PA24 Privacy Policy

Effective date: 27 September 2026

The short version

• PA24 is a personal assistant. You tell it about your day. It builds a plan and writes drafts for you to send yourself.
• You can use PA24 without an account. In guest mode, what you say and what PA24 builds from it stays on your phone, unless you later sign in and it moves to your account.
• If you sign in with your email address, we keep your notes, plans and drafts on our servers in London, so PA24 can remind you and work across your devices.
• Your phone turns your voice into text. The PA24 app sends us the words, not the recording.
• PA24 never sends a message or email for you. Drafts open in your own apps, and you press send.
• We use outside AI services only if you say yes, and what you say about how you feel only if you say yes to that separately. You can change your mind at any time.
• We do not sell your data. We do not show adverts or track you across other apps. We do not use your life to train AI models.
• You can download or delete everything yourself, in the app, at any time.

1. Who we are

PA24 is provided by BespokeWorks AI Limited, a company registered in England and Wales (company number 14553823), whose registered office is at Unit 9, Magreal Industrial Estate, Freeth Street, Birmingham, B16 0QZ. In this policy, "we" and "us" means BespokeWorks AI Limited.

We are the controller of the personal data described here. This means we decide how and why it is used, and we are responsible for it. We are registered with the Information Commissioner's Office (ICO) under registration number ZB947426.

PA24 is offered to people in the United Kingdom.

Contact us about anything in this policy at hello@pa24.ai, or by post at our registered office.

2. What this policy covers

This policy covers:

• the PA24 app for iPhone;
• the web version of the app at app.pa24.ai;
• our website, pa24.ai; and
• the PA24 servers these connect to.

It does not cover other companies' apps and services that PA24 hands you over to, such as WhatsApp, Messages, Mail or the App Store. Their own privacy policies apply.

3. Two ways to use PA24

Guest mode (no account)

When you tap Get started, PA24 runs entirely on your phone. Your notes, plans, drafts, the people you name and what PA24 learns are saved in the app's storage on your phone. They are not sent to our servers unless you sign in (see "If you sign in later" below). On the web version, they are saved in your browser's storage instead. If you use a shared computer, delete them when you finish (Settings, Privacy, Delete everything).

A few things still use the internet:

• When the app opens, it checks whether our server can be reached, so it knows whether to offer sign-in. This check contains none of your notes or plans. Like any request to our server, it is logged (section 4.9).
• If your phone cannot turn speech into text on the device, or you turn off Transcribe on this phone in Settings, your phone's own speech service does it. On iPhone that is Apple's speech service, under Apple's terms. On the web version it is your browser's speech service.

In guest mode:

• reminders and briefs are scheduled on the phone itself, and no push token is sent to us;
• there is no free trial;
• we cannot see, recover or restore your data. If you delete the app or lose your phone, it is gone.

If you sign in later. When you sign in from guest mode to a new account, the app moves your guest setup to our servers: your settings, sleep settings, routines, the people and patterns PA24 has learned, your notes (the most recent 500) and what PA24 understood from them, your writing styles and your history. Mood readings move only if you said yes to PA24 using how you feel, and only while they are less than 18 hours old. Your conversation, drafts and saved plans do not move. Once the move succeeds, the app deletes the guest copy from your phone, including the conversation and drafts. Your answer about outside AI services is not carried over, so you will be asked again. If the account you sign in to is already in use, nothing moves, and your guest data stays on the phone.

With an account

When you sign in with your email address, PA24 runs on our servers. Most of this policy is about accounts.

4. What we collect, and why

For each part of PA24, this section says what we collect, why, and our lawful basis under UK data protection law. Section 10 says how long we keep it.

4.1 Your account and signing in

What we collect:

• your email address;
• a random account number;
• the six-digit sign-in codes we email you. We store each code only in scrambled form (a keyed hash), with its expiry time and how many wrong attempts were made;
• when your account was created, and when the app last loaded your account;
• a record of each device you are signed in on (a random session number and when it started and was last renewed);
• your time zone, and whether you use iPhone or the web, taken from your device;
• your plan, any trial end date, and whether you have finished setup;
• your settings, including the optional first name you give us (used to sign drafts) and the optional home town you give us (used for a weather line).

