for the specific data and use case. Our written approval is mandatory in every case, even if your organization has determined that it has a lawful basis and appropriate safeguards. Timeline is not currently presented as HIPAA-compliant.
17. Automated decision-making
Timeline uses AI to organize information and propose or generate answers, but it is not intended to make decisions producing legal or similarly significant effects about people. Customers must provide appropriate human review for consequential decisions.
18. Changes to this Policy
We may update this Policy as the product, providers, or law changes. We will publish the new version and effective date. If a change is material or requires renewed acknowledgement, signed-in users will be asked to review the updated Terms and Privacy Policy before using the protected product again. We keep acceptance history to show which version a user accepted and when.
19. Contact
Privacy requests and questions: [email protected]. Provider: Nyxone OÜ, Estonian registry code 16172329, Harju maakond, Tallinn, Kesklinna linnaosa, Narva mnt 5, 10117, Estonia.