Privacy policy

Updated 28 October 2026

Wishbone helps you keep track of the people you know by bringing your contacts, calendar, email activity and notes into one workspace. It is run by Ronan Hussar (“Wishbone”, “we”, “us”). This policy covers the Wishbone app at app.wishbone.network, the Wishbone Chrome extension, the Wishbone API and MCP connection, and the website at wishbone.network (together, the “Service”). It explains what we collect, why, who we share it with, how long we keep it, and the choices and rights you have. By using the Service you acknowledge this policy. If you do not agree with it, do not use the Service.

The short version

  • We do not sell your data, share it for advertising, or use it to build profiles for advertisers.
  • We do not use your data, or data from your connected accounts, to train general-purpose AI models, and our AI providers are not permitted to train on it.
  • You choose which accounts to connect, and you can disconnect them or delete your account at any time.
  • Your data is kept separate from every other account’s. Other people see it only if you share it (for example in a shared workspace).
  • You are responsible for the information about other people that you put into Wishbone. See “Information about other people” below.

Information we collect

  • Your account. Your email address and name, and your basic Google profile (name, email, picture) if you sign in with Google. Sign in is handled by Clerk, which also sets the session cookies that keep you signed in.
  • Accounts you connect. Only the ones you connect yourself, such as Google (Gmail, Calendar, Contacts, Drive, YouTube), Microsoft Outlook, Slack, GitHub and X. We receive an access token for each, plus the data described under “How connected accounts are used”.
  • What you add. People, notes, reminders, drafts, meeting notes, groups, files and images, messages you write to the assistant, and anything else you enter, upload or import.
  • Data from devices you pair. If you pair a helper app, device or the Chrome extension, the information that component sends to your account (for example summaries of conversations on your own computer, or LinkedIn profile details).
  • Information we derive. For example how often you are in touch with someone, when you last spoke, summaries, suggested follow ups, search indexes (embeddings) of your notes and summaries, and public profile photos matched to people in your workspace.
  • Usage and technical data. Pages and controls you use, features used and how often, errors and performance, device and browser type, approximate location from your IP address, and session replays with all text, inputs and images masked (see “Analytics and cookies”).
  • Messages to us. If you email us, we keep the message and our reply.

We do not knowingly collect payment card numbers, government identifiers, or health or financial account data. Please do not put them in notes or other free text fields. If paid plans are introduced, this policy will be updated before any payment information is collected.

Information about other people

Wishbone is built around information about the people you know: names, contact details, employers, roles, conversations, meetings and your own notes. That information comes from you, from accounts you connect, and from public profile pages you view through the extension. For this information you decide what is collected and why, and you are responsible for having the right to store and use it. This means that you:

  • should use it only for personal and professional relationship management, and in line with the law that applies to you, including laws on email and text outreach and on unsolicited marketing;
  • must not use Wishbone to make decisions about a person’s employment, credit, insurance, housing or similar eligibility. Wishbone is not a consumer reporting agency and its data is not intended for those uses;
  • must respect the terms of the services you connect and the sites you use with the extension, such as Google, Microsoft, Slack and LinkedIn;
  • are responsible for responding to any person who contacts you about information you hold on them. If someone contacts us, we may refer them to you.

To the extent privacy law treats you as the party deciding how that information is used, Wishbone acts as your service provider or processor. We process it only on your instructions, as described here, and for no purpose of our own other than running, securing and improving the Service. If you need a data processing agreement, email us.

How we use information

  • To provide the Service: sync your accounts, build your people and timeline, search, draft, remind and respond to what you ask the assistant to do.
  • To keep it secure and working: authenticate you, prevent abuse and fraud, rate limit, debug, back up and restore.
  • To improve Wishbone: understand which features are used and where they fail, using the masked analytics described below.
  • To communicate with you: service messages such as invitations, security notices and changes to this policy. We do not send marketing email without a separate opt in.
  • To meet legal obligations and to establish, exercise or defend legal claims.

Where the EU or UK GDPR applies, our legal bases are: performing our contract with you (providing the Service); our legitimate interests in securing, supporting and improving the Service, which we balance against your rights; your consent, where we ask for it (for example when you connect an account, which you can withdraw by disconnecting it); and compliance with legal obligations.

How connected accounts are used

  • Gmail. The regular sync reads message headers only (who, when, how often), never subjects or bodies, to count how often you are in touch with each person. Some features read the text of specific recent messages when you open them, for example a conversation preview or drafting a reply. That text is used for the request and is not kept unless you save something.
  • Calendar. Read to show your meetings and who attended. Wishbone only creates or changes events when you ask it to.
  • Contacts and Drive. Read only, to match people and to show documents you choose.
  • Microsoft, Slack, GitHub, X and YouTube. Used only for the feature you connected them for.
  • Nothing is sent for you. Wishbone drafts messages but does not send email or messages on your behalf unless you tell it to in that moment.