How sign-in works: we email you a code. It works for ten minutes, and only once. Asking for a new code cancels the old one. We limit how many codes one address can receive, and how many wrong codes can be tried. Once you are signed in, the app keeps a session token in your phone's secure storage (on the web, in your browser's storage). A session lasts 30 days and renews quietly while you use the app, but ends after 180 days at most. Signing out ends the session on our server as well as on your device. Sign out everywhere, in Settings, ends every session on every device.

We email you only your sign-in codes, and a warning before we delete an account that has not been used for two years (section 10). We do not send marketing emails.

Why: to create your account, sign you in, keep you signed in, and check whether your email address qualifies for the Student plan (it must end in .ac.uk).

Lawful basis: contract.

4.2 Voice notes, and what you type

What happens when you speak:

• You tap Speak. Your phone turns what you say into text. Where the phone can do this on the device, the audio does not leave the phone. Where it cannot, your phone's speech service does it (section 3).
• The PA24 app sends us the text. It does not send us the recording.
• By default, the recording is not kept on your phone. If you turn off Delete audio after transcription in Privacy, recordings are kept on your phone. They are still not sent to us.

What we store on our servers:

• the text of each note or reply (up to 4,000 characters), when you made it, how long the recording was, and whether it was spoken or typed;
• what PA24 understood from it: events, tasks, messages you want written, and wake and bed time wishes. A mood reading is kept only if you have said yes to PA24 using how you feel (section 5);
• a one-line summary, if an outside AI service wrote one (section 6);
• your conversation with PA24, including its replies, which your phone can read aloud with its own voice;
• a copy of the result of each note for 30 days, so that a note sent twice (for example after a dropped connection) is not processed twice.

Why: this is how PA24 understands what you want, and builds your day.

Lawful basis: contract. Mood readings: your explicit consent (section 5).

4.3 Your day: plans, routines, patterns and the people you name

What we store:

• your day plans: what is placed when, the three versions of the day PA24 considered, and why it chose one;
• your sleep settings: wake time, how much sleep you need, whether you are a lark or an owl, your wind-down time, and different wake times for particular days;
• the anchors of your week (routines), such as work, lectures or the gym;
• the people you mention or add: their name, other names you use for them, the relationship you chose (mate, partner, family, work or client), how often you have met and whether meetings ran over, and notes on how PA24 learned this;
• patterns PA24 notices, such as when you usually have lunch or go to the gym, with the evidence;
• how you usually write to each person (greeting, sign-off, capitals, contractions, exclamation marks, kisses, emoji and length), learned from the drafts you approve and edit;
• your corrections (moving, dropping, keeping or finishing things), a history of what happened (used when you ask about your week and for the weekly report), a weekly accuracy score, and a record of which briefs and check-ins have run;
• the Assistant permissions you grant (all are off until you turn them on), and a log of every change PA24 makes under them.

Weather: if you give us a home town and the weather line is switched on, our server sends the town's name and the date to Open-Meteo to get a forecast for your morning brief. Nothing else is sent, and the request comes from our server, not your phone. We keep the forecast in the server's memory for six hours.

You can see and correct most of this in the You tab and in Settings, and you can remove a person or a pattern at any time. Pause learning, in Privacy, stops PA24 learning anything new from your notes, finished events and sent drafts, while it keeps using what it already knows.

Why: to build a day that fits your life, and to get more accurate over time.

Lawful basis: contract.

4.4 Drafts and messages

What we store: each draft's channel (WhatsApp, text message, email or other), who it is to (a name), its subject and text, any send time you set, whether you approved or binned it, and each change made to it, including instructions such as "make it shorter". Binned drafts are deleted after 30 days.

PA24 never sends a message or email for you. When you approve a draft, PA24 opens WhatsApp, Messages or your mail app with the text ready, or copies it for you to paste. You choose who it goes to, and you press send. What happens after that is covered by that app's own terms.

If you give a draft a send time, PA24 reminds you when it is due. It still does not send it.

We do not read your email inbox or your message history.

Why: to write messages the way you would, and to remind you to send them.

Lawful basis: contract.

4.5 Calendar and contacts on your phone

Both are optional. The app asks your permission first, and works without them.

