Privacy Policy

TL;DR

Pico Pico is privacy-first:

• No analytics, telemetry, advertising, or activity tracking
• Calendar and meeting data remain on your device
• We collect only the information necessary to authenticate users, process purchases, provide application functionality, and support re-downloads
• We never sell personal data
• Google user data is used solely to provide calendar and meeting features requested by you

Who We Are

Pico Pico is an independent macOS app distributed through picopico.xyz.

If you have questions about this Privacy Policy or your data, contact us at hello@advark.ai.

Information We Collect

We collect information directly from you, from authentication providers, and from payment processors only to the extent necessary to operate Pico Pico and fulfill purchases.

When you sign in or make a purchase on the website, we may collect:

• Your Google account name and email address (via Google OAuth through Supabase Auth)
• Any first name you enter during onboarding
• Purchase information, including:
  • Stripe session ID
  • Payment intent ID
  • Amount paid
  • Currency
  • Purchase timestamp

We do not collect or store your credit card details. All payment processing is handled securely by Stripe.

What the Mac App Stores Locally

All local application data remains on your device and is not transmitted to Pico Pico servers.

Local data may include:

• Google Calendar OAuth credentials (stored securely in macOS Keychain)
• Zoom OAuth credentials (stored securely in macOS Keychain)
• Application preferences and display settings
• Cached calendar events and meeting metadata retrieved directly from Google APIs
• Optional Claude Code / Codex session activity if the Claude Monitor feature is enabled

Pico Pico does not send:

• analytics,
• telemetry,
• crash reports, or
• usage tracking data.

Google User Data

Pico Pico accesses Google user data only after you explicitly connect your Google account and grant permission through Google’s OAuth consent flow.

This section describes only the data Google sends to the Mac app via the Calendar integration. Signing in to the picopico.xyz website is a separate Google OAuth flow handled by Supabase Auth — see “Information We Collect” above for what that flow collects.

Data Accessed

• openid email profile— your Google account ID, email address, display name, and profile picture URL. Used to identify the signed-in account in the app’s UI.
• https://www.googleapis.com/auth/calendar.readonly— read-only access to upcoming events on your primary calendar. Pico Pico reads each event’s title, start and end time, attendees (when present), and any conferencing data (Zoom, Google Meet, Microsoft Teams join URL) so it can show your next meeting and offer a one-click join button.
• https://www.googleapis.com/auth/calendar.events— used only to mint a fresh Google Meet link on demand. When you tap “Start instant Meet”, Pico Pico inserts a short-lived event with a Meet conferenceData.createRequest on your primary calendar, reads the generated Meet URL from the response, and immediately deletes the event. The throwaway event typically exists for less than a second.

Pico Pico does not request access to Gmail, Drive, Contacts, Photos, or any other Google service.

How We Use It

• The signed-in account’s email and name are shown inside the Mac app so you can confirm which account is connected.
• Upcoming-event data is rendered in the notch’s “Next meeting” panel and used to power the one-click join button.
• The throwaway calendar event is used solely to obtain a Google Meet URL, which is then opened in your browser.

How We Share It

We do not sell, rent, transfer, disclose, or otherwise share Google user data with advertisers, data brokers, analytics providers, AI model providers, or any other third party.

Google user data never passes through Pico Pico-operated servers. All Google API requests are made directly between the Pico Pico application running on your device and Google’s services.

AI and Model Training

Pico Pico does not use Google user data to train, fine-tune, improve, or develop generalized artificial intelligence or machine learning models.

How It’s Stored & Protected

• OAuth access and refresh tokens are stored locally in the macOS Keychain (encrypted at rest by macOS, accessible only to the Pico Pico app on your Mac).
• Calendar events and profile data fetched from Google are held in memory while the app is running and are not persisted to disk.
• All requests to Google’s APIs use HTTPS.

Retention & Deletion

• Tokens remain in your local Keychain until you disconnect your Google account from inside the Mac app, at which point they are removed from the Keychain. Deleting Pico Pico from /Applications also removes all locally cached Google data.
• You can revoke Pico Pico’s access to your Google account at any time from Google Account → Third-party apps with account access. Revoking access immediately invalidates the tokens Pico Pico holds.
• Because we never store Google user data on our servers, there is nothing for us to delete on your behalf — deletion is fully under your control via the two paths above.

Limited Use Disclosure

Pico Pico’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Third-Party Services

We use a small number of trusted third-party providers:

Supabase

Used for authentication and database storage. Supabase stores:

• your name,
• email address, and
• purchase records.

Stripe

Used for payment processing. Stripe independently handles payment and card information in accordance with its own Privacy Policy.

Vercel

Hosts the Pico Pico website and may maintain standard server access logs.

Google

Used for sign-in on the website (via Supabase Auth) and for the optional Google Calendar integration inside the Mac app. See the “Google User Data” section above for a detailed breakdown of what the Mac app accesses and how that data is used, stored, shared, and deleted.

Zoom

If you connect Zoom, authentication and meeting creation requests are processed directly with Zoom. Zoom’s handling of your information is governed by Zoom’s own privacy policies and terms.

Cookies

The website uses only essential functional cookies required for authentication and login sessions through Supabase.

We do not use:

• advertising cookies,
• tracking cookies, or
• analytics cookies.

Security

We implement reasonable administrative, technical, and organizational safeguards designed to protect personal information. These measures include:

• Encryption of authentication credentials through trusted providers
• Secure storage of OAuth tokens in the macOS Keychain
• HTTPS encryption for all communications with third-party services
• Access controls limiting access to account and purchase information

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Data Retention

Account information and purchase records are retained for as long as reasonably necessary to provide access to Pico Pico, maintain purchase history, comply with legal obligations, and resolve disputes.

You may request deletion of your account information at any time by contacting hello@advark.ai.

We will process verified deletion requests within seven (7) days unless a longer retention period is required by law.

Please note that Stripe may independently retain payment records for accounting, tax, or legal compliance purposes.

Your Rights

You may request:

• a copy of the personal data we hold about you, or
• deletion of your data

by contacting hello@advark.ai.

We aim to respond to all requests within seven (7) days.

Children's Privacy

Pico Pico is not intended for children under the age of 13.

If you believe a child has provided us with personal information, please contact us at hello@advark.ai and we will delete the account promptly.

Changes to This Policy

We may update this Privacy Policy from time to time.

Any material changes will be posted on this page with an updated “Last updated” date at the top.

By continuing to use Pico Pico after changes become effective, you agree to the revised Privacy Policy.