Wishbone’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide and improve the user facing features you see in Wishbone. It is not sold, not used for advertising, not used to determine creditworthiness or for lending, not used to train general purpose AI models, and not read by humans unless you ask us for support and agree, it is needed for security or to investigate abuse, or the law requires it.

The Chrome extension

The Wishbone Chrome extension keeps the people already in your Wishbone current as you use LinkedIn.

  • What it reads. When you open a LinkedIn profile page, the extension reads what that page shows you: name, headline, current role, location, work history, education, About section and profile photo, and, for your first degree connections, the contact info LinkedIn shows you.
  • Only people you already have. The profile is sent to your Wishbone account, which updates the matching person if they are already in your workspace. Wishbone never adds new people from LinkedIn. A profile that matches no one in your workspace is discarded without being saved.
  • Background refreshes. Off unless you turn them on. When on, the extension opens the profiles of people in your workspace that are due for a refresh, one at a time in a background tab, up to a daily limit you set, mostly while you are away from your computer. It uses Chrome’s idle status only to tell whether you are at your computer.
  • LinkedIn messages. Off by default. When turned on, message text is sent only to a helper app on your own computer, never to Wishbone’s servers. The helper uses the Codex app you are signed in to on that computer to write short follow up notes, and saves only those notes to Wishbone. Scans can mark conversations as read on LinkedIn.
  • Where it runs. Only on LinkedIn and on Wishbone itself. It does not read other sites or your browsing history.
  • Your token. Signing in to Wishbone pairs the extension with your account using a token kept in this browser’s local extension storage, not Chrome Sync. The extension also keeps a short list of recently captured profile addresses and an activity log there; neither leaves your browser. Wishbone receives a summary of each refresh session, such as how many profiles were checked.
  • Your responsibility. Automated or background activity on a third party site may be restricted by that site’s terms. You decide whether to turn these features on and are responsible for how you use them.

Data from the extension is used only to keep your Wishbone current. It is not sold, not transferred for advertising, not used to determine creditworthiness or for lending, and not used to train AI models. Its use complies with the Chrome Web Store User Data Policy, including the Limited Use requirements.

AI features and assistants you connect

  • Our AI providers. Some features, such as summaries and suggested replies, send the relevant text to Anthropic to generate a response, and meeting notes and summaries are sent to Voyage AI to make them searchable. They are sent only to run the feature you are using. Both providers process this data under their commercial API terms, which do not allow them to train their models on it.
  • Your own keys and helpers. If you add your own API key, or use a model helper running on your own computer, the text of your chat is sent to that provider under your agreement with it, and their terms and privacy policy apply. Keys you add are stored encrypted.
  • Assistants you connect. You can connect outside AI assistants and agents (for example through MCP or a ChatGPT or Claude connection). Connecting opens a Wishbone page where you approve the connection and choose read only or read and write access; each connection is listed on the Agents page, where you can revoke it at any time. When the assistant needs Wishbone it calls a Wishbone tool and receives only that tool’s result, which is then governed by the assistant provider’s terms, not this policy. Wishbone does not receive your conversations, the assistant’s memory or your files, only the tool calls it makes. We keep a log of each call (which tool, when, by which connection, and an outline of its inputs with search and message text removed) for 180 days so you can see what a connection did. Wishbone never sends a message on your behalf. Connect only assistants you trust.
  • Accuracy. AI output can be wrong, incomplete or out of date. Review it before you rely on it or send anything.
  • No automated decisions. We do not make decisions about you that have legal or similarly significant effects through automated means.

Who else sees it

Wishbone does not sell your data or share it with advertisers. We share information only as follows:

  • Service providers that process data for us under written terms: Vercel (hosting), Neon (database), Clerk (sign in), Anthropic and Voyage AI (AI features), unavatar.io (public profile photos), and PostHog (product analytics). We may add or replace providers that do the same jobs, such as for email delivery, error monitoring or payments, and will keep this list current. Ask us for the current list at any time.
  • People you choose. If you use a shared workspace, or invite others to one, members can see the information shared there according to their role (such as owner or editor). Private notes, reminders and drafts in your personal workspace are not shared by that. You are responsible for who you add.
  • Services and assistants you connect or instruct, as described above.
  • Legal and safety. If we believe in good faith that disclosure is required by law, subpoena or court order, or is needed to protect the rights, property or safety of Wishbone, our users or the public, or to detect and prevent fraud or abuse. Where lawful, we will tell you first.
  • Business changes. If Wishbone is involved in a merger, acquisition, financing or sale of assets, your information may be transferred. We will tell you and the acquirer will have to honor this policy or give you a choice.
  • De-identified data. We may use aggregated or de-identified data that cannot reasonably be linked to you or to anyone in your workspace, for example usage statistics.