Calendar. You choose which of your phone's calendars PA24 may read. It reads the next 14 days (7 days during setup). For each event it reads the title, the times, whether it lasts all day, the location, the names of other people invited, whether any of them has accepted, and whether the time is marked busy. Invitees are kept by name only, never by email address. Cancelled events, events you declined and time marked free are left out.

• If you are signed in, these events are sent to our server and replaced each time the app reads your calendar. If you stop sharing a calendar, its events are removed from PA24.
• In guest mode, they stay on your phone.
• PA24 only writes to your phone's calendar when you tap Copy today to Calendar and confirm. It then copies today's planned activities into a separate calendar called "pa24", replacing only the entries it copied before. It does not change your own events.

Contacts. PA24 uses your phone's contact picker. You choose one person. PA24 reads only the contact you pick and keeps only their name, and you choose the relationship. Phone numbers, email addresses and photos are not imported.

Why: to plan around what is already booked, and to recognise the people you mention.

Lawful basis: contract. You control access through your phone's permissions, and can turn it off at any time in your phone's settings.

4.6 Notifications, reminders and the wake-up

• Reminders before your activities, the wind-down reminder, "leave now", and the daily brief and check-in reminders are scheduled on your phone. Their content stays on the phone.
• On iPhone with iOS 26 or later, the wake-up you ask for is set as a real alarm on the phone, through Apple's AlarmKit. On earlier versions it is a notification.
• If you are signed in and allow notifications, your phone gives us a push token. We keep up to five per account. We use them to send the morning brief, and drafts that fall due, while the app is closed. Depending on your plan, we also send the evening check-in and "leave in ten" reminders. During your quiet hours (Settings, Times), they arrive silently. Signing out removes that phone's token, and we drop tokens for phones that no longer have the app.
• Push notifications are delivered through Expo's push service and then Apple's push service. The text of the notification passes through both. It can include part of your plan, such as an event's title and time, or the name of the person a draft is for.

Some notifications are Time Sensitive, so they appear during Focus. You can change this in your iPhone's settings.

Lawful basis: contract.

4.7 Purchases

PA24 does not sell subscriptions yet, so we collect no payment or purchase information. Before paid plans go on sale, we will update this policy to explain how purchases work and who handles them.

4.8 Daily limits

The free plan allows three voice notes in any seven days. We work this out from your saved notes.

Every plan also has a daily allowance for outside AI services (section 6). For each account and day, we count how many times we used the language model, and whether we have told you the allowance is used up. When it is, PA24 carries on with its own engine for the rest of the day.

Why: to keep PA24 fair and affordable, and to stop one account running up large bills.

Lawful basis: legitimate interests (keeping PA24 available and its costs under control).

We keep these counts until you delete your account.

4.9 Security logs and preventing misuse

• Our server writes a short log line for each request: the time, a random request number, the kind of request, the address it was for (which can include the date of a plan or the number of a draft), the result and how long it took. It does not log what you said or wrote. When something goes wrong, it logs a short technical error, and sometimes your account number. Google Cloud also records each request with the network (IP) address it came from, the app or browser version (user agent), the address requested, the time and the result. Google Cloud stores these logs for us in its global logging storage, which may be outside the UK (section 9), for up to 12 months.
• To stop abuse, we count requests for each account, and for sign-in requests, for each network (IP) address. These counts are held only in our server's memory. They are not saved in our database, and are cleared when the server restarts.
• We count the sign-in codes sent to each email address, and wrong attempts, in our database (section 4.1).

Why: to keep PA24 and your account secure.

Lawful basis: legitimate interests (security and preventing misuse).

4.10 Our website, pa24.ai

• The website sets no cookies, and uses no analytics or advertising tools.
• The interactive example runs in your browser and sends nothing to us.
• If you sign in on the website, it uses the same email code sign-in, and creates a PA24 account if you do not have one. Your session is kept in your browser tab's session storage, and ends when you close the tab or sign out.
• The website and the web app are hosted on Google's Firebase Hosting.

5. How you feel: health information, only with your yes

What you say about how you feel (for example "I'm knackered" or "feeling rough") is information about your health, which the law protects more strictly. PA24 uses it only with your explicit consent.

