Your privacy

Candor is a short, confidential conversation that helps an organisation understand where work gets slow or painful. It is operated by Paradigm Machines ("we", "us"). This policy explains what we collect, why, and what we never do with it.

Summary

Connecting Gmail is optional. Without it, you just tell Candor your company and role.
If you connect Gmail, access is read-only, used once to understand your role, and revoked immediately. Your emails are never stored.
What you say in the interview is kept confidential and used only to understand bottlenecks at your organisation.
We do not sell your data, use it for advertising, or use it to train AI models.

Information from Google (Gmail)

If you choose "Connect Gmail", you grant Candor the gmail.readonly permission and basic sign-in (your email address). Candor uses that access once, at the moment you connect, to read:

your mailbox's email address and display name;
your Gmail signature setting (which often includes your job title) and the names of the labels you have created;
for up to 25 messages you sent in the last 90 days and up to 25 messages you received in the last 45 days (excluding promotions, social, updates and forums): the subject, sender, recipients, date and Gmail's short preview of the message;
only if you have no signature set: the closing lines of up to 2 recently sent messages, to find your signature.

How it is used. Candor first counts, in code, who you correspond with most (colleagues by name, outside organisations by domain only) and which conversations recur. This information is then condensed, in memory, into a short work profile (for example: your likely role, team, company and the kinds of work you do) so the interview can skip basic questions. To produce that profile, the information is sent to our AI model provider (Anthropic) for processing. Automated and repetitive messages are filtered out first.

What is kept. Only the short profile is stored. The messages themselves, including subjects, previews, signatures and label names, are not stored. The Google access token is held only until the read completes (normally a few seconds), then deleted from our database and revoked with Google, so Candor cannot access your mailbox again.

Google API Services User Data Policy. Candor's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, Gmail data is used only to provide the interview feature described above; it is never used for advertising, never sold, never used to train generalised AI or machine-learning models, and no person reads it unless you ask us to (for example for support), it is needed for security or abuse investigation, or the law requires it.

Information you give us in the interview

Start-page details: the company and role you enter if you don't connect Gmail.
Your answers: the messages you type, the interviewer's questions, working notes the interviewer keeps during the conversation (for example, topics covered), and the summary of findings produced at the end.

This is used to identify inefficiencies and bottlenecks in how work gets done at your organisation, and is made available to the organisation that invited you to Candor for that purpose. Findings are written about processes, not about individuals. Separately, Candor keeps a shared knowledge base for each organisation containing only neutral facts about how it works (for example, team names, systems and processes); it never includes opinions, complaints, names or anything that identifies who said what.

Public information about your company

To avoid asking you basic questions, Candor reads public information about your company: its website, news, job postings and published employee reviews. These searches use only the company's name or website, never your name or anything you said.

Cookies

Candor uses one essential cookie to keep your interview session (sid, 30 days) and one short-lived cookie that protects the Gmail sign-in from forgery (oauth_state, 10 minutes). There are no advertising or analytics cookies and no third-party tracking.

Service providers

Cloudflare: hosting and database.
Anthropic: the AI model that runs the interview and condenses information. Anthropic does not use API data to train its models by default.
OpenRouter and Parallel Web Systems: public web search about your company (company name or website only).
Google: sign-in and the Gmail read described above, if you choose to connect.

Each provider processes data only to deliver its part of the service.

Retention and deletion

Interview records and email-derived profiles are kept while your organisation uses Candor, so findings can be reviewed. You can ask us to delete your interview, or anything derived from your Gmail, at any time by emailing ryan@paradigmmachines.ai; we will do so within 30 days. You can also remove Candor's access in your Google Account permissions, although Candor already revokes it straight after use.

Security

All traffic is encrypted in transit (HTTPS). Credentials are stored as encrypted secrets, and access to stored data is limited to the people operating the service.

Children

Candor is a workplace tool and is not intended for anyone under 16.

Changes

If we change this policy, we will update the date above and, for material changes, tell users before they take effect.

Contact

Paradigm Machines · ryan@paradigmmachines.ai