Analytics and cookies

PostHog records which pages and controls you use in the app, which features and assistant tools are used and how often, errors, and session replays, to improve Wishbone. Replays mask all text, form inputs and images, and no contact names, email or message content, or search text is sent. On this website, PostHog counts visits and clicks on Get started. Wishbone uses cookies and local storage that are needed to keep you signed in, remember your theme and settings, and run this analytics. We do not use advertising or cross site tracking cookies. If your browser sends a Global Privacy Control signal, we treat it as a request to opt out of any sale or sharing, which we do not do in any case. There is no standard for Do Not Track signals, so we do not respond to them separately. You can block cookies in your browser, but the app may not work without the sign in cookies.

Where data is stored

Data is stored in a Postgres database hosted by Neon and served by Vercel, in the United States. If you use Wishbone from outside the United States, your information is transferred to and processed in the United States, which may have different data protection laws from your country. Where required, we rely on appropriate safeguards for those transfers, such as the Standard Contractual Clauses. Each account’s data is kept separate from every other account’s.

How long we keep it

  • Your content and connected data is kept while your account is active, so that Wishbone can work for you.
  • When you disconnect an account, we stop syncing it and delete its access token. Data already imported into Wishbone stays until you delete it or your account, so your history is not lost.
  • When you delete your account or ask us to, we delete your account and its data within 30 days. Copies in backups and logs are overwritten on the providers’ normal cycles. Until then they are not used for any purpose except restoring the Service.
  • Inactive accounts may be deleted after we give you notice.
  • Some records (for example security logs, billing records if ever applicable, and records of deletion requests) may be kept longer where needed for security, to resolve disputes, to enforce our terms, or to comply with law.
  • Public profile photos and other matches are kept only for the people in your workspace and go when those people are deleted.

Security

We use reasonable technical and organizational measures to protect your information: data is encrypted in transit over HTTPS, access tokens for connected services and API keys are encrypted at rest, accounts are separated from each other, and access to production systems is limited to Ronan Hussar and the providers needed to run the Service. No system is completely secure, and we cannot guarantee that your information will never be accessed, disclosed, altered or destroyed. You are responsible for keeping your sign in details and the devices you pair safe, and for using a strong sign in method. If you believe your account has been compromised, email us right away. If a breach affects your personal information, we will notify you and the authorities as the law requires.

Your rights and choices

  • Everyone. Disconnect any connected account in Settings at any time. You can also revoke Google access at myaccount.google.com/permissions. Disconnect the Chrome extension in Settings, under Devices, or remove it from Chrome, which deletes everything it kept in your browser. Download your data from the app. Ask for a copy of your data, or for your account and all its data to be deleted, by emailing info@wishbone.network.
  • EEA, UK and similar laws. You may ask to access, correct, delete or port your personal data, to restrict or object to its processing, and to withdraw consent at any time without affecting earlier processing. You may complain to your local data protection authority.
  • California and other US states. You may ask to know what personal information we hold and how it is used and shared, to correct or delete it, to get a portable copy, and to opt out of sale, targeted advertising and profiling. We do not sell personal information or share it for cross context behavioral advertising, and we do not use it for profiling that has legal effects. We do not discriminate against you for using these rights. In the past 12 months we collected the categories listed under “Information we collect” (identifiers, contact and professional information, communications metadata and content you add or choose to sync, internet activity and device data, and inferences such as summaries) for the purposes above, and disclosed them only to the providers listed under “Who else sees it”.
  • How to ask. Email us. We may need to verify that the request comes from you, and you may use an authorized agent. We respond within 30 days, or sooner where the law requires, and tell you if we need more time. If we decline, you can appeal by replying to our response.
  • Limits. We may decline a request where the law allows, for example where it would reveal another person’s information or where we must keep the data. If your information is in someone else’s Wishbone, that person decides how it is used, and we may direct you to them.

Children

Wishbone is for adults. It is not directed to anyone under 18, and we do not knowingly collect personal information from them. If you believe a child has given us information, email us and we will delete it.

Third party services

The Service links to and works with services we do not control, including Google, Microsoft, Slack, GitHub, X, LinkedIn and AI providers. We are not responsible for their content or privacy practices. Read their policies before connecting them.

Changes

We may update this policy. If it changes in a meaningful way, the date above will change and active users will be told by email before the change takes effect, and where the law requires it we will ask for your consent again. Continuing to use the Service after the change means you accept the updated policy. Previous versions are available on request.

Contact

Questions, requests or complaints about privacy: info@wishbone.network. Wishbone is operated by Ronan Hussar.