• The app asks on the permissions screen when you set up, and you can change your answer at any time in Privacy, Use how I feel. It is off until you say yes. We record your answer and when you gave it.
• With your yes, PA24 turns what you say about how you feel into a simple mood reading (how positive and how energetic you sound) and uses it to shape the next 18 hours of your plan, for example a lighter day when you are tired. Each reading is deleted after those 18 hours.
• Without it, PA24 ignores what you say about how you feel, and keeps no mood reading.
• Turning it off deletes the mood readings we hold straight away, and PA24 stops using them.

Other health details you choose to include in a note, such as a doctor's appointment, are kept as part of that note so PA24 can plan around them. Please include only what PA24 needs to help you.

PA24 is not a medical service, and does not diagnose, treat or monitor any condition.

Lawful basis: your explicit consent (UK GDPR Article 9(2)(a)).

6. Outside AI services, and your permission

PA24 can plan your day entirely with its own engine. If you allow it, it also uses an outside AI service.

How we ask:

• The app asks you once, on the Assistant tab, the first time the service is available. It names the service and says what it receives. You choose Allow or Don't allow; closing the question counts as Don't allow.
• Our server enforces your answer. Without a yes, nothing is sent to the service.
• You can change your answer at any time in Privacy, Use outside AI services. We record your answer and when you gave it.
• Turning it off stops sharing from then on. It cannot recall what was already sent.

Each account has a daily allowance for this service (section 4.8).

Lawful basis: your consent.

7. No training on your life

We do not use what you tell PA24 to train AI models. PA24 learns about you only to plan your own days, and what it learns stays in your account.

We hold the outside AI service to the same promise:

• OpenRouter: every request names Microsoft Azure's EU service as the only provider allowed to answer it, forbids passing it to any other, refuses providers that collect data, and requires zero data retention. If no provider meets these rules, the request fails and PA24 uses its own engine instead. Requests pass through OpenRouter's servers in the United States. OpenRouter keeps no prompts or replies unless prompt logging is switched on in our OpenRouter account, and we do not switch it on. It keeps information about each request, such as its size and how long it took, and may classify a small sample of requests without linking them to us or to you.
• Microsoft Azure: Microsoft does not use prompts and replies to train its models, and does not make them available to OpenAI. OpenRouter lists this Azure service as keeping no prompts. Microsoft's automated abuse monitoring checks requests as they pass; content it flags may be kept for review in the same region as the service.
• Apple's speech service is used by your phone under Apple's terms, not ours.

8. Who we share data with

We do not sell your personal data. We do not share it for advertising. We do not track you across other companies' apps or websites.

We share personal data only with the service providers below, who handle it for us under contract and on our instructions, and with the services you choose to use.

These act under their own terms and privacy policies, not as our service providers:

• Apple: the App Store, the speech service on your iPhone, and Apple's push notification service.
• WhatsApp, Messages, Mail and any other app that opens your drafts.

We may also share personal data if the law requires it, or to protect someone's safety. If our business is sold or reorganised, your data may pass to the new owner, and this policy will continue to protect it.

9. International transfers

Our server and database are in London. Some of our providers handle personal data outside the UK. We protect it like this:

• Google Cloud and Firebase Hosting (the European Economic Area and the United States): UK adequacy regulations cover the EEA. For the United States, Google LLC is certified under the UK Extension to the EU-US Data Privacy Framework, and Google's terms also include the ICO's UK Addendum to the EU standard contractual clauses.
• Supabase (support access from outside the UK): the UK Addendum to the EU standard contractual clauses, in Supabase's data processing agreement.
• OpenRouter (United States): the UK Addendum to the EU standard contractual clauses, in OpenRouter's data processing agreement.
• Microsoft Azure (European Union): UK adequacy regulations.
• Expo (United States): Expo is certified under the UK Extension to the EU-US Data Privacy Framework.
• Resend (United States): Resend is certified under the UK Extension to the EU-US Data Privacy Framework, and its data processing agreement also includes the UK Addendum.
• Open-Meteo (Switzerland): UK adequacy regulations.

You can ask us for details.

10. How long we keep your data

11. Your rights

You have the right to:

• access your personal data and get a copy;
• portability: get it in a format a computer can read;
• correction of anything that is wrong;
• deletion;
• restriction: ask us to limit how we use it;
• objection to our use of it where we rely on legitimate interests;
• withdraw consent at any time, where we rely on your consent.

You can do most of this yourself in the app:

• Export. Go to Settings, Privacy and tap Export. You get one file (JSON) with your notes, what PA24 understood from them, the conversation, plans, drafts, writing styles, history, corrections, the permissions log, calendar copies and weekly scores. It does not include some technical records, such as push tokens, session records and usage counts. Ask us for those.
• Correct. Change your details in Settings. Correct or remove people, patterns and sleep settings in the You tab.
• Delete. Go to Settings, Privacy and tap Delete everything. This deletes your account and its data straight away, and cannot be undone. The exceptions are in section 10 (backups, logs and sign-in code records). In guest mode, it deletes everything PA24 saved on your phone.
• Withdraw consent. In Privacy, turn off Use outside AI services, or Use how I feel.
• Stop learning. Turn on Pause learning in Privacy.

You can also email hello@pa24.ai. We will reply within one month. If your request is complex, we may take up to two more months, and we will tell you why. We may need to confirm that the request comes from you, for example by asking you to write from the email address on your account.

12. Complaints

If you are unhappy with how we have used your data, please tell us first at hello@pa24.ai. We will acknowledge your complaint within 30 days, look into it, and tell you the outcome.

You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint, or on 0303 123 1113.

13. Age limit

PA24 is for people aged 16 and over. The app asks you to confirm this before you start. We do not ask for your date of birth.

If you are 16 or 17, you have the same rights as everyone else, and we have assessed PA24 against the ICO's Age Appropriate Design Code for people your age.

If we learn that someone under 16 is using PA24 with an account, we will delete the account. If you think this has happened, please contact us.

14. Automated decisions

PA24 makes some decisions automatically, as part of what it does for you:

• it builds your day, compares three versions of it, and tells you when you have taken on too much;
• it can use your recent sleep and, if you have said yes, how you said you feel, to choose a lighter day;
• with your permission (off until you turn it on), it adds buffers and travel time to its plan, or moves activities in its plan that involve only you, by up to a time you set. It never changes the events in your own calendars. Each change is logged, and you can undo it;
• it checks whether your email address qualifies for the Student plan, and applies the limits of your plan.

These are suggestions and settings for your own day. They have no legal effect on you, or any similarly significant effect. You can see why PA24 chose the shape of your day (Why this shape), pick another, move or drop anything, and correct what it has learned.

15. Keeping your data secure

What we do:

• Connections to our server are encrypted, and our server tells browsers to use only encrypted connections. The connection to our database is encrypted and checks the database's certificate.
• Sign-in codes are random, short-lived, single-use and stored only in scrambled form, with strict limits on attempts.
• Sessions are signed and expire, and signing out ends them on our server.
• Our server's database account can reach only PA24's own tables, and those tables are not published through Supabase's public interface.
• Our secret keys are kept in Google Secret Manager.
• We limit how many requests can be made, and how large they can be.
• The app contains no analytics, advertising or crash-reporting software.

No system is perfectly secure. If a breach puts you at risk, we will tell you and the ICO as the law requires.

16. Cookies and storage on your device

Our website sets no cookies. When you sign in on the website, your session is kept in that browser tab's session storage and ends when you close the tab or sign out.

The PA24 app, and its web version, store what they need to work on your device: your session (in secure storage on iPhone), your guest data in guest mode, and a short-lived copy of your account data so the app works offline. This storage is strictly necessary to provide PA24, so we do not ask for separate permission for it. Signing out or Delete everything clears it.

17. Information about other people

PA24 stores information about people in your life when you give it: their names, their relationship to you, events with them, and drafts to them. Please add only what PA24 needs to help you. We use it only to provide PA24 to you, and we never contact these people. Anyone who wants to ask about information we may hold about them can contact us.

18. Changes to this policy

If we change this policy, we will change the effective date at the top. If a change matters to how your data is used, we will tell you in the app before it takes effect.

19. Contact

BespokeWorks AI Limited, Unit 9, Magreal Industrial Estate, Freeth Street, Birmingham, B16 0QZ. Email: hello@pa24.ai. ICO registration number: ZB947426.