Legal & Privacy

Privacy Policy

Effective October 11, 2026 · Cinnamon AI · Published by Cobbles Tech LLC, Connecticut, USA

1. Our Philosophy & Core Commitments

Cinnamon is built for the most private place on earth: your household. We believe consumer software should respect your family's boundaries by construction, not by marketing promises. Everything in Cinnamon is governed by three foundational rules:

Collect the minimum. We collect only the information strictly required to carry out the household tasks you ask for.
Never sell your data. No advertising, no tracking brokers, no data licensing. Our only business model is paid subscriptions.
Zero model training. Your household conversations, notes, schedules, and documents are never used to train AI models.

2. Services This Policy Covers

This Privacy Policy applies to the Cinnamon website at getcinnamon.ai, the web application at client.getcinnamon.ai, the Cinnamon API at api.getcinnamon.ai, and the Cinnamon mobile and desktop applications (collectively, the "Service").

Cinnamon is designed, built, and published by Cobbles Tech LLC ("Cobbles Tech", "we", "us"), a limited liability company organized under the laws of Connecticut, USA.

3. Information We Collect

The information we process depends on how you interact with Cinnamon and what you ask the agent to do:

Data Category Purpose & Use Retention Policy
Account Information Name and email address provided through Sign in with Google, Sign in with Apple, or email sign-in, used to authenticate you and manage your household account. Retained while your account is active; deleted within 30 days of account cancellation.
Personal Space Content Private tasks, personal notes, individual calendars, private documents, and requests intended only for you. Completely isolated from other household members. Retained while your account exists. You can delete individual items or wipe your space at any time.
Household Group Content Shared chore rotas, family calendars, trip plans, school documents, and household tasks placed into the shared group space for your household (up to 6 members). Retained while the household group exists or until removed by members.
Forwarded Ingestion Data Receipts, tickets, invoices, or schedules sent to your dedicated Cinnamon forwarding email address to convert into household deliverables. Parsed to generate tasks, then retained only as reference documents in your designated space until deleted.
Connected Service Data Calendar, email, or messaging data from external accounts you explicitly connect via OAuth, used solely to execute the specific tasks you request. Accessed on demand; authorization tokens are encrypted and purged immediately when you disconnect the service.
Waitlist & Support Email address and correspondence submitted when joining our waitlist or contacting customer support. Waitlist data retained until launch or unsubscribed. Support threads retained up to 24 months.
Crash Diagnostics & Telemetry De-identified system logs, application crashes, and network latency to ensure uptime and resolve errors. Contains no household content. Automatically purged after 90 days.
Website Cookies Strictly functional session cookies on getcinnamon.ai. We do not use third-party advertising or cross-site tracking cookies. Session only, or up to 30 days for authentication state.

4. How Cinnamon Operates (Agentic Architecture & AI Processing)

Cinnamon is an autonomous AI agent for households. It understands natural instructions, breaks them into executable steps, formulates plans, and coordinates actions. Here is how your data is handled during agent execution:

Enterprise AI Processing With Zero Training

To generate plans, summarize documents, and compose drafts, relevant task context is passed to enterprise frontier model APIs (such as Anthropic and Google). We process requests under enterprise agreements that strictly prohibit training on customer data and require immediate zero-retention discarding of prompt inputs once inference is complete. Neither we nor our AI infrastructure providers train models on your family's records.

Deterministic Human-in-the-Loop Safeguards

Cinnamon operates on a strict "Ask Before Acting" principle. While the agent can conduct research, prepare blueprints, and draft communications autonomously, it always requests explicit human confirmation before taking consequential real-world actions, such as:

  • Sending an email or message outside your household;
  • Booking a reservation or service appointment;
  • Authorizing a financial transaction or purchase;
  • Sharing household records with outside contacts.

Connected Services & Forwarding Ingestion

When you connect Google Calendar or other third-party accounts, Cinnamon requests the minimum necessary OAuth permissions. We never scan your inbox or external accounts for advertising, marketing, or general profiling. Access is limited strictly to executing the specific tasks you assign to the agent.

State-Changing Action Audit Trails & Verification Logs

When Cinnamon executes state-changing operations (such as scheduling events, creating calendar entries, placing orders within your authorized spend boundaries, or dispatching outbound communications), the system creates an immutable audit record within your space. This activity log documents the original prompt, the drafted execution plan, your confirmation or authorization token, and external third-party response codes. These records allow you to inspect, verify, and track every autonomous or assisted action taken on behalf of your household.

Automated Interaction Transparency & External Disclosures

When Cinnamon interacts with external web services, booking platforms, or merchants on your behalf, it adheres to automated identity disclosure standards by indicating that requests originate from an automated AI household assistant configured by an authenticated user. Cinnamon is strictly programmed never to conceal its non-human nature, deceive external parties, or circumvent robotic interaction disclosures.

5. Personal vs. Shared Spaces (Household Isolation)

Every Cinnamon account features two hermetically isolated environments:

  • Personal Space: Visible exclusively to you. Your private tasks, personal reminders, confidential health or career notes, and private concierge threads never appear in the shared household feed.
  • Household / Group Space: Visible to all approved members of your household group (1 to 6 members: the creator plus up to 5 invited family members or housemates).

Member Removal & Data Preservation: If a household member leaves or is removed by the group creator, the departing member immediately loses access to the group's shared tasks and history. However, their personal account, login credentials, and private space remain 100% intact in their own standalone personal environment.

6. What We Never Do

  • We do not sell, rent, or trade your personal information or household data to third parties.
  • We do not display advertisements, use ad-tracking IDs (such as IDFA or GAID), or partner with data brokers.
  • We do not train machine-learning models on your household notes, emails, documents, or conversations.
  • We do not permit cross-tenant data leakage: data from one household is cryptographically segregated from every other household.
  • We do not conceal automated identity: external communications and web interactions conducted by Cinnamon clearly identify the assistant as an AI agent.
  • We do not permit autonomous legal, credit, or housing evaluations: Cinnamon is a household assistant and is prohibited from being used for automated profiling or consequential decision-making affecting legal rights or eligibility.

7. Data Storage, Encryption & Security

We treat your household data with the highest standard of infrastructure security:

  • Encryption in Transit: All communications between your devices, our API, and backend runtime environments are encrypted using modern TLS 1.3 / HTTPS protocols.
  • Encryption at Rest: All databases, documents, and credentials in our Google Cloud Platform (GCP) infrastructure are protected with AES-256 encryption at rest.
  • Token Security: Third-party OAuth tokens and secret keys are stored in secure key vaults with restricted, audited access policies.
  • Network Protection: Infrastructure is protected by Cloud Armor Web Application Firewalls (WAF) and strict role-based access control (RBAC).

While no system can guarantee absolute invulnerability, we continuously monitor and audit our platform against emerging threats. In the event of a security incident affecting your data, we will notify you promptly in accordance with applicable laws.

8. Third Parties & Sub-processors

We share data only with trusted service providers necessary to operate Cinnamon, under strict confidentiality agreements:

  • Cloud Infrastructure: Google Cloud Platform (GCP) and Firebase Hosting for secure computation, databases, and static web hosting in the United States.
  • AI Inference: Enterprise AI model providers (including Anthropic and Google Vertex AI) under zero-data-retention, zero-training enterprise terms.
  • Authentication & App Stores: Apple (App Store distribution, Sign in with Apple, in-app subscriptions) and Google (Sign in with Google).
  • Email Delivery: Resend for sending transactional system notifications, schedule alerts, and authentication links.
  • Legal Authorities: Only when strictly required by a valid court order, subpoena, or applicable law, and only to the narrow extent necessary.

9. Age Requirement (Adults 18+ Only)

Cinnamon is designed for adults aged 18 and older. We do not knowingly collect personal information from individuals under 18 years of age. If you believe that an individual under 18 has created an account or provided personal information, please contact us immediately at help@getcinnamon.ai, and we will promptly terminate the account and purge all associated records.

10. Your Rights, Data Portability & Account Erasure

Regardless of where you reside, you have full ownership and control over your data:

  • Access & Export: You can view all memories, documents, and deliverables stored in Cinnamon at any time, and request a machine-readable export.
  • Correction: You can edit or correct any information Cinnamon remembers about your household directly from the app interface.
  • Granular Deletion: You can delete individual tasks, notes, documents, or memory items at any time.
  • Complete Account Erasure: You can permanently delete your Cinnamon account from the app settings or by emailing help@getcinnamon.ai. Upon confirmation, all personal space data, account credentials, and associated memory items are purged from active production systems within 30 days.

Residents of California (CCPA/CPRA), the European Union / European Economic Area (GDPR), the United Kingdom, and other jurisdictions have statutory privacy rights, including non-discrimination for exercising privacy choices and the right to lodge a complaint with their local supervisory authority.

11. International Data Transfers

Cinnamon operates on cloud servers located in the United States. If you access the Service from outside the United States, your information will be transferred to, stored, and processed in the United States. Where required by applicable law, we implement standard contractual clauses and appropriate technical safeguards to protect international data transfers.

12. Data Retention Schedule

We retain personal information only for as long as necessary to fulfill the purposes outlined in this policy. When you close your account, your data is scheduled for permanent deletion within 30 days, except for minimal business or billing records required to satisfy statutory tax, accounting, or legal compliance obligations.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time as our features, platforms, and regulatory requirements evolve. When we make material changes, we will update the "Effective" date at the top of this document and provide prominent notice through the application or via email. Your continued use of Cinnamon following the effective date of an updated policy signifies your agreement to the revised terms.

14. Contact Us

If you have any questions, feedback, or requests regarding this Privacy Policy or your personal information, please contact us at:

Cinnamon AI Support & Privacy:
Email: help@getcinnamon.ai
Legal: legal@getcinnamon.ai

Cobbles Tech LLC
Connecticut, United